Report Overview
Visitedpublic
2025-10-19 15:25:16
Submit Tags
URL
inv-901156.vercel.app/
Finishing URL
inv-901156.vercel.app/success.html
IP / ASN
64.29.17.195
Title
inv-901156.vercel.app/success.html
Suspicious - Suspicious Javascript code
Detections
urlquery
2
Network Intrusion Detection
2
Threat Detection Systems
2
Host Summary
| Host | Rank | Registered | First Seen | Last Seen | Sent | Received | IP | Fingerprints |
|---|---|---|---|---|---|---|---|---|
ipapi.co | 7936 | 2016-04-19 | 2017-01-31 | 2025-10-13 | 443 B | 2.5 kB |  104.26.8.44 |  |
inv-901156.vercel.app 11 alert(s) on this Host | unknown | unknown | No data | No data | 4.3 kB | 25 MB | 64.29.17.195 |  |
api.telegram.org | 206724 | 2003-12-15 | 2015-06-25 | 2025-10-13 | 1.2 kB | 1.3 kB |  149.154.167.220 |  |
cdnjs.cloudflare.com | 1222 | 2009-02-17 | 2012-05-23 | 2025-10-12 | 964 B | 64 kB | 104.17.25.14 | |
Cloudflare (CDN)
Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.Vercel (PaaS)
Vercel is a cloud platform for static frontends and serverless functions.Nginx:1.18.0 (Web servers, Reverse proxies)
Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.Related reports
Network Intrusion Detection Systems
Suricata /w Emerging Threats Pro
| Timestamp | Severity | Source IP | Destination IP | Alert |
|---|---|---|---|---|
| low | 172.18.0.25 | 149.154.167.220 | ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI) | |
| low | 172.18.0.25 | 149.154.167.220 | ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI) |
Threat Detection Systems
| Detection System | Indicator | Verdict | Alert |
|---|---|---|---|
| YARAhub by abuse.ch | inv-901156.vercel.app/ | malware | Detects file containing Telegram Bot API |
| Cloudflare DNS | inv-901156.vercel.app | malicious | Sinkholed |
File detected
URL
inv-901156.vercel.app/doc/INV-901156.exe
IP / ASN
64.29.17.195
File Overview
File TypePE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
Size24 MB (24446944 bytes)
MD54e051e117c7dad6f16e1c796843df9f2
SHA1b82ad2168d271713993d808fe3e59ed80ef09035
Telegram Bot detected (1)
URL
inv-901156.vercel.app/
IP / ASN
64.29.17.195
Token
7340403282:AAE2Ev2JyEQh9X3TyovX9MZghv3063ZUbXQ
Bot Overview
User ID7340403282
UsernameFireMe07_bot
First NameFireMebot
Last NameN/A
Chat Info
Chat ID5404279656
Chat Typeprivate
TitleN/A
User Count2
Admins0
Pending Msgs0
JavaScript (1)
No JavaScripts
HTTP Transactions (14)
| URL | IP | Response | Size |
|---|