{"report_id":"6528950a-b9d0-44cc-bc5e-25691ee64884","version":6,"status":"done","tags":["suspicious"],"date":"2026-04-05T18:44:31Z","url":{"schema":"https","addr":"fffffffffcvtr.pages.dev","fqdn":"fffffffffcvtr.pages.dev","domain":"fffffffffcvtr.pages.dev","tld":"pages.dev"},"ip":{"addr":"172.66.46.239","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"fffffffffcvtr.pages.dev/","fqdn":"fffffffffcvtr.pages.dev","domain":"fffffffffcvtr.pages.dev","tld":"pages.dev"},"title":"Transfer USDT TRC20","dom":{"size":5193,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (392)","md5":"50e3912d4bf59794087016c2647ca190","sha1":"222f1a52157f5d1657ff758beaa352319cdf4535","sha256":"4ea75fdb2525ca9e2e21443456e1f92a2cadd0963f5ba0da3911271414fbe6ed","sha512":"8efec4fd04d2bdcd4a5c7c3ca5bcabd20ab6c7ababe0671f9675a9925a9eb848b49e292aee17ace5be2e36338b1adba341b1326a9200669f28350dceb4304a6a","ssdeep":"96:JUvWqO3uuau9WCWaJ9mkow/LqAU6R3LIfkgIfkmvEqVOCMP42k:JUvWq8uuau9WCWaJAkow/LkEL5ky","tlshash":"01b1c726f8e21e9db00382b66ee6b52f6a64e607c10fd55c75ec51e05fc7c89dc63108","dom_hash":"domhashf63ca220c4d6f59f5a3d76685e141dd5","first_seen":"2026-04-05T18:44:35.804982Z","last_seen":"2026-04-05T18:44:35.804982Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"fffffffffcvtr.pages.dev","fqdn":"fffffffffcvtr.pages.dev","domain":"fffffffffcvtr.pages.dev","tld":"pages.dev"},"ip":{"addr":"172.66.46.239","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-05-10T18:44:31Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-04-05","alert":"Detects file containing Telegram Bot API","trigger":"fffffffffcvtr.pages.dev/main.js","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"summary":[{"fqdn":"fffffffffcvtr.pages.dev","ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2020-09-02","domain_rank":0,"first_seen":"2026-04-05T18:44:33.07934Z","last_seen":"2026-04-05T18:44:33.079341Z","alert_count":3,"request_count":6,"received_data":2671805,"sent_data":2682,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"fffffffffcvtr.pages.dev/","fqdn":"fffffffffcvtr.pages.dev","domain":"fffffffffcvtr.pages.dev","tld":"pages.dev"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"4436be55e435cdb4ce98fb721a4df4b1","sha1":"80be671b3a4a1cf8a12217a5ff787935373605df","sha256":"b420646d06a9bb2ebfd720cd33e1f35f7b7fd470a7d59b08f5271183ccded372","sha512":"c31b409f5eb10c447d267733eeecaa909e0c4ed2b17a46f7d81d1105edfbed7a0e574c32627768d5c01f93bb0f5d98a9c2829aef5c949ed3530558bb845cad1f","ssdeep":"","tlshash":"06c012597020696604ce787d4ccf088ebe269412a20849c99ddcd8547fb2e6c42e484c","size":192,"data":"","first_seen":"2025-09-07T13:20:24.46413Z","last_seen":"2026-06-07T04:15:54.83152Z","times_seen":94,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fffffffffcvtr.pages.dev/config.js","fqdn":"fffffffffcvtr.pages.dev","domain":"fffffffffcvtr.pages.dev","tld":"pages.dev"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"018746eb1eadd37b282aa62ec73ac3f7","sha1":"80300ea94a5eb7fc4c5061c6166c125b5eb120a4","sha256":"871fbd3371e12c06322984fb95a8d635f1ecc96972feb2f34f0c6b25020c544a","sha512":"fb64b72c6ca3d54b95a66599074aec5445c822f35d2b4bf17b2195be1350cdbccd27f147fa7c684f202470d478a29b8e1d5bce6d66a1d4b4e708dda67a72336e","ssdeep":"","tlshash":"fdf09e4461b9ab012c11018a65491b1a74431e3fad48b01863faa6045f7d36689b618e","size":471,"data":"","first_seen":"2026-04-05T18:44:35.814116Z","last_seen":"2026-04-05T18:44:35.814116Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fffffffffcvtr.pages.dev/main.js","fqdn":"fffffffffcvtr.pages.dev","domain":"fffffffffcvtr.pages.dev","tld":"pages.dev"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"9623873511d13dd3cbede0a04532d98b","sha1":"9bb080d5f120576491c75ed89dff76eb00d69bc2","sha256":"57416365b653a77045dba2502f840583e19e742528cb517e366843a6cc6d1c33","sha512":"23646659ec662a66984688ce5c61d7f523e80f39b322b1996b7bfc2ae921f804f9e7d500582ac6f487285de688626c923895469e97d5e233f059f193f64d7297","ssdeep":"192:SfjLCAfQINc2xjxVZFtNoDhcDF9jhic10JzW5xzdBD:mjL0CoSyzW5x7","tlshash":"5f02e76566b631304627a07aa3db60543036900b7c15d8a1b7ad83618fec8ac9bb77de","size":8924,"data":"","first_seen":"2026-04-05T18:44:35.817236Z","last_seen":"2026-05-16T18:16:40.624078Z","times_seen":2,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-04-05","alert":"Detects file containing Telegram Bot API","trigger":"fffffffffcvtr.pages.dev/main.js","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}},{"url":{"schema":"https","addr":"fffffffffcvtr.pages.dev/tron-bundle.js","fqdn":"fffffffffcvtr.pages.dev","domain":"fffffffffcvtr.pages.dev","tld":"pages.dev"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"8793eaf422f8eea08a865181ac015622","sha1":"e1ddc0f3fe4656c72e12353316ede00dd5cfbfeb","sha256":"d5212ff076256bd14cca438167675bdf45dd475a89c3926687bd88855de5fbd3","sha512":"c1535c933378e6ad2f2b8a156b1c0c3b151ed7ac474174dc61fbe5c50f91dcb02dcb6713a24543d328c6985b9b186b6444da0f38d1b4aa1208bbe8177ed251fc","ssdeep":"49152:wp60VEVZ7h+kDysVOvxvCtX/S/KeJOsYEKvyHKoEXfzEBk6baynIm0VdJGTysHeC:Fh+kDysV8xvC4mWBk6ba0d","tlshash":"ebc54a8073a1f47a479651e8157b0405f33da85a800d856cf7ecd4e7afa89c98abbf34","size":2630615,"data":"","first_seen":"2026-04-05T18:44:35.821171Z","last_seen":"2026-05-16T18:16:40.628391Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"fffffffffcvtr.pages.dev/","fqdn":"fffffffffcvtr.pages.dev","domain":"fffffffffcvtr.pages.dev","tld":"pages.dev"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-04-05T18:44:09.155Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fffffffffcvtr.pages.dev","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Apr 2026 15:13:05 GMT","end":"Sat, 04 Jul 2026 15:13:04 GMT"},"fingerprint":{"sha1":"7A:0A:F2:7E:A1:0E:00:9C:F1:EB:F3:99:65:2B:1B:19:AF:2C:0D:0F","sha256":"2A:FD:73:D2:75:5C:EC:9E:A2:DE:E3:95:77:DE:B5:75:7B:AB:8F:E8:49:6F:D0:00:3F:07:E4:EA:C7:52:C7:4E"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: fffffffffcvtr.pages.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 05 Apr 2026 18:44:09 GMT\r\ncontent-type: text/html; charset=utf-8\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=0, must-revalidate\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nYpoZCDl5y9mnhaVuaITeScg9EM3zanApNPvmkTvMQTwx6eFqPP5Yo0TZDLNLMaNJU%2Fl2gCb8bj49xbRBHN7JApYPAeYOClZp%2FJJGz%2FXSpZgXZlW4br9jGA2xj2x78m%2BOwjSBFyeolyoOg%3D%3D\"}]}\r\netag: W/\"6b953f9875e641a9a0ec5c55acaa06ff\"\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9e7ab3d5895456c5-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5317,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (392), with CRLF line terminators","md5":"ec5369c72b906bdaf0b60ebd4eb0f4c8","sha1":"339fcfdea27d1e356dd922c1a0a90ee79f091654","sha256":"236fb1c45477af4d14599bce13746a171e84654c983e394e54f12f25af17720b","sha512":"f95c958778ee6aa9cf442e2ff996a673c7bf3623b111d588a9777045de99751a5c47e543a94d08ffc496211946274fb2c3d16bc69d5d9d157794469f401cf1d7","ssdeep":"96:vqs/7MmkoR/L3cY5cqtUEHUEmJYy18LPSTg:vqUNkoR/LiJrzYj","tlshash":"8fb19425b5c11e5a603382b5aae6b12ffa65d217c30fd95c71ec62a31ff7c189c63104","first_seen":"2026-04-05T18:44:35.809694Z","last_seen":"2026-04-05T18:44:35.809694Z","times_seen":1,"resource_available":false,"data":null}},"time_used":164,"timings":{"blocked":45,"dns":29,"connect":1,"send":0,"wait":71,"receive":0,"ssl":15},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fffffffffcvtr.pages.dev/style.css","fqdn":"fffffffffcvtr.pages.dev","domain":"fffffffffcvtr.pages.dev","tld":"pages.dev"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://fffffffffcvtr.pages.dev/","date":"2026-04-05T18:44:09.481Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fffffffffcvtr.pages.dev","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Apr 2026 15:13:05 GMT","end":"Sat, 04 Jul 2026 15:13:04 GMT"},"fingerprint":{"sha1":"7A:0A:F2:7E:A1:0E:00:9C:F1:EB:F3:99:65:2B:1B:19:AF:2C:0D:0F","sha256":"2A:FD:73:D2:75:5C:EC:9E:A2:DE:E3:95:77:DE:B5:75:7B:AB:8F:E8:49:6F:D0:00:3F:07:E4:EA:C7:52:C7:4E"}}},"request":{"raw":"GET /style.css HTTP/1.1\r\nHost: fffffffffcvtr.pages.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://fffffffffcvtr.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 05 Apr 2026 18:44:09 GMT\r\ncontent-type: text/css; charset=utf-8\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=0, must-revalidate\r\npriority: u=2,i=?0\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OwwObegR6Ji3DW3h1JOmnju0XwxD9Pd48fb3JKDLdxHBkNXLKxHx1ZRTbQlzQuhmnOp5tJt2GGXxRj4jHEHvrh%2FCdKn6CH1jSO4VLhFOZF18FZPHP4epiWxWKikTxXWrzKyMBijveavToA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"ab3b1fe770f83820b6e22168e9155a81\"\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9e7ab3d73d4e4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16465,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with CRLF line terminators","md5":"a415aac7ffeb8678f276930aaafa57b3","sha1":"9bd4f4a252125122743053f891491663d9e4c872","sha256":"d4ce296fb2399d842b732cd930898f96004144ef16fbb061eeb56a509fc72b20","sha512":"0e539a4ec64370cc318b8640e2966c88397ed96fb7c8033b8cba4e99c53977a9f504e0e7565ca849c2fe91eb8401add1d10e7d2ad95c56792ad7acd9941c6bbf","ssdeep":"192:kAfP5BgAgAfP5BgAjBAuiDb1LKquuMU7sN1OwSHsfjkEHOlL7D/8PMeDNEWAw6qd:/BgADBgAZFOhLP/K5Nz","tlshash":"11722014960295026f338ffab3d6a60bfb2b40abcf22a17db6c451058ff557059d1e8d","first_seen":"2025-09-21T18:52:40.582545Z","last_seen":"2026-07-27T07:54:46.899694Z","times_seen":92,"resource_available":false,"data":null}},"time_used":46,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":46,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fffffffffcvtr.pages.dev/tron-bundle.js","fqdn":"fffffffffcvtr.pages.dev","domain":"fffffffffcvtr.pages.dev","tld":"pages.dev"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fffffffffcvtr.pages.dev/","date":"2026-04-05T18:44:09.483Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fffffffffcvtr.pages.dev","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Apr 2026 15:13:05 GMT","end":"Sat, 04 Jul 2026 15:13:04 GMT"},"fingerprint":{"sha1":"7A:0A:F2:7E:A1:0E:00:9C:F1:EB:F3:99:65:2B:1B:19:AF:2C:0D:0F","sha256":"2A:FD:73:D2:75:5C:EC:9E:A2:DE:E3:95:77:DE:B5:75:7B:AB:8F:E8:49:6F:D0:00:3F:07:E4:EA:C7:52:C7:4E"}}},"request":{"raw":"GET /tron-bundle.js HTTP/1.1\r\nHost: fffffffffcvtr.pages.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://fffffffffcvtr.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 05 Apr 2026 18:44:09 GMT\r\ncontent-type: application/javascript\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=0, must-revalidate\r\npriority: u=3,i=?0\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mWCmk4r1jIGrKtN3x1GJpXym9F1C9IA0xB0as6mRH1sAyl73wRhFs5lRAIJoiw%2BngsFCocBf1SzQ5Lm0u4882YaatMEE5Tl20HIXCxDWOj9OjIixqR%2F7huv771KgR%2FyUoQiyW8GuEbdSDQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"5ecda5993dfa750db185c246cfcfb4ba\"\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9e7ab3d73d514c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2630615,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (53216)","md5":"e1fbac55fe739d188209d083e6aafa45","sha1":"67d0c15ede2abc93dfc05270f2d07bf25f454433","sha256":"b16d2b17b5079dfa7439f6a80061e6eac14a7528ea5208a66878718e591a8950","sha512":"fa597295b83fc177d615d7c995b2fe8b200949e1181abd6b26609a454f3290186b7411da940b33ca5988abca29d6203cfa3bd5b650da9e3c13ce6e4fdce70c73","ssdeep":"24576:wp60VEVZ7hJk7wDysVOvxvCtiu/S/KeJOs9:wp60VEVZ7h+kDysVOvxvCtX/S/KeJOs9","tlshash":"56256d9073a5f476479f92a8a47b1101f33858a5500d406cfaec99ebbf988c9c5bbf34","first_seen":"2026-04-05T18:44:35.811603Z","last_seen":"2026-05-16T18:16:40.626101Z","times_seen":2,"resource_available":false,"data":null}},"time_used":268,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":246,"receive":22,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fffffffffcvtr.pages.dev/config.js","fqdn":"fffffffffcvtr.pages.dev","domain":"fffffffffcvtr.pages.dev","tld":"pages.dev"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fffffffffcvtr.pages.dev/","date":"2026-04-05T18:44:09.485Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fffffffffcvtr.pages.dev","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Apr 2026 15:13:05 GMT","end":"Sat, 04 Jul 2026 15:13:04 GMT"},"fingerprint":{"sha1":"7A:0A:F2:7E:A1:0E:00:9C:F1:EB:F3:99:65:2B:1B:19:AF:2C:0D:0F","sha256":"2A:FD:73:D2:75:5C:EC:9E:A2:DE:E3:95:77:DE:B5:75:7B:AB:8F:E8:49:6F:D0:00:3F:07:E4:EA:C7:52:C7:4E"}}},"request":{"raw":"GET /config.js HTTP/1.1\r\nHost: fffffffffcvtr.pages.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://fffffffffcvtr.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 05 Apr 2026 18:44:09 GMT\r\ncontent-type: application/javascript\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=0, must-revalidate\r\npriority: u=3,i=?0\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zJ%2FNgcC3TLi3jWXzPM0GukW8%2F7vK2eodSNb1%2BY7M6XSAFOEjHrgrqko2TSNX6GbZ3MQVpf38PePSKNeOUAJaHGec65XKPsCBeIocoE9qbJnNqg5Bep7b%2BItyPm7XnTYgrvvUMmIS8Y92TA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"08e1947b888f00ee93673938553749e1\"\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9e7ab3d73d574c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":471,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text","md5":"018746eb1eadd37b282aa62ec73ac3f7","sha1":"80300ea94a5eb7fc4c5061c6166c125b5eb120a4","sha256":"871fbd3371e12c06322984fb95a8d635f1ecc96972feb2f34f0c6b25020c544a","sha512":"fb64b72c6ca3d54b95a66599074aec5445c822f35d2b4bf17b2195be1350cdbccd27f147fa7c684f202470d478a29b8e1d5bce6d66a1d4b4e708dda67a72336e","ssdeep":"","tlshash":"fdf09e4461b9ab012c11018a65491b1a74431e3fad48b01863faa6045f7d36689b618e","first_seen":"2026-04-05T18:44:35.814116Z","last_seen":"2026-04-05T18:44:35.814116Z","times_seen":1,"resource_available":true,"data":null}},"time_used":54,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":54,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]}},{"url":{"schema":"https","addr":"fffffffffcvtr.pages.dev/main.js","fqdn":"fffffffffcvtr.pages.dev","domain":"fffffffffcvtr.pages.dev","tld":"pages.dev"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fffffffffcvtr.pages.dev/","date":"2026-04-05T18:44:09.486Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fffffffffcvtr.pages.dev","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Apr 2026 15:13:05 GMT","end":"Sat, 04 Jul 2026 15:13:04 GMT"},"fingerprint":{"sha1":"7A:0A:F2:7E:A1:0E:00:9C:F1:EB:F3:99:65:2B:1B:19:AF:2C:0D:0F","sha256":"2A:FD:73:D2:75:5C:EC:9E:A2:DE:E3:95:77:DE:B5:75:7B:AB:8F:E8:49:6F:D0:00:3F:07:E4:EA:C7:52:C7:4E"}}},"request":{"raw":"GET /main.js HTTP/1.1\r\nHost: fffffffffcvtr.pages.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://fffffffffcvtr.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 05 Apr 2026 18:44:09 GMT\r\ncontent-type: application/javascript\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=0, must-revalidate\r\npriority: u=3,i=?0\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tudXBlZudfuIRSGcitKYT5RncIYDoSVDHWywqMVkG9m6oUb1BWd42iEeDBiV7gwT1lRpznUdjyVyrhEmz%2Bc729atIQk3PwwuyGnoF%2F9yqA0A0sa47c7DbxkCsUlHDx2p0MJPnZPBsHIbqw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"06ec7a91b36628d7b54e4917b4dab414\"\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9e7ab3d73d5b4c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8924,"size_decoded":0,"mime_type":"application/javascript","magic":"Unicode text, UTF-8 text","md5":"9623873511d13dd3cbede0a04532d98b","sha1":"9bb080d5f120576491c75ed89dff76eb00d69bc2","sha256":"57416365b653a77045dba2502f840583e19e742528cb517e366843a6cc6d1c33","sha512":"23646659ec662a66984688ce5c61d7f523e80f39b322b1996b7bfc2ae921f804f9e7d500582ac6f487285de688626c923895469e97d5e233f059f193f64d7297","ssdeep":"192:SfjLCAfQINc2xjxVZFtNoDhcDF9jhic10JzW5xzdBD:mjL0CoSyzW5x7","tlshash":"5f02e76566b631304627a07aa3db60543036900b7c15d8a1b7ad83618fec8ac9bb77de","first_seen":"2026-04-05T18:44:35.817236Z","last_seen":"2026-05-16T18:16:40.624078Z","times_seen":2,"resource_available":true,"data":null}},"time_used":60,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":60,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-04-05","alert":"Detects file containing Telegram Bot API","trigger":"fffffffffcvtr.pages.dev/main.js","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]}},{"url":{"schema":"https","addr":"fffffffffcvtr.pages.dev/favicon.ico","fqdn":"fffffffffcvtr.pages.dev","domain":"fffffffffcvtr.pages.dev","tld":"pages.dev"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://fffffffffcvtr.pages.dev/","date":"2026-04-05T18:44:10.232Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fffffffffcvtr.pages.dev","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Apr 2026 15:13:05 GMT","end":"Sat, 04 Jul 2026 15:13:04 GMT"},"fingerprint":{"sha1":"7A:0A:F2:7E:A1:0E:00:9C:F1:EB:F3:99:65:2B:1B:19:AF:2C:0D:0F","sha256":"2A:FD:73:D2:75:5C:EC:9E:A2:DE:E3:95:77:DE:B5:75:7B:AB:8F:E8:49:6F:D0:00:3F:07:E4:EA:C7:52:C7:4E"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: fffffffffcvtr.pages.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://fffffffffcvtr.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 05 Apr 2026 18:44:10 GMT\r\ncontent-type: text/html; charset=utf-8\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=0, must-revalidate\r\npriority: u=6,i=?0\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tQmd5BgroEYCZu82w0%2FYauPS4%2F9eRy3S%2FfLCn2KfL8i8gOaR1gwq1bLzPGPvYSsE60JSG9fN%2BDFN1N17hsKH3JV222p2duDnepIvrCrlf82vNitGaw9YNgCy0TI5dz5X3Bxu6qqPrWUDaQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"6b953f9875e641a9a0ec5c55acaa06ff\"\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9e7ab3dbfd324c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5317,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (392), with CRLF line terminators","md5":"ec5369c72b906bdaf0b60ebd4eb0f4c8","sha1":"339fcfdea27d1e356dd922c1a0a90ee79f091654","sha256":"236fb1c45477af4d14599bce13746a171e84654c983e394e54f12f25af17720b","sha512":"f95c958778ee6aa9cf442e2ff996a673c7bf3623b111d588a9777045de99751a5c47e543a94d08ffc496211946274fb2c3d16bc69d5d9d157794469f401cf1d7","ssdeep":"96:vqs/7MmkoR/L3cY5cqtUEHUEmJYy18LPSTg:vqUNkoR/LiJrzYj","tlshash":"8fb19425b5c11e5a603382b5aae6b12ffa65d217c30fd95c71ec62a31ff7c189c63104","first_seen":"2026-04-05T18:44:35.809694Z","last_seen":"2026-04-05T18:44:35.809694Z","times_seen":1,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}