{"report_id":"54bfd114-04b4-4005-abd1-5baa0f1f054a","version":6,"status":"done","tags":["suspicious","telegram_bot"],"date":"2026-04-13T11:36:13Z","url":{"schema":"https","addr":"www.google.com/url?q=https%3A%2F%2Faws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com%2Fdeanx%2Fkdlespw.html\u0026sa=D\u0026sntz=1\u0026usg=AOvVaw3fEgEnb5eB7JEia1ru93J8","fqdn":"www.google.com","domain":"google.com","tld":"com"},"ip":{"addr":"142.251.152.119","port":0,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com/deanx/kdlespw.html","fqdn":"aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com","domain":"aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com","tld":"s3.dualstack.eu-west-2.amazonaws.com"},"title":"View \u0026 Sign Form","dom":{"size":363,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (363), with no line terminators","md5":"f19eb86e16a28f4f024b932658dbff8d","sha1":"2d3ef51209d941b8f91d0ef77fcc7ea0429b24d9","sha256":"20f2663005f771a39d8cede0573711bace3cf760fb427b23b2f9728b2aec19d0","sha512":"31b033d9b1b9e0f1d067d58b031d73be006c6c6a477af4dded4ac7decdc00b193aaae571fce467a86c384bfc419a5ca57332f6c91ec57ad78fc741df644af5b0","ssdeep":"","tlshash":"a0e020fa2d79cc3466b4078e24f6e39c16346550b611da0442dbec6a8f20fd78c92d58","dom_hash":"domhashfa92bf49a0529f3ae8099507699ba65b","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"www.google.com/url?q=https%3A%2F%2Faws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com%2Fdeanx%2Fkdlespw.html\u0026sa=D\u0026sntz=1\u0026usg=AOvVaw3fEgEnb5eB7JEia1ru93J8","fqdn":"www.google.com","domain":"google.com","tld":"com"},"ip":{"addr":"142.251.152.119","port":0,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-05-18T11:36:13Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":3,"urlquery":2,"analyzer":2}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-04-13T11:35:49Z","timestamp":1776080149,"ip_dst":{"addr":"104.26.13.205","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":33884,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI","source":"{\"timestamp\":\"2026-04-13T11:35:49.824454+0000\",\"flow_id\":2218139434974804,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.21\",\"src_port\":33884,\"dest_ip\":\"104.26.13.205\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2047703,\"rev\":1,\"signature\":\"ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Any\"],\"attack_target\":[\"Client_and_Server\"],\"confidence\":[\"High\"],\"created_at\":[\"2023_08_22\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"reviewed_at\":[\"2023_08_22\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"External_IP_Lookup\"],\"updated_at\":[\"2023_08_22\"]}},\"tls\":{\"sni\":\"api.ipify.org\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":915,\"bytes_toclient\":3512,\"start\":\"2026-04-13T11:35:49.818772+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-04-13T11:35:50Z","timestamp":1776080150,"ip_dst":{"addr":"149.154.166.110","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"ip_src":{"addr":"Client IP","port":37522,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)","source":"{\"timestamp\":\"2026-04-13T11:35:50.390603+0000\",\"flow_id\":809433111608610,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.21\",\"src_port\":37522,\"dest_ip\":\"149.154.166.110\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2033967,\"rev\":1,\"signature\":\"ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2021_09_16\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2021_09_16\"]}},\"tls\":{\"sni\":\"api.telegram.org\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"15af977ce25de452b96affa2addb1036\",\"string\":\"771,4866,43-51\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":6,\"bytes_toserver\":918,\"bytes_toclient\":4500,\"start\":\"2026-04-13T11:35:50.343330+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-04-13T11:35:50Z","timestamp":1776080150,"ip_dst":{"addr":"149.154.166.110","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"ip_src":{"addr":"Client IP","port":37524,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)","source":"{\"timestamp\":\"2026-04-13T11:35:50.395046+0000\",\"flow_id\":1785017753025958,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.21\",\"src_port\":37524,\"dest_ip\":\"149.154.166.110\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2033967,\"rev\":1,\"signature\":\"ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2021_09_16\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2021_09_16\"]}},\"tls\":{\"sni\":\"api.telegram.org\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"15af977ce25de452b96affa2addb1036\",\"string\":\"771,4866,43-51\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":6,\"bytes_toserver\":789,\"bytes_toclient\":4500,\"start\":\"2026-04-13T11:35:50.343462+0000\"}}"}],"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-04-13","alert":"Detects file containing Telegram Bot API","trigger":"aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com/deanx/kdlespw.html","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-13","alert":"Sinkholed","trigger":"amit08.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"summary":[{"fqdn":"tm.filter","ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2024-12-07T09:27:49.366408Z","last_seen":"2026-04-09T18:18:08.468173Z","alert_count":0,"request_count":1,"received_data":0,"sent_data":616,"comment":"","tags":null,"fingerprints":null},{"fqdn":"aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com","ip":{"addr":"3.5.246.74","port":443,"asn":16509,"as":"AMAZON-02","country":"United Kingdom","country_code":"GB"},"domain_registered":"2005-08-18","domain_rank":0,"first_seen":"2026-04-07T10:52:16.253735Z","last_seen":"2026-04-07T10:52:16.253735Z","alert_count":2,"request_count":5,"received_data":15349880,"sent_data":3050,"comment":"","tags":null,"fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Cloudflare Browser Insights","description":"Cloudflare Browser Insights is a tool that measures the performance of websites from the perspective of users.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Analytics","RUM"]}]},{"fqdn":"ipapi.co","ip":{"addr":"172.67.69.226","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2016-04-19","domain_rank":7936,"first_seen":"2017-01-31T09:07:01Z","last_seen":"2026-04-08T15:54:12.890284Z","alert_count":0,"request_count":1,"received_data":2567,"sent_data":570,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"api.ipify.org","ip":{"addr":"104.26.13.205","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2014-01-05","domain_rank":8166,"first_seen":"2014-10-06T12:38:43Z","last_seen":"2026-04-06T11:59:43.380237Z","alert_count":0,"request_count":1,"received_data":269,"sent_data":569,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"static.cloudflareinsights.com","ip":{"addr":"104.16.80.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2019-08-30","domain_rank":4073,"first_seen":"2019-09-24T14:34:56Z","last_seen":"2026-04-12T22:43:52.947527Z","alert_count":0,"request_count":3,"received_data":60963,"sent_data":1902,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"api.telegram.org","ip":{"addr":"149.154.166.110","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"domain_registered":"2003-12-15","domain_rank":206724,"first_seen":"2015-06-25T10:09:00Z","last_seen":"2026-04-11T11:46:30.227188Z","alert_count":0,"request_count":2,"received_data":1357,"sent_data":1383,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"www.google.com","ip":{"addr":"142.251.151.119","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"1997-09-15","domain_rank":22,"first_seen":"2015-05-10T13:11:19Z","last_seen":"2026-04-12T22:38:35.592234Z","alert_count":0,"request_count":1,"received_data":1604,"sent_data":718,"comment":"","tags":null,"fingerprints":[{"name":"Google Web Server","description":"","website":"https://en.wikipedia.org/wiki/Google_Web_Server","common_platform_enumeration":"cpe:2.3:a:google:web_server:*:*:*:*:*:*:*:*","icon":"Google.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"amit08.com","ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2025-11-27","domain_rank":0,"first_seen":"2026-03-02T12:45:17.580882Z","last_seen":"2026-04-07T04:31:55.233299Z","alert_count":1,"request_count":1,"received_data":0,"sent_data":496,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":[{"md5":"4adba19a703f9c2e7b766ef89c682031","sha1":"97ef46f81777a5ad8e233749b4abe581174d57fe","sha256":"d5b95e129d6b01f122044dc433195a19ce2a3ed0ea9a3756622bfeb9a4ff65f7","sha512":"ac173836dad8ccddcf43468e13294b20867ed7ba8139c4bd3eee4e3a3374f5173b533702147508bac3363e034d47e8f7d206b8081d7f3b3cc2ec9d9a398e3b23","magic":"PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections","size":15293232,"url":{"schema":"https","addr":"aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com/deanx/Doc_14093.exe","fqdn":"aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com","domain":"aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com","tld":"s3.dualstack.eu-west-2.amazonaws.com"},"ip":{"addr":"3.5.246.74","port":443,"asn":16509,"as":"AMAZON-02","country":"United Kingdom","country_code":"GB"},"archive":null,"alerts":{"urlquery":null,"analyzer":null}}],"telegram":[{"url":{"schema":"https","addr":"aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com/deanx/kdlespw.html","fqdn":"aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com","domain":"aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com","tld":"s3.dualstack.eu-west-2.amazonaws.com"},"ip":{"addr":"3.5.246.74","port":443,"asn":16509,"as":"AMAZON-02","country":"United Kingdom","country_code":"GB"},"md5":"ee0e7285848418823cb98002ad654ac9","sha1":"9886aecff14df7284a8a72aeee801e3eb714976a","sha256":"8e5f57c6e9854ec635c4a5ba8092b402e75c43b526b9d79f07ab81c75f53293e","sha512":"bb5c98cdef7fe86dc00c93f6a08ffaae6ecb42ad2ee183aa7a73fc6e2f35743d7afdad861e3c1821af2740ca001374c6a3083809527773f8298b419d82500a24","size":4758,"token":"8646583242:AAHbUJprkpqCDMmCl49nO3YzNWYw_ZFnvP8","is_revoked":false,"bot":{"token":"8646583242:AAHbUJprkpqCDMmCl49nO3YzNWYw_ZFnvP8","user_id":"8646583242","username":"spoertybet20399_bot","first_name":"spoertybet20399_bot","last_name":"","chat":{"chat_id":"513257544","title":"","type":"private","bot_is":"member","total_users":2,"active_members":null,"admins":null},"pending_messages":0}}],"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com/deanx/kdlespw.html","fqdn":"aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com","domain":"aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com","tld":"s3.dualstack.eu-west-2.amazonaws.com"},"ip":{"addr":"3.5.246.74","port":443,"asn":16509,"as":"AMAZON-02","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":true,"md5":"635eaa506ddc1c5e2693458197135dca","sha1":"64754c848bf3661c0156bfb56eafc4018e035c94","sha256":"a056b58ab3b498f730f07361d8aa20554bba0f56f4982e003ff7c133f6d31ed8","sha512":"5e51c1ecc25f0d53e3fd6b885a4cc6d60a62b1b4f4426b39569afdc5ef2df94ae1ea96a507c21f574b35a3f1e15c0c25f2d9471b94b3ecb97cf67abfa2ca409f","ssdeep":"768:3N1STrXbmqQYq5KQ29ObLoNLfiewzgJb5ubf3wzvfVzVS25p7lPBDJkw5zLY+C:3N1S3XbmqQrZ8NLfqMVEb/Y7lPB9xRLC","tlshash":"5813d54d31de2433ab5330b685af7349b73d9368611950647d2ccad42f2c93a53b6fa8","size":44020,"data":"","first_seen":"2026-03-02T12:45:26.48697Z","last_seen":"2026-07-31T03:34:01.211339Z","times_seen":73,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com/deanx/kdlespw.html","fqdn":"aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com","domain":"aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com","tld":"s3.dualstack.eu-west-2.amazonaws.com"},"ip":{"addr":"3.5.246.74","port":443,"asn":16509,"as":"AMAZON-02","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":true,"md5":"ee0e7285848418823cb98002ad654ac9","sha1":"9886aecff14df7284a8a72aeee801e3eb714976a","sha256":"8e5f57c6e9854ec635c4a5ba8092b402e75c43b526b9d79f07ab81c75f53293e","sha512":"bb5c98cdef7fe86dc00c93f6a08ffaae6ecb42ad2ee183aa7a73fc6e2f35743d7afdad861e3c1821af2740ca001374c6a3083809527773f8298b419d82500a24","ssdeep":"96:nNJulWOL8uX/p/dRI/k+2cUKReR+BRUF88xiATT/1XCs+4ZcEdxc2FE95CiMizTH:n/8WOLbv1TO+Zq0TTxCszcEd6a/iMi3H","tlshash":"baa151af21bb01060a5378bd6a4b55003033f04b358adc9abb5c4b945f162bc61777dc","size":4758,"data":"","first_seen":"2026-04-13T07:47:33.059481Z","last_seen":"2026-04-13T11:36:18.734574Z","times_seen":2,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-04-13","alert":"Detects file containing Telegram Bot API","trigger":"aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com/deanx/kdlespw.html","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}},{"url":{"schema":"https","addr":"static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015","fqdn":"static.cloudflareinsights.com","domain":"cloudflareinsights.com","tld":"com"},"ip":{"addr":"104.16.80.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"ec18af6d41f6f278b6aed3bdabffa7bc","sha1":"62c9e2cab76b888829f3c5335e91c320b22329ae","sha256":"8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f","sha512":"669b0e9a545057acbdd3b4c8d1d2811eaf4c776f679da1083e591ff38ae7684467abacef5af3d4aabd9fb7c335692dbca0def63ddac2cd28d8e14e95680c3511","ssdeep":"384:XriNpnjyMkg8XMtExRN1w29JIOzahXtO2nJ65:GijgSWuanfJ65","tlshash":"8d92d7def645723613f76076913f220b733b35a528068459812adbc22c3d98f6267f6e","size":19948,"data":"","first_seen":"2024-06-07T09:21:23Z","last_seen":"2026-07-30T15:53:34.481583Z","times_seen":337625,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015","fqdn":"static.cloudflareinsights.com","domain":"cloudflareinsights.com","tld":"com"},"ip":{"addr":"104.16.80.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"ec18af6d41f6f278b6aed3bdabffa7bc","sha1":"62c9e2cab76b888829f3c5335e91c320b22329ae","sha256":"8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f","sha512":"669b0e9a545057acbdd3b4c8d1d2811eaf4c776f679da1083e591ff38ae7684467abacef5af3d4aabd9fb7c335692dbca0def63ddac2cd28d8e14e95680c3511","ssdeep":"384:XriNpnjyMkg8XMtExRN1w29JIOzahXtO2nJ65:GijgSWuanfJ65","tlshash":"8d92d7def645723613f76076913f220b733b35a528068459812adbc22c3d98f6267f6e","size":19948,"data":"","first_seen":"2024-06-07T09:21:23Z","last_seen":"2026-07-30T15:53:34.481583Z","times_seen":337625,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015","fqdn":"static.cloudflareinsights.com","domain":"cloudflareinsights.com","tld":"com"},"ip":{"addr":"104.16.80.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"ec18af6d41f6f278b6aed3bdabffa7bc","sha1":"62c9e2cab76b888829f3c5335e91c320b22329ae","sha256":"8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f","sha512":"669b0e9a545057acbdd3b4c8d1d2811eaf4c776f679da1083e591ff38ae7684467abacef5af3d4aabd9fb7c335692dbca0def63ddac2cd28d8e14e95680c3511","ssdeep":"384:XriNpnjyMkg8XMtExRN1w29JIOzahXtO2nJ65:GijgSWuanfJ65","tlshash":"8d92d7def645723613f76076913f220b733b35a528068459812adbc22c3d98f6267f6e","size":19948,"data":"","first_seen":"2024-06-07T09:21:23Z","last_seen":"2026-07-30T15:53:34.481583Z","times_seen":337625,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.google.com/url?q=https%3A%2F%2Faws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com%2Fdeanx%2Fkdlespw.html\u0026sa=D\u0026sntz=1\u0026usg=AOvVaw3fEgEnb5eB7JEia1ru93J8","fqdn":"www.google.com","domain":"google.com","tld":"com"},"ip":{"addr":"142.251.151.119","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"eventHandler","is_inline":false,"md5":"67c336105bd0154e856aa9feb7a39fd1","sha1":"c20f1a48063cd2fe22cb369d36d154d3fa3e63ac","sha256":"a9a1288dde33fa2e32b95332df812fd78d305f672c4f218ca584448fe34980a2","sha512":"46d57dc263d3597361c010243aaec62d6d49700c49704c37ca6e1c0086f529ed7d6f46f5b61376ccbf716e7e5885c10e03fa6d70599ad8ed6046363edce86a2b","ssdeep":"","tlshash":"91c02bd700a4c092fbc2f201f9d137943ebb601f9094e1b0c904c641c604c15234150a","size":148,"data":"","first_seen":"2026-04-13T07:47:33.05303Z","last_seen":"2026-04-13T11:36:18.735513Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:blank","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"f03c1784ba21ba872e98e220b3015393","sha1":"fcd72e8629c710376f741c3ae019aac12aab9be1","sha256":"13099cabfeed1ba898304dd91601f3bb645053df6835606f4f04ad281beadfc6","sha512":"1c1931c81abe261ffb692f8f0ac1bee7000026991c123a81d9233fc6ee12214f95dee79446a110d342ef07b5dff22a358f89f9d61fced0304e73d7d1566c4b40","ssdeep":"","tlshash":"f4d0a7aa29798d306798024e65bbe3a8267165506611a90081dbdc5b5a21fd34ce1a68","size":236,"data":"","first_seen":"2026-03-02T12:45:26.484851Z","last_seen":"2026-07-31T03:34:01.217172Z","times_seen":70,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com/deanx/kdlespw.html","fqdn":"aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com","domain":"aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com","tld":"s3.dualstack.eu-west-2.amazonaws.com"},"ip":{"addr":"3.5.246.74","port":443,"asn":16509,"as":"AMAZON-02","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":true,"md5":"2b02ce1e7dd471b4d8110cfa0ec5ccce","sha1":"89966c511ebf4ba9110a88aa1f6149343925fc7d","sha256":"3ad723ea8f631c7069e3dc66fc92fe4d8eb6c0bb16f92278c4b5f78c6ade059a","sha512":"dac1dc8206f126870ebaf0830aaffba72cdf396ffe0f8c69650b22b6a8ee44de255e796f5815c25671f29d89d27dd06df7651f428a9657436254005cb0fd2a46","ssdeep":"","tlshash":"7d1104753b1a2534c6c5414b317ee7a93d3250217a02a044c36ddc285d1cf8718efdbe","size":923,"data":"","first_seen":"2026-03-02T12:45:26.495064Z","last_seen":"2026-07-31T03:34:01.216151Z","times_seen":70,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015","fqdn":"static.cloudflareinsights.com","domain":"cloudflareinsights.com","tld":"com"},"ip":{"addr":"104.16.80.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com/deanx/kdlespw.html","date":"2026-04-13T11:35:49.713Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cloudflareinsights.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 17 Feb 2026 14:29:28 GMT","end":"Mon, 18 May 2026 15:29:15 GMT"},"fingerprint":{"sha1":"8B:A9:51:50:78:B2:5E:75:31:54:23:BC:80:D6:CA:53:34:E5:CD:8F","sha256":"AF:D9:FB:4F:B0:E1:BD:80:DF:22:93:A7:4A:99:5B:50:0A:BE:47:59:37:98:C6:BF:C5:DF:8D:8F:F0:8D:FD:23"}}},"request":{"raw":"GET /beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015 HTTP/1.1\r\nHost: static.cloudflareinsights.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Mon, 13 Apr 2026 11:35:49 GMT\r\ncontent-type: text/javascript;charset=UTF-8\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=86400\r\netag: W/\"2024.6.1\"\r\nlast-modified: Thu, 19 Feb 2026 17:45:24 GMT\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: cloudflare\r\ncf-ray: 9eba2b67af33568f-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":19948,"size_decoded":0,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (19948), with no line terminators","md5":"ec18af6d41f6f278b6aed3bdabffa7bc","sha1":"62c9e2cab76b888829f3c5335e91c320b22329ae","sha256":"8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f","sha512":"669b0e9a545057acbdd3b4c8d1d2811eaf4c776f679da1083e591ff38ae7684467abacef5af3d4aabd9fb7c335692dbca0def63ddac2cd28d8e14e95680c3511","ssdeep":"384:XriNpnjyMkg8XMtExRN1w29JIOzahXtO2nJ65:GijgSWuanfJ65","tlshash":"8d92d7def645723613f76076913f220b733b35a528068459812adbc22c3d98f6267f6e","first_seen":"2024-06-07T09:21:23Z","last_seen":"2026-07-30T15:53:34.481583Z","times_seen":337625,"resource_available":true,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"wss","addr":"tm.filter:1503/","fqdn":"tm.filter","domain":"tm.filter","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"websocket","requested_by":"https://aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com/deanx/kdlespw.html","date":"2026-04-13T11:35:49.805Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: tm.filter:1503\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nSec-WebSocket-Version: 13\r\nOrigin: https://aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com\r\nSec-WebSocket-Extensions: permessage-deflate\r\nSec-WebSocket-Key: ULwfTukZ/OhFhXFj0qJ+Vw==\r\nDNT: 1\r\nConnection: keep-alive, Upgrade\r\nSec-Fetch-Dest: websocket\r\nSec-Fetch-Mode: websocket\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-31T04:31:18.068558Z","times_seen":17628370,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com/cdn-cgi/rum?","fqdn":"aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com","domain":"aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com","tld":"s3.dualstack.eu-west-2.amazonaws.com"},"ip":{"addr":"3.5.246.74","port":443,"asn":16509,"as":"AMAZON-02","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com/deanx/kdlespw.html","date":"2026-04-13T11:35:49.834Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3.eu-west-2.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Mon, 17 Nov 2025 00:00:00 GMT","end":"Wed, 04 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"47:4E:C3:25:4B:EA:B5:40:B3:47:B1:59:B5:69:23:DD:A8:AA:09:FA","sha256":"3B:B6:72:B0:01:B0:77:3B:D0:F1:61:B8:CC:7F:7F:97:0C:F9:D2:72:73:BF:F5:EC:4E:DC:25:FF:CD:2A:BC:A0"}}},"request":{"raw":"POST /cdn-cgi/rum? HTTP/1.1\r\nHost: aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\ncontent-type: application/json\r\nContent-Length: 1206\r\nOrigin: https://aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com/deanx/kdlespw.html\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":1206,"data":"{\"memory\":{},\"resources\":[],\"referrer\":\"https://www.google.com/\",\"eventType\":1,\"firstPaint\":0,\"firstContentfulPaint\":461,\"startTime\":1776080149272,\"versions\":{\"fl\":\"2024.11.0\",\"js\":\"2024.6.1\",\"timings\":2},\"pageloadId\":\"16a739ba-1ae7-4aff-8eb2-e3ee63cadb14\",\"location\":\"https://aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com/deanx/kdlespw.html\",\"nt\":\"navigate\",\"timingsV2\":{\"unloadEventStart\":0,\"unloadEventEnd\":0,\"domInteractive\":449,\"domContentLoadedEventStart\":525,\"domContentLoadedEventEnd\":531,\"domComplete\":532,\"loadEventStart\":532,\"loadEventEnd\":545,\"type\":\"navigate\",\"redirectCount\":0,\"initiatorType\":\"navigation\",\"nextHopProtocol\":\"http/1.1\",\"workerStart\":0,\"redirectStart\":0,\"redirectEnd\":0,\"fetchStart\":0,\"domainLookupStart\":15,\"domainLookupEnd\":133,\"connectStart\":133,\"connectEnd\":220,\"secureConnectionStart\":167,\"requestStart\":220,\"responseStart\":299,\"responseEnd\":326,\"transferSize\":54146,\"encodedBodySize\":53588,\"decodedBodySize\":53588,\"name\":\"https://aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com/deanx/kdlespw.html\",\"entryType\":\"navigation\",\"startTime\":0,\"duration\":545},\"siteToken\":\"f87f52325f5a47a3be0745acde12e881\",\"st\":2}"}},"response":{"raw":"HTTP/1.1 405 Method Not Allowed\r\nx-amz-request-id: 4M13CBJHB7BSYNR2\r\nx-amz-id-2: gHLNyPdZqSCxD416G0PqwswEd4UK7dRPdOS4s0sn136urgyy0XJ5u1dowLf+poObd+AmM8fovXZ8D0Dzd5VFhhaIjcPvSG4o\r\nAllow: HEAD, DELETE, GET, PUT\r\nContent-Type: application/xml\r\nTransfer-Encoding: chunked\r\nDate: Mon, 13 Apr 2026 11:35:49 GMT\r\nConnection: close\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"405","status_text":"Method Not Allowed","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":368,"size_decoded":0,"mime_type":"application/xml","magic":"XML 1.0 document, ASCII text, with very long lines (329)","md5":"01abeccdb42ffd3ca5beb84aee783d24","sha1":"70020930df7c884620f94378fd3c198725df8427","sha256":"c81631e09cbbeaafdf8051fca50e0917b0c2188914c30f698b9a0d62e8212283","sha512":"8f18ec767af66628980e1dbe4999baa5dfa7075c9cd5c40a7b3a1de24bfeb296b700fbb376ffee71b0b6ad29e404fda6ad10bb1a8dbc135c320c2d5f8a196a8c","ssdeep":"","tlshash":"70e0c032375a703c4e61864d6e06d279ab08007495a32a38bec306a33fd30978f97e34","first_seen":"2026-04-13T11:36:18.726037Z","last_seen":"2026-04-13T11:36:18.726037Z","times_seen":1,"resource_available":false,"data":null}},"time_used":49,"timings":{"blocked":19,"dns":0,"connect":0,"send":0,"wait":29,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ipapi.co/91.90.42.154/json/","fqdn":"ipapi.co","domain":"ipapi.co","tld":"co"},"ip":{"addr":"172.67.69.226","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com/deanx/kdlespw.html","date":"2026-04-13T11:35:50.012Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"ipapi.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 16 Feb 2026 15:59:25 GMT","end":"Sun, 17 May 2026 16:59:23 GMT"},"fingerprint":{"sha1":"37:8F:7A:B7:BF:60:24:8D:1C:83:4F:C2:59:C3:0A:0C:EE:B3:75:A5","sha256":"8D:E6:B5:3D:41:1D:D8:B2:FA:03:95:07:E2:54:7C:1F:A2:22:E9:05:05:5E:D2:99:7D:DF:46:3F:32:52:53:F9"}}},"request":{"raw":"GET /91.90.42.154/json/ HTTP/1.1\r\nHost: ipapi.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com/\r\nOrigin: https://aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Mon, 13 Apr 2026 11:35:50 GMT\r\ncontent-type: application/json\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\nallow: OPTIONS, HEAD, OPTIONS, GET, POST\r\nx-frame-options: DENY\r\nvary: Host, origin\r\naccess-control-allow-origin: https://aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com\r\nx-content-type-options: nosniff\r\nreferrer-policy: same-origin\r\ncross-origin-opener-policy: same-origin\r\ncontent-security-policy-report-only: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.stripe.com https://*.paddle.com https://www.google.com https://www.gstatic.com https://maps.gstatic.com https://maps.googleapis.com https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/; style-src 'self' 'unsafe-inline' https://*.paddle.com https://fonts.gstatic.com https://fonts.googleapis.com; img-src 'self' data: https://ipapi.co https://maps.gstatic.com https://maps.googleapis.com https://*.stripe.com; font-src 'self' data: https://fonts.gstatic.com https://fonts.googleapis.com; frame-src 'self' https://www.google.com https://*.stripe.com https://*.paddle.com https://www.google.com/recaptcha/ https://recaptcha.google.com/recaptcha/; connect-src 'self' https://ipapi.co/ https://*.paddle.com https://*.stripe.com https://maps.googleapis.com https://www.google.com/recaptcha/; object-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'self';\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bY7ghgffElt%2FmzyLCZV90vxsA6qwL6yn0%2BCAyhNM41%2BEetMPupWMIlGReVEDBNJYIMbETqt%2BJmVEBryg5c1k3%2B7xbltnRrNCtQH%2BFkUmEnLBqFu4EVY3cZ6E\"}]}\r\ncontent-encoding: br\r\ncf-ray: 9eba2b69ab40a0f0-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":744,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"89df796ab79917fd97143353c6fbe887","sha1":"9002bf3fb180a0bdea493caa8489a9ce4da08c46","sha256":"8e66f081090f0ce97511f66051f92af469ddcd141d307e9cde761fbe1b0816e6","sha512":"44b44189e1a3f540b2f885c438df5c909ddfb6750827c9b3f64f749c49a576506d497ee1dd04560949386e1ffa298cb867ac55bb19089ce4b0ad4afe31fb9310","ssdeep":"","tlshash":"a0012f68e4680ebbacb8035cb0286907123422074e56398e7fd09b4d0f8e8bf30b134e","first_seen":"2026-04-08T09:13:34.032533Z","last_seen":"2026-04-22T09:34:42.053612Z","times_seen":846,"resource_available":false,"data":null}},"time_used":283,"timings":{"blocked":16,"dns":1,"connect":1,"send":0,"wait":246,"receive":0,"ssl":16},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.telegram.org/bot8646583242:AAHbUJprkpqCDMmCl49nO3YzNWYw_ZFnvP8/sendMessage","fqdn":"api.telegram.org","domain":"telegram.org","tld":"org"},"ip":{"addr":"149.154.166.110","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com/deanx/kdlespw.html","date":"2026-04-13T11:35:50.341Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.telegram.org","organization":""},"issuer":{"commonName":"Go Daddy Secure Certificate Authority - G2","organization":"GoDaddy.com, Inc."},"validity":{"start":"Tue, 25 Mar 2025 13:09:41 GMT","end":"Sun, 26 Apr 2026 13:09:41 GMT"},"fingerprint":{"sha1":"8B:AA:E2:A3:48:3C:0E:62:9D:B5:49:3A:BD:47:60:BA:AD:18:AA:8D","sha256":"80:58:CE:C7:28:68:D2:99:42:91:1E:43:06:54:D2:D6:F0:9C:DD:E2:F7:6F:68:A0:8A:EA:0C:15:FB:DB:8C:CD"}}},"request":{"raw":"OPTIONS /bot8646583242:AAHbUJprkpqCDMmCl49nO3YzNWYw_ZFnvP8/sendMessage HTTP/1.1\r\nHost: api.telegram.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com/\r\nOrigin: https://aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 204 No Content\r\nserver: nginx/1.18.0\r\ndate: Mon, 13 Apr 2026 11:35:50 GMT\r\naccess-control-max-age: 86400\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: content-type\r\naccess-control-expose-headers: Content-Length,Content-Type,Date,Server,Connection\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-31T04:31:18.068558Z","times_seen":17628370,"resource_available":true,"data":null}},"time_used":323,"timings":{"blocked":150,"dns":4,"connect":23,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.google.com/url?q=https%3A%2F%2Faws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com%2Fdeanx%2Fkdlespw.html\u0026sa=D\u0026sntz=1\u0026usg=AOvVaw3fEgEnb5eB7JEia1ru93J8","fqdn":"www.google.com","domain":"google.com","tld":"com"},"ip":{"addr":"142.251.151.119","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-04-13T11:35:48.973Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 23 Mar 2026 08:39:53 GMT","end":"Mon, 15 Jun 2026 08:39:52 GMT"},"fingerprint":{"sha1":"84:73:AD:21:D7:99:85:74:5C:48:5A:0D:AC:D6:69:F6:B8:C0:F7:92","sha256":"E0:8F:67:97:65:DF:94:C4:50:AD:BB:CB:88:9B:3D:53:89:9B:60:FF:F3:D8:C7:40:94:0F:14:65:BC:FB:C3:B8"}}},"request":{"raw":"GET /url?q=https%3A%2F%2Faws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com%2Fdeanx%2Fkdlespw.html\u0026sa=D\u0026sntz=1\u0026usg=AOvVaw3fEgEnb5eB7JEia1ru93J8 HTTP/1.1\r\nHost: www.google.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: SOCS=CAESHAgBEhJnd3NfMjAyMjA5MjktMF9SQzEaAnJvIAEaBgiAkvOZBg\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlocation: https://aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com/deanx/kdlespw.html\r\ncache-control: private\r\ncontent-type: text/html; charset=UTF-8\r\nstrict-transport-security: max-age=31536000\r\np3p: CP=\"This is not a P3P policy! See g.co/p3phelp for more info.\"\r\ndate: Mon, 13 Apr 2026 11:35:49 GMT\r\nserver: gws\r\ncontent-length: 571\r\nx-xss-protection: 0\r\nexpires: Mon, 13 Apr 2026 11:35:49 GMT\r\nset-cookie: __Secure-ENID=32.SE=ZU0JxoDYvCPJM9E2xziwJLluB6BByIAG295zFEfr1Lcsfq1i6Dmj2RGv-jeoN5NanEGfUp7vdM9wm4AjCF8Lb_XQqW5rCS-4dD_uebV6i7g4LaLyo3UNVgp35fD2bYNpqKXFXkmBU8K0thNPL01JsKShMsYnT3sYwY2VMHhcFFFtCfiz9Uz1ycECcunATdAOZjZ0yd49WzjQyubW7NzEKODPRYnu5TD7ekFjyUqICKg_nETjX1QmDhBy1NCwiJR-M6RKXtfzszEPgpM3kg; expires=Fri, 14-May-2027 03:54:07 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax\n__Secure-BUCKET=CBM; expires=Sat, 10-Oct-2026 11:35:49 GMT; path=/; domain=.google.com; Secure; HttpOnly\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Web Server","description":"","website":"https://en.wikipedia.org/wiki/Google_Web_Server","common_platform_enumeration":"cpe:2.3:a:google:web_server:*:*:*:*:*:*:*:*","icon":"Google.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":571,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"9ce93f28de4172275b2c5435e2ba0baa","sha1":"cc16aee62b7b8b24aa58dbdb18934cc3328daecb","sha256":"03e069aece344fa00b75e9d9e1d2347228fb42882b6794ecaa4c9e71b8da6fa0","sha512":"3fc7947a52992472743bd9158c3dc5656331f8d09a6b066a7587611146f5af28e0db791c1ce5752c50673bd0a756500a3f867456b7ea44edfac2ceb0fe9581a4","ssdeep":"","tlshash":"def08be908e0406afbd1f245f9c473547eaa640ec098c9b8c920c79dcd44e1463c1a56","first_seen":"2026-04-13T07:47:33.039107Z","last_seen":"2026-04-13T11:36:18.727712Z","times_seen":2,"resource_available":false,"data":null}},"time_used":283,"timings":{"blocked":110,"dns":1,"connect":21,"send":0,"wait":59,"receive":0,"ssl":89},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com/deanx/kdlespw.html","fqdn":"aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com","domain":"aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com","tld":"s3.dualstack.eu-west-2.amazonaws.com"},"ip":{"addr":"3.5.246.74","port":443,"asn":16509,"as":"AMAZON-02","country":"United Kingdom","country_code":"GB"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-04-13T11:35:49.288Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3.eu-west-2.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Mon, 17 Nov 2025 00:00:00 GMT","end":"Wed, 04 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"47:4E:C3:25:4B:EA:B5:40:B3:47:B1:59:B5:69:23:DD:A8:AA:09:FA","sha256":"3B:B6:72:B0:01:B0:77:3B:D0:F1:61:B8:CC:7F:7F:97:0C:F9:D2:72:73:BF:F5:EC:4E:DC:25:FF:CD:2A:BC:A0"}}},"request":{"raw":"GET /deanx/kdlespw.html HTTP/1.1\r\nHost: aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.google.com/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: uaxlDMOnEDmcxnCBINqazQgxO4cVBvPKHwhBfgjI/VCFop8bdLLz6uDj4hU0gpBsTNsv7djBqbdhecl1h4plmvrouqqxd/fp\r\nx-amz-request-id: 4M10FQF6YQ5ZZDN3\r\nDate: Mon, 13 Apr 2026 11:35:50 GMT\r\nLast-Modified: Fri, 10 Apr 2026 20:12:50 GMT\r\nETag: \"154eccc2ba34040711b317f20b0cb73b\"\r\nx-amz-server-side-encryption: AES256\r\nx-amz-meta-checksum-sha256: 5ab72a1bdd98efb118e9443d7af995cb76ab1ca63a11c03dbb74abd2dba2ae51\r\nx-amz-meta-s3b-last-modified: 20260410T201210Z\r\nAccept-Ranges: bytes\r\nContent-Type: text/html\r\nContent-Length: 53588\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare Browser Insights","description":"Cloudflare Browser Insights is a tool that measures the performance of websites from the perspective of users.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Analytics","RUM"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":53588,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (44047), with CRLF line terminators","md5":"154eccc2ba34040711b317f20b0cb73b","sha1":"0fe56cc51412d630824deac9d3b8310f985f9902","sha256":"5ab72a1bdd98efb118e9443d7af995cb76ab1ca63a11c03dbb74abd2dba2ae51","sha512":"17d76ca16f25fc669a7e13a7f1ae849884ccc355f0077eafdb088aa4bf823548cc018fc344c6625a8d1fdb90bc285b9b6dda78ce822be37d5b959c7490979bcb","ssdeep":"1536:HN1S3XbmqQrZ8NLfqMVEb/Y7lPB9xRLo76jjoh4B88ix/L:HNE6qQrqNBJ7lO6noh44L","tlshash":"0a33f74d31de20339a6331f59aafb345f739926a610950507d2ccad42f3893a52b7fa8","first_seen":"2026-04-13T07:47:33.034185Z","last_seen":"2026-04-13T11:36:18.728386Z","times_seen":2,"resource_available":false,"data":null}},"time_used":515,"timings":{"blocked":203,"dns":118,"connect":30,"send":0,"wait":80,"receive":27,"ssl":52},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-04-13","alert":"Detects file containing Telegram Bot API","trigger":"aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com/deanx/kdlespw.html","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]}},{"url":{"schema":"https","addr":"static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015","fqdn":"static.cloudflareinsights.com","domain":"cloudflareinsights.com","tld":"com"},"ip":{"addr":"104.16.80.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com/deanx/kdlespw.html","date":"2026-04-13T11:35:49.709Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cloudflareinsights.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 17 Feb 2026 14:29:28 GMT","end":"Mon, 18 May 2026 15:29:15 GMT"},"fingerprint":{"sha1":"8B:A9:51:50:78:B2:5E:75:31:54:23:BC:80:D6:CA:53:34:E5:CD:8F","sha256":"AF:D9:FB:4F:B0:E1:BD:80:DF:22:93:A7:4A:99:5B:50:0A:BE:47:59:37:98:C6:BF:C5:DF:8D:8F:F0:8D:FD:23"}}},"request":{"raw":"GET /beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015 HTTP/1.1\r\nHost: static.cloudflareinsights.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Mon, 13 Apr 2026 11:35:49 GMT\r\ncontent-type: text/javascript;charset=UTF-8\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=86400\r\netag: W/\"2024.6.1\"\r\nlast-modified: Thu, 19 Feb 2026 17:45:24 GMT\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: cloudflare\r\ncf-ray: 9eba2b67af2e568f-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":19948,"size_decoded":0,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (19948), with no line terminators","md5":"ec18af6d41f6f278b6aed3bdabffa7bc","sha1":"62c9e2cab76b888829f3c5335e91c320b22329ae","sha256":"8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f","sha512":"669b0e9a545057acbdd3b4c8d1d2811eaf4c776f679da1083e591ff38ae7684467abacef5af3d4aabd9fb7c335692dbca0def63ddac2cd28d8e14e95680c3511","ssdeep":"384:XriNpnjyMkg8XMtExRN1w29JIOzahXtO2nJ65:GijgSWuanfJ65","tlshash":"8d92d7def645723613f76076913f220b733b35a528068459812adbc22c3d98f6267f6e","first_seen":"2024-06-07T09:21:23Z","last_seen":"2026-07-30T15:53:34.481583Z","times_seen":337625,"resource_available":true,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com/favicon.ico","fqdn":"aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com","domain":"aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com","tld":"s3.dualstack.eu-west-2.amazonaws.com"},"ip":{"addr":"3.5.246.74","port":443,"asn":16509,"as":"AMAZON-02","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com/deanx/kdlespw.html","date":"2026-04-13T11:35:49.814Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3.eu-west-2.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Mon, 17 Nov 2025 00:00:00 GMT","end":"Wed, 04 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"47:4E:C3:25:4B:EA:B5:40:B3:47:B1:59:B5:69:23:DD:A8:AA:09:FA","sha256":"3B:B6:72:B0:01:B0:77:3B:D0:F1:61:B8:CC:7F:7F:97:0C:F9:D2:72:73:BF:F5:EC:4E:DC:25:FF:CD:2A:BC:A0"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com/deanx/kdlespw.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nx-amz-request-id: 4M1FWWQFGXPR71PT\r\nx-amz-id-2: J5cKTHywgtU2LRZCgmF37WV4qiAHB9lbDpykycoHYFePeNypHKQHRtfZ43jmTBdrApTABQYicGXlFxJJagc5skwB1/8F19Da\r\nContent-Type: application/xml\r\nTransfer-Encoding: chunked\r\nDate: Mon, 13 Apr 2026 11:35:49 GMT\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":302,"size_decoded":0,"mime_type":"application/xml","magic":"XML 1.0 document, ASCII text","md5":"2049e464351c97975f072eb34bbbe877","sha1":"b9fb222a95227f0bfac9ab62190c44ec81d51c8e","sha256":"08b137a2a85a88fba3a5e8af086c717d31877ea62e4731722d0230e044a9628c","sha512":"52fc2b816cc0c8fe02f4f0f06bd8511620d696dd3e80cf3fa16f81ff0ac6fad7024709d41f4abc2720643222969d69f1284d240e4ed7d59b2f2e086267864891","ssdeep":"","tlshash":"a0e0721123a408041ed0816faa6fd313bb36a8b633e811302a9949831bed0ca4ea23b0","first_seen":"2026-04-13T11:36:18.729106Z","last_seen":"2026-04-13T11:36:18.729106Z","times_seen":1,"resource_available":false,"data":null}},"time_used":39,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":38,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.telegram.org/bot8646583242:AAHbUJprkpqCDMmCl49nO3YzNWYw_ZFnvP8/sendMessage","fqdn":"api.telegram.org","domain":"telegram.org","tld":"org"},"ip":{"addr":"149.154.166.110","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com/deanx/kdlespw.html","date":"2026-04-13T11:35:50.537Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.telegram.org","organization":""},"issuer":{"commonName":"Go Daddy Secure Certificate Authority - G2","organization":"GoDaddy.com, Inc."},"validity":{"start":"Tue, 25 Mar 2025 13:09:41 GMT","end":"Sun, 26 Apr 2026 13:09:41 GMT"},"fingerprint":{"sha1":"8B:AA:E2:A3:48:3C:0E:62:9D:B5:49:3A:BD:47:60:BA:AD:18:AA:8D","sha256":"80:58:CE:C7:28:68:D2:99:42:91:1E:43:06:54:D2:D6:F0:9C:DD:E2:F7:6F:68:A0:8A:EA:0C:15:FB:DB:8C:CD"}}},"request":{"raw":"POST /bot8646583242:AAHbUJprkpqCDMmCl49nO3YzNWYw_ZFnvP8/sendMessage HTTP/1.1\r\nHost: api.telegram.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com/\r\nContent-Type: application/json\r\nContent-Length: 346\r\nOrigin: https://aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":346,"data":"{\"chat_id\":\"513257544\",\"text\":\"evast downloaded\\n====================\\nLocation: Oslo, Oslo County, Norway\\nISP: Blix Solutions AS\\nIP: 91.90.42.154\\nDevice: Desktop\\nBrowser: Firefox 134.0\\nTime: 2026-04-13 11:35:50 UTC\\nCoordinates: 59.9133,10.7389\\nUser Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\"}"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.18.0\r\ndate: Mon, 13 Apr 2026 11:35:53 GMT\r\ncontent-type: application/json\r\ncontent-length: 626\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-expose-headers: Content-Length,Content-Type,Date,Server,Connection\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":626,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"b58c77338581e2a962e6d50a4d38af37","sha1":"142de88b94362a8ce8e46fa8d1144335da3cd9b4","sha256":"b6aa9c0a3d07a47fbd38ceaff8b900d087ffba99434c95bba3c323cdcfdf7434","sha512":"ff7a7c01ebde3b3778a2961a62cb80a1518f9e4e6ad5e0f75f85f6ff85578cc3f62adf2fb6b8def5334f4429b4b4414df5fa1d7782b4fd5377f7d8018769bcf0","ssdeep":"","tlshash":"e8f00c8b4d201d6c2983d65578a3bf025bb9203760cc9c61b9d52a2c93e038a211f993","first_seen":"2026-04-13T11:36:18.730012Z","last_seen":"2026-04-13T11:36:18.730012Z","times_seen":1,"resource_available":false,"data":null}},"time_used":2549,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2548,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com/deanx/Doc_14093.exe","fqdn":"aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com","domain":"aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com","tld":"s3.dualstack.eu-west-2.amazonaws.com"},"ip":{"addr":"3.5.246.74","port":443,"asn":16509,"as":"AMAZON-02","country":"United Kingdom","country_code":"GB"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-04-13T11:35:50.823Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3.eu-west-2.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Mon, 17 Nov 2025 00:00:00 GMT","end":"Wed, 04 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"47:4E:C3:25:4B:EA:B5:40:B3:47:B1:59:B5:69:23:DD:A8:AA:09:FA","sha256":"3B:B6:72:B0:01:B0:77:3B:D0:F1:61:B8:CC:7F:7F:97:0C:F9:D2:72:73:BF:F5:EC:4E:DC:25:FF:CD:2A:BC:A0"}}},"request":{"raw":"GET /deanx/Doc_14093.exe HTTP/1.1\r\nHost: aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com/deanx/kdlespw.html\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: 4lEDLfgnZaGEsq+ebLWSB/WbUmxwm0jCltOjs7vOKmWfusjz70+sbOL2LU0F7Xq1tBZMrIXi8ajnoW3+0efnSrjMrmR3j6PE\r\nx-amz-request-id: K6PWBDBAVZHHKDQG\r\nDate: Mon, 13 Apr 2026 11:35:51 GMT\r\nLast-Modified: Sun, 12 Apr 2026 13:41:01 GMT\r\nETag: \"2e460b026ccff45c2211f1a0fb4d9522-2\"\r\nx-amz-server-side-encryption: AES256\r\nx-amz-meta-checksum-sha256: 18ff2a183deddf244c3ee559b295e5ff78eeb55ca579f5a5154a7050214a01f9\r\nx-amz-meta-s3b-last-modified: 20260412T133724Z\r\nAccept-Ranges: bytes\r\nContent-Type: application/x-msdownload\r\nContent-Length: 15293232\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":15293232,"size_decoded":0,"mime_type":"application/x-msdownload","magic":"PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections","md5":"4adba19a703f9c2e7b766ef89c682031","sha1":"97ef46f81777a5ad8e233749b4abe581174d57fe","sha256":"d5b95e129d6b01f122044dc433195a19ce2a3ed0ea9a3756622bfeb9a4ff65f7","sha512":"ac173836dad8ccddcf43468e13294b20867ed7ba8139c4bd3eee4e3a3374f5173b533702147508bac3363e034d47e8f7d206b8081d7f3b3cc2ec9d9a398e3b23","ssdeep":"24576:8Yzr/5C1IGnNmPIozHH9BYO9/5XpbPP/0LJwIkG0Z5ra:1zVILN4TH4+X5HsOIR0Pa","tlshash":"2d25234e47b1476ec5a89fb01428268b87b8bc6c11a1614f4710fbf6feb239958d9f12","first_seen":"2026-04-13T07:47:33.049733Z","last_seen":"2026-04-21T15:48:08.982712Z","times_seen":7,"resource_available":false,"data":null}},"time_used":1151,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":104,"receive":1047,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"amit08.com/pic/ttank.jpg","fqdn":"amit08.com","domain":"amit08.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com/deanx/kdlespw.html","date":"2026-04-13T11:35:49.707Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /pic/ttank.jpg HTTP/1.1\r\nHost: amit08.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-31T04:31:18.068558Z","times_seen":17628370,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-13","alert":"Sinkholed","trigger":"amit08.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.ipify.org/?format=json","fqdn":"api.ipify.org","domain":"ipify.org","tld":"org"},"ip":{"addr":"104.26.13.205","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com/deanx/kdlespw.html","date":"2026-04-13T11:35:49.818Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ipify.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 01 Mar 2026 16:45:18 GMT","end":"Sat, 30 May 2026 17:45:14 GMT"},"fingerprint":{"sha1":"EF:8D:ED:C7:B3:46:8A:91:47:71:92:F2:D9:B0:67:EA:C1:FC:5B:89","sha256":"01:CA:DB:EB:79:61:2D:B3:FE:2B:09:FE:44:84:EA:5B:6E:C1:3B:81:A1:0F:8C:9F:DE:2E:16:1E:59:45:06:D9"}}},"request":{"raw":"GET /?format=json HTTP/1.1\r\nHost: api.ipify.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com/\r\nOrigin: https://aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Mon, 13 Apr 2026 11:35:49 GMT\r\ncontent-type: application/json\r\ncontent-length: 21\r\nserver: cloudflare\r\naccess-control-allow-origin: *\r\nvary: Origin\r\ncf-cache-status: DYNAMIC\r\ncf-ray: 9eba2b689c7d568b-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":21,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"7d69c71af0f191e9a72db6153f8018d1","sha1":"f67c5f2887bc05654b47f76e9621e53a4091aed1","sha256":"5bac6e06cf0e1ad38c55f9f9d12122272bf4b8157877629fe68cd33fe2133c65","sha512":"fdf43a8f3d843fe9008949d6709c8e2a5cd640f6101522319745f0a829f21dc8f4bd4d70ff3e2f6e1fd53ca0d2dd872bf3588c593a403071102ab28763cbdba5","ssdeep":"","tlshash":"b8700022000000208c80800eca0a032223a0000ac20a00088e800b2288a0b380282032","first_seen":"2023-04-05T02:54:03Z","last_seen":"2026-06-07T07:51:18.251001Z","times_seen":93313,"resource_available":false,"data":null}},"time_used":174,"timings":{"blocked":40,"dns":2,"connect":1,"send":0,"wait":93,"receive":0,"ssl":35},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015","fqdn":"static.cloudflareinsights.com","domain":"cloudflareinsights.com","tld":"com"},"ip":{"addr":"104.16.80.73","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com/deanx/kdlespw.html","date":"2026-04-13T11:35:49.685Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cloudflareinsights.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 17 Feb 2026 14:29:28 GMT","end":"Mon, 18 May 2026 15:29:15 GMT"},"fingerprint":{"sha1":"8B:A9:51:50:78:B2:5E:75:31:54:23:BC:80:D6:CA:53:34:E5:CD:8F","sha256":"AF:D9:FB:4F:B0:E1:BD:80:DF:22:93:A7:4A:99:5B:50:0A:BE:47:59:37:98:C6:BF:C5:DF:8D:8F:F0:8D:FD:23"}}},"request":{"raw":"GET /beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015 HTTP/1.1\r\nHost: static.cloudflareinsights.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Mon, 13 Apr 2026 11:35:49 GMT\r\ncontent-type: text/javascript;charset=UTF-8\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=86400\r\netag: W/\"2024.6.1\"\r\nlast-modified: Thu, 19 Feb 2026 17:45:24 GMT\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: cloudflare\r\ncf-ray: 9eba2b67af1a568f-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":19948,"size_decoded":0,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (19948), with no line terminators","md5":"ec18af6d41f6f278b6aed3bdabffa7bc","sha1":"62c9e2cab76b888829f3c5335e91c320b22329ae","sha256":"8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f","sha512":"669b0e9a545057acbdd3b4c8d1d2811eaf4c776f679da1083e591ff38ae7684467abacef5af3d4aabd9fb7c335692dbca0def63ddac2cd28d8e14e95680c3511","ssdeep":"384:XriNpnjyMkg8XMtExRN1w29JIOzahXtO2nJ65:GijgSWuanfJ65","tlshash":"8d92d7def645723613f76076913f220b733b35a528068459812adbc22c3d98f6267f6e","first_seen":"2024-06-07T09:21:23Z","last_seen":"2026-07-30T15:53:34.481583Z","times_seen":337625,"resource_available":true,"data":null}},"time_used":45,"timings":{"blocked":17,"dns":1,"connect":1,"send":0,"wait":9,"receive":0,"ssl":15},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com/cdn-cgi/challenge-platform/scripts/jsd/main.js","fqdn":"aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com","domain":"aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com","tld":"s3.dualstack.eu-west-2.amazonaws.com"},"ip":{"addr":"3.5.246.74","port":443,"asn":16509,"as":"AMAZON-02","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com/deanx/kdlespw.html","date":"2026-04-13T11:35:49.816Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3.eu-west-2.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Mon, 17 Nov 2025 00:00:00 GMT","end":"Wed, 04 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"47:4E:C3:25:4B:EA:B5:40:B3:47:B1:59:B5:69:23:DD:A8:AA:09:FA","sha256":"3B:B6:72:B0:01:B0:77:3B:D0:F1:61:B8:CC:7F:7F:97:0C:F9:D2:72:73:BF:F5:EC:4E:DC:25:FF:CD:2A:BC:A0"}}},"request":{"raw":"GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1\r\nHost: aws-cloudtrail-logs-484206414752-fa7f2674.s3.dualstack.eu-west-2.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nx-amz-request-id: 4M1DY2HJDAGP62Z0\r\nx-amz-id-2: wxPvG8iT17a4NloO1/DJHTWFWzj9AgWTKqoVU4kifWOxiqi9548XQe9JNih9IsJCP0211+atpax/83lyBSkKUunFcbL2URdb\r\nContent-Type: application/xml\r\nTransfer-Encoding: chunked\r\nDate: Mon, 13 Apr 2026 11:35:49 GMT\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":337,"size_decoded":0,"mime_type":"application/xml","magic":"XML 1.0 document, ASCII text","md5":"3925344f73dee98befc440b122ba31b7","sha1":"ec951e76f8846f5fb5520f1f07a7c64afd6e8278","sha256":"e4b3b1021d531cd7348191c2a6447ec3620c1cb1e4fe51f37e5a8d3de593ae0f","sha512":"4776d1c454ce08240bab70bc072bef76788593535a4ebbd7795de1d85d7d8e6928c3ce27042230389ad5a4fe31b2a08f809fc6ef65409a3e3a1b11cd6051774f","ssdeep":"","tlshash":"97e02d76132258040ae00f2af58fe12b0b34e3b233d222709bd7ced34fc80a28d63620","first_seen":"2026-04-13T11:36:18.732683Z","last_seen":"2026-04-13T11:36:18.732683Z","times_seen":1,"resource_available":false,"data":null}},"time_used":202,"timings":{"blocked":70,"dns":2,"connect":24,"send":0,"wait":59,"receive":1,"ssl":42},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}