{"report_id":"6bfaf69f-edb7-43ff-a13c-0a0104f9c288","version":0,"status":"done","tags":["suspicious","telegram_bot"],"date":"2026-08-25T20:51:37Z","url":{"schema":"http","addr":"www.detectsysscanner.at/","fqdn":"www.detectsysscanner.at","domain":"detectsysscanner.at","tld":"at"},"ip":{"addr":"157.230.180.90","port":0,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"detectsysscanner.at/","fqdn":"detectsysscanner.at","domain":"detectsysscanner.at","tld":"at"},"title":"Microsoft SysScan — Browser \u0026 System Diagnostic Scanner","dom":{"size":25347,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (386)","md5":"6faf4259f9e7c552d2ac0fb7cc0cb040","sha1":"4157defd3071c7319e41b06b7b7c3a30a37ec8ba","sha256":"214a02a37bbfe665124fdc51784b64838b3705a56f7c08d74e33e0d6e4758a60","sha512":"b3e2962bd398edb32aace136cb67a406a6b35715cf32c09aa699becf66e9443bae4a12f067460e2aea607a98d8ecdbd7edbf71f6cdc4d3694a4b663f7a1c7629","ssdeep":"384:Br0ohtg/f+kUCklnz3LzWPbaQ1JxTinX2KzUk:Se6+kLy7Lz0a6xTinZr","tlshash":"2ab2f12061f9983780a745c9a6a26b6e6ef59703c90a1104f7ac4bf54fe3ccade37518","dom_hash":"domhash08d302c271cb6370cdaa731013fd5d30","first_seen":"2026-08-25T20:43:57.439889Z","last_seen":"2026-08-25T20:51:41.820762Z","times_seen":5,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"www.detectsysscanner.at/","fqdn":"www.detectsysscanner.at","domain":"detectsysscanner.at","tld":"at"},"ip":{"addr":"157.230.180.90","port":0,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-29T20:51:37Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":5}},"detection":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-08-25","alert":"Detects file containing Telegram Bot API","trigger":"detectsysscanner.at/sysscan-scanner.js","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"detectsysscanner.at","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"detectsysscanner.at","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"www.detectsysscanner.at","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"www.detectsysscanner.at","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"summary":[{"fqdn":"www.detectsysscanner.at","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-08-25T20:51:37.561066Z","last_seen":"2026-08-25T20:51:37.561066Z","alert_count":2,"request_count":1,"received_data":0,"sent_data":492,"comment":"","tags":null,"fingerprints":null},{"fqdn":"api.fontshare.com","ip":{"addr":"195.181.166.158","port":443,"asn":60068,"as":"Datacamp Limited","country":"Sweden","country_code":"SE"},"domain_registered":"2003-10-01","domain_rank":604295,"first_seen":"2021-03-02T20:36:57Z","last_seen":"2026-08-23T06:51:27.846639Z","alert_count":0,"request_count":1,"received_data":3084,"sent_data":559,"comment":"","tags":null,"fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}]},{"fqdn":"detectsysscanner.at","ip":{"addr":"157.230.180.90","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-08-25T20:43:51.578917Z","last_seen":"2026-08-25T20:43:51.578917Z","alert_count":12,"request_count":5,"received_data":139456,"sent_data":2427,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"ipapi.co","ip":{"addr":"104.26.9.44","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2016-04-19","domain_rank":7936,"first_seen":"2017-01-31T09:07:01Z","last_seen":"2026-08-20T02:37:52.187777Z","alert_count":0,"request_count":1,"received_data":2531,"sent_data":464,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":[{"url":{"schema":"https","addr":"detectsysscanner.at/sysscan-scanner.js","fqdn":"detectsysscanner.at","domain":"detectsysscanner.at","tld":"at"},"ip":{"addr":"157.230.180.90","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"md5":"3907d2991c69be0b1cf727cd26bd3d7d","sha1":"87a4990ec02354ae353d7f42a17b1e0647785166","sha256":"51241da764ad61477c151116771a5d80cbfeeaf05d319bfd9a47bff843d54383","sha512":"9a32a1e24fb46872c84b167222e230d1c81b5a16a6977f8da65fe7efd4742c5e177a73512a373e6b25e4c12134c5ce02a889cb5b072dd204a2826a20f87e9377","size":83063,"token":"8848000942:AAFxF-scU96x4pORGnnGwCycdXSvd8VUqs8","is_revoked":false,"bot":{"token":"8848000942:AAFxF-scU96x4pORGnnGwCycdXSvd8VUqs8","user_id":"8848000942","username":"comdpro24_bot","first_name":"\u003c\u003cDPRO24\u003e\u003e","last_name":"","chat":{"chat_id":"-1004422837797","title":"DPRO24","type":"supergroup","bot_is":"administrator","total_users":7,"active_members":null,"admins":[{"user_id":7161369195,"username":"lonewolf1re","first_name":"Lone Wolf","last_name":"","is_bot":false},{"user_id":8356788977,"username":"daniel_webb23","first_name":"Daniel","last_name":"Webb","is_bot":false},{"user_id":8848000942,"username":"comdpro24_bot","first_name":"\u003c\u003cDPRO24\u003e\u003e","last_name":"","is_bot":true},{"user_id":7137925447,"username":"cmystic1","first_name":"C","last_name":"mystic","is_bot":false}]},"pending_messages":6}}],"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"detectsysscanner.at/sysscan-scanner.js","fqdn":"detectsysscanner.at","domain":"detectsysscanner.at","tld":"at"},"ip":{"addr":"157.230.180.90","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"3907d2991c69be0b1cf727cd26bd3d7d","sha1":"87a4990ec02354ae353d7f42a17b1e0647785166","sha256":"51241da764ad61477c151116771a5d80cbfeeaf05d319bfd9a47bff843d54383","sha512":"9a32a1e24fb46872c84b167222e230d1c81b5a16a6977f8da65fe7efd4742c5e177a73512a373e6b25e4c12134c5ce02a889cb5b072dd204a2826a20f87e9377","ssdeep":"768:/+v9eRdU47sVJJjugaxCWmaASn1U9xqQTNv+zbJzX5/4P5iV:/OgRdLGJaFHj+9AUNWD45iV","tlshash":"b783946a9576293505a360ad5f9b61016321910b2e08fc4c3fce831c2f9d66f92f7bed","size":83063,"data":"","first_seen":"2026-08-25T20:43:57.444425Z","last_seen":"2026-08-25T20:51:41.82763Z","times_seen":5,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-08-25","alert":"Detects file containing Telegram Bot API","trigger":"detectsysscanner.at/sysscan-scanner.js","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"api.fontshare.com/v2/css?f[]=satoshi@400,500,700,900\u0026f[]=jetbrains-mono@400,500,700\u0026display=swap","fqdn":"api.fontshare.com","domain":"fontshare.com","tld":"com"},"ip":{"addr":"195.181.166.158","port":443,"asn":60068,"as":"Datacamp Limited","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://detectsysscanner.at/","date":"2026-08-25T20:51:11.421Z","timestamp":1787691071421,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.fontshare.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 12 Aug 2026 11:02:22 GMT","end":"Tue, 10 Nov 2026 11:02:21 GMT"},"fingerprint":{"sha1":"69:47:B7:C8:96:DB:6E:32:43:04:72:6C:D2:39:29:8F:C3:31:33:36","sha256":"BA:97:33:5D:48:ED:D6:0F:A3:E5:33:7F:13:E8:CB:DC:E1:BE:18:1A:08:1E:1C:D1:BB:45:6E:E2:DD:DA:AF:15"}}},"request":{"raw":"GET /v2/css?f[]=satoshi@400,500,700,900\u0026f[]=jetbrains-mono@400,500,700\u0026display=swap HTTP/1.1\r\nHost: api.fontshare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://detectsysscanner.at/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 25 Aug 2026 20:51:11 GMT\r\ncontent-type: text/css; charset=utf-8\r\nvary: Accept-Encoding\r\nserver: BunnyCDN-SE1-725\r\ncdn-pullzone: 6318758\r\ncdn-requestcountrycode: NO\r\naccess-control-allow-headers: content-type, authorization, cookie\r\naccess-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=86400, stale-while-revalidate=604800\r\nx-request-id: GM8PdVYfN6y8HYMAAfiS\r\ncdn-proxyver: 1.62\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 200\r\ncdn-cachedat: 08/25/2026 13:29:33\r\ncdn-edgestorageid: 725\r\ncdn-requestid: 3fee36cec931144cbed8dab352ac5c24\r\ncdn-cache: HIT\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}],"data":{"size":2340,"size_decoded":1290,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"3d4ac42804672f363857ac55e385c61c","sha1":"9daa3a3de3702e2050354be54b4b2daf9e0468be","sha256":"1c055fbceec7a16d9572093fa0f30a7c962790eab0e939e129f099bab9af6669","sha512":"ed6c585c1f44d19119b3e3e446ac2f1de242f95d856effde417130c4b1dde8bf7c792f8431f99921e3e9388d1794209627e060dd0ed9cfedb76f97e9a0ac69c8","ssdeep":"","tlshash":"a741014239e030c948732c0877db1eec8d4d68131045e47e369ecb2caebae45439ab5c","first_seen":"2024-11-09T08:52:50.208783Z","last_seen":"2026-08-25T21:38:40.291238Z","times_seen":178,"resource_available":false,"data":null}},"time_used":86,"timings":{"blocked":-1,"dns":46,"connect":21,"send":0,"wait":8,"receive":-1,"ssl":11},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"detectsysscanner.at/sysscan-styles.css","fqdn":"detectsysscanner.at","domain":"detectsysscanner.at","tld":"at"},"ip":{"addr":"157.230.180.90","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://detectsysscanner.at/","date":"2026-08-25T20:51:11.423Z","timestamp":1787691071423,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"detectsysscanner.at","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 08:56:40 GMT","end":"Mon, 09 Nov 2026 08:56:39 GMT"},"fingerprint":{"sha1":"FB:2C:C2:AA:A7:AC:65:8E:BE:01:01:91:F8:01:F3:AA:6C:FC:A0:37","sha256":"BE:7E:F0:CC:09:99:A8:44:E9:9A:FE:BA:FB:19:7D:23:29:E8:75:90:E4:D0:1A:9A:E3:7E:F3:73:DA:5C:36:03"}}},"request":{"raw":"GET /sysscan-styles.css HTTP/1.1\r\nHost: detectsysscanner.at\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://detectsysscanner.at/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 20:51:11 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 11 Aug 2026 08:45:13 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a7ae119-6dd4\"\r\nexpires: Wed, 26 Aug 2026 08:51:11 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":28116,"size_decoded":6634,"mime_type":"text/css","magic":"Unicode text, UTF-8 text","md5":"e4f3ec6a5c986b999957e171cf7146a5","sha1":"0b9bbbe545fc341e66950ec1cc87382beae7873c","sha256":"91fd7b43da266a1d3b2fc76fc4e814e598c1601018466118a9b8be7e2c54f543","sha512":"03b60c37ea34990faf0d7484ffa200fd73637a0dd477108c375de7e92ad620ef4f9a6e1556e9398fffeb185ba4b9f4923b720e2bd7380b6c2fdb2e8ef8e8b60d","ssdeep":"384:ioqHpBRtW51SiCBBNIU/zx+yY2EK3nVayKF4XrCypKc:ioqHdtW51SiCbNIULwy4wVaq9","tlshash":"18c26792233452747d27ea7476875b4e735ca102990edabc6fe4100cdec93fa6663b8c","first_seen":"2026-08-25T20:43:57.45646Z","last_seen":"2026-08-25T21:38:40.291797Z","times_seen":17,"resource_available":false,"data":null}},"time_used":98,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":98,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"detectsysscanner.at","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"detectsysscanner.at","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"detectsysscanner.at/sysscan-scanner.js","fqdn":"detectsysscanner.at","domain":"detectsysscanner.at","tld":"at"},"ip":{"addr":"157.230.180.90","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://detectsysscanner.at/","date":"2026-08-25T20:51:11.425Z","timestamp":1787691071425,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"detectsysscanner.at","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 08:56:40 GMT","end":"Mon, 09 Nov 2026 08:56:39 GMT"},"fingerprint":{"sha1":"FB:2C:C2:AA:A7:AC:65:8E:BE:01:01:91:F8:01:F3:AA:6C:FC:A0:37","sha256":"BE:7E:F0:CC:09:99:A8:44:E9:9A:FE:BA:FB:19:7D:23:29:E8:75:90:E4:D0:1A:9A:E3:7E:F3:73:DA:5C:36:03"}}},"request":{"raw":"GET /sysscan-scanner.js HTTP/1.1\r\nHost: detectsysscanner.at\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://detectsysscanner.at/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 20:51:11 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 11 Aug 2026 08:45:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a7ae118-14479\"\r\nexpires: Wed, 26 Aug 2026 08:51:11 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":83065,"size_decoded":23072,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (315)","md5":"3907d2991c69be0b1cf727cd26bd3d7d","sha1":"87a4990ec02354ae353d7f42a17b1e0647785166","sha256":"51241da764ad61477c151116771a5d80cbfeeaf05d319bfd9a47bff843d54383","sha512":"9a32a1e24fb46872c84b167222e230d1c81b5a16a6977f8da65fe7efd4742c5e177a73512a373e6b25e4c12134c5ce02a889cb5b072dd204a2826a20f87e9377","ssdeep":"768:/+v9eRdU47sVJJjugaxCWmaASn1U9xqQTNv+zbJzX5/4P5iV:/OgRdLGJaFHj+9AUNWD45iV","tlshash":"b783946a9576293505a360ad5f9b61016321910b2e08fc4c3fce831c2f9d66f92f7bed","first_seen":"2026-08-25T20:43:57.444425Z","last_seen":"2026-08-25T20:51:41.82763Z","times_seen":5,"resource_available":true,"data":null}},"time_used":194,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":194,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-08-25","alert":"Detects file containing Telegram Bot API","trigger":"detectsysscanner.at/sysscan-scanner.js","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"detectsysscanner.at","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"detectsysscanner.at","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]}},{"url":{"schema":"https","addr":"detectsysscanner.at/favicon.svg","fqdn":"detectsysscanner.at","domain":"detectsysscanner.at","tld":"at"},"ip":{"addr":"157.230.180.90","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://detectsysscanner.at/","date":"2026-08-25T20:51:11.636Z","timestamp":1787691071636,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"detectsysscanner.at","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 08:56:40 GMT","end":"Mon, 09 Nov 2026 08:56:39 GMT"},"fingerprint":{"sha1":"FB:2C:C2:AA:A7:AC:65:8E:BE:01:01:91:F8:01:F3:AA:6C:FC:A0:37","sha256":"BE:7E:F0:CC:09:99:A8:44:E9:9A:FE:BA:FB:19:7D:23:29:E8:75:90:E4:D0:1A:9A:E3:7E:F3:73:DA:5C:36:03"}}},"request":{"raw":"GET /favicon.svg HTTP/1.1\r\nHost: detectsysscanner.at\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://detectsysscanner.at/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 20:51:11 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 755\r\nlast-modified: Tue, 11 Aug 2026 08:45:10 GMT\r\netag: \"6a7ae116-2f3\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":755,"size_decoded":1027,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"484d76251c2e1278bfe341c96c4d2414","sha1":"badfd8212fc08f78acb3e892454427b554f57dbe","sha256":"f848aaa8c7599928b7910eaecec780051c1777940c7c3e530afa0bf148359bf7","sha512":"2e8ad60f015f8a843581ecabb4ec08c95e30e1d6fcc757d0abe45630450415ced0bb0d8de00903ff8f44cb3a3ead26c79ef5584eaaaadaf51f9b3aa6cd2e308e","ssdeep":"","tlshash":"0a016812e59c811bc304870dd60cb969338fa2d39ba68100b1986b2a1a385e75dde3bc","first_seen":"2026-08-25T20:43:57.447582Z","last_seen":"2026-08-25T21:38:40.290069Z","times_seen":17,"resource_available":false,"data":null}},"time_used":97,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":97,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"detectsysscanner.at","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"detectsysscanner.at","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ipapi.co/json/","fqdn":"ipapi.co","domain":"ipapi.co","tld":"co"},"ip":{"addr":"104.26.9.44","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://detectsysscanner.at/","date":"2026-08-25T20:51:11.638Z","timestamp":1787691071638,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"ipapi.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 13 Aug 2026 09:56:10 GMT","end":"Wed, 11 Nov 2026 10:56:07 GMT"},"fingerprint":{"sha1":"F3:18:40:3B:2F:29:8F:72:5D:C9:F9:8D:83:FF:1A:13:26:F5:A1:7A","sha256":"17:EB:45:1D:BC:F6:67:CB:CB:85:0A:03:6F:55:93:30:F8:33:F4:78:1A:C0:46:17:64:09:C8:78:62:38:02:5D"}}},"request":{"raw":"GET /json/ HTTP/1.1\r\nHost: ipapi.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://detectsysscanner.at/\r\nOrigin: https://detectsysscanner.at\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 25 Aug 2026 20:51:11 GMT\r\ncontent-type: application/json\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\nallow: OPTIONS, GET, POST, HEAD, OPTIONS\r\nx-frame-options: DENY\r\nvary: Host, origin\r\naccess-control-allow-origin: https://detectsysscanner.at\r\nx-content-type-options: nosniff\r\nreferrer-policy: same-origin\r\ncross-origin-opener-policy: same-origin\r\ncontent-security-policy-report-only: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.stripe.com https://*.paddle.com https://www.google.com https://www.gstatic.com https://maps.gstatic.com https://maps.googleapis.com https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/; style-src 'self' 'unsafe-inline' https://*.paddle.com https://fonts.gstatic.com https://fonts.googleapis.com; img-src 'self' data: https://ipapi.co https://maps.gstatic.com https://maps.googleapis.com https://*.stripe.com; font-src 'self' data: https://fonts.gstatic.com https://fonts.googleapis.com; frame-src 'self' https://www.google.com https://*.stripe.com https://*.paddle.com https://www.google.com/recaptcha/ https://recaptcha.google.com/recaptcha/ https://challenges.cloudflare.com/; connect-src 'self' https://ipapi.co/ https://*.paddle.com https://*.stripe.com https://maps.googleapis.com https://www.google.com/recaptcha/; object-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'self';\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Rm1wDvE28snDTxCnW4CVn907VB8J0XWojmEpBoJXGzm415llzrOmD0x4RoaivzU%2Fy8UT1gkUkol6cEu6O5zCpoghOwOnuH%2FcLMjfzCs5gMMvLHKpvcuefnT6\"}]}\r\ncontent-encoding: br\r\ncf-ray: a30d792ddaf53181-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":742,"size_decoded":2142,"mime_type":"application/json","magic":"JSON text data","md5":"c9a83cf7b79bb169afa15370aaa9d642","sha1":"e0fb50e54473bf4468fe35add9fd6f777c8633dc","sha256":"9513f5d1cb329721ac415720ce53669e0e98329f191ef9bacb323dd35b4134c1","sha512":"b937a919074c16e74b79086e2d1037911cd8578d04669f9bb90914c0cf579bf200fee329b8282a3c700eddfe26dbe73407141bd88a949e219f394fdc0d672e41","ssdeep":"","tlshash":"5a01df68e4780f7b9cb813587078691b113422176e563a8e7bd4a74d0f8d8bf30b135e","first_seen":"2026-08-17T05:59:44.876786Z","last_seen":"2026-08-25T22:54:01.928294Z","times_seen":314,"resource_available":false,"data":null}},"time_used":267,"timings":{"blocked":0,"dns":3,"connect":1,"send":0,"wait":253,"receive":0,"ssl":10},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"detectsysscanner.at/favicon.svg","fqdn":"detectsysscanner.at","domain":"detectsysscanner.at","tld":"at"},"ip":{"addr":"157.230.180.90","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://detectsysscanner.at/","date":"2026-08-25T20:51:11.848Z","timestamp":1787691071848,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"detectsysscanner.at","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 08:56:40 GMT","end":"Mon, 09 Nov 2026 08:56:39 GMT"},"fingerprint":{"sha1":"FB:2C:C2:AA:A7:AC:65:8E:BE:01:01:91:F8:01:F3:AA:6C:FC:A0:37","sha256":"BE:7E:F0:CC:09:99:A8:44:E9:9A:FE:BA:FB:19:7D:23:29:E8:75:90:E4:D0:1A:9A:E3:7E:F3:73:DA:5C:36:03"}}},"request":{"raw":"GET /favicon.svg HTTP/1.1\r\nHost: detectsysscanner.at\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://detectsysscanner.at/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 20:51:11 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 755\r\nlast-modified: Tue, 11 Aug 2026 08:45:10 GMT\r\netag: \"6a7ae116-2f3\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":755,"size_decoded":1027,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"484d76251c2e1278bfe341c96c4d2414","sha1":"badfd8212fc08f78acb3e892454427b554f57dbe","sha256":"f848aaa8c7599928b7910eaecec780051c1777940c7c3e530afa0bf148359bf7","sha512":"2e8ad60f015f8a843581ecabb4ec08c95e30e1d6fcc757d0abe45630450415ced0bb0d8de00903ff8f44cb3a3ead26c79ef5584eaaaadaf51f9b3aa6cd2e308e","ssdeep":"","tlshash":"0a016812e59c811bc304870dd60cb969338fa2d39ba68100b1986b2a1a385e75dde3bc","first_seen":"2026-08-25T20:43:57.447582Z","last_seen":"2026-08-25T21:38:40.290069Z","times_seen":17,"resource_available":false,"data":null}},"time_used":98,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":98,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"detectsysscanner.at","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"detectsysscanner.at","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.detectsysscanner.at/","fqdn":"www.detectsysscanner.at","domain":"detectsysscanner.at","tld":"at"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-25T20:51:10.297Z","timestamp":1787691070297,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: www.detectsysscanner.at\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-25T23:40:46.009336Z","times_seen":18103337,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"www.detectsysscanner.at","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"www.detectsysscanner.at","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"detectsysscanner.at/","fqdn":"detectsysscanner.at","domain":"detectsysscanner.at","tld":"at"},"ip":{"addr":"157.230.180.90","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-25T20:51:10.567Z","timestamp":1787691070567,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"detectsysscanner.at","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 08:56:40 GMT","end":"Mon, 09 Nov 2026 08:56:39 GMT"},"fingerprint":{"sha1":"FB:2C:C2:AA:A7:AC:65:8E:BE:01:01:91:F8:01:F3:AA:6C:FC:A0:37","sha256":"BE:7E:F0:CC:09:99:A8:44:E9:9A:FE:BA:FB:19:7D:23:29:E8:75:90:E4:D0:1A:9A:E3:7E:F3:73:DA:5C:36:03"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: detectsysscanner.at\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 20:51:10 GMT\r\ncontent-type: text/html\r\nlast-modified: Tue, 11 Aug 2026 08:45:11 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a7ae117-629b\"\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":25243,"size_decoded":6026,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (346)","md5":"e31477eb27def0d6f3659386897bba93","sha1":"b2b5c37d84570cafd8623afcc82f66694552d6f7","sha256":"2fff7840fdf6db96c50bc206dc7ddabf15488624bcbf35124ab9800747f56897","sha512":"75793fa17fa4d263ffd663a6de04530cd31d756b1b34d0a3abb620c6c07314a66c1f55f0e95204dd2bcbf135870814f723d0b796123b696957f3b8e04542ed21","ssdeep":"384:vrBootg/c8k48CkvtipEWtcLPW8xTin72fzUy:tXD8kW1pEdLVxTinM5","tlshash":"8eb2f02061f9983780a745c967a29b3e6ef59343ca0a1104f7ac4be50fe3ccade37559","first_seen":"2026-08-25T20:43:57.452248Z","last_seen":"2026-08-25T20:51:41.832324Z","times_seen":5,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":-1,"dns":30,"connect":97,"send":0,"wait":99,"receive":0,"ssl":101},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"detectsysscanner.at","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"detectsysscanner.at","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}