{"report_id":"7302b590-452b-403d-8388-7161fa5acbdb","version":0,"status":"done","tags":["suspicious"],"date":"2026-07-22T10:41:44Z","url":{"schema":"http","addr":"zoomeetingvideo.live","fqdn":"zoomeetingvideo.live","domain":"zoomeetingvideo.live","tld":"live"},"ip":{"addr":"31.177.109.168","port":0,"asn":56694,"as":"LLC Smart Ape","country":"Russia","country_code":"RU"},"final":{"url":{"schema":"https","addr":"zoomeetingvideo.live/","fqdn":"zoomeetingvideo.live","domain":"zoomeetingvideo.live","tld":"live"},"title":"Zoom - Meeting Invitation","dom":{"size":9332,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"26e79513480ea4931cfc04245f954591","sha1":"b3ada09d211726876134fbc2324d8d71ee537772","sha256":"b2f0c4b5a15d807e0d457bf3d2def85fc3a59d1fa0819f09b51a4dcf8c7c9618","sha512":"02334de96e6990dca5f1d42f17e64a95bc7c6dc9bb464f180c3a7fa9ab12798b83ea71b908357aa5897475c44407153b11f0ba3e07d072dc0433995247eb0446","ssdeep":"192:IIGkLq6GaGgVcFoBjF4Wd9pjJf7oCE2jNL463IQ3eKn0zPTu8oghsyHsc6I+Jj:IISogrHsc4","tlshash":"ae12912a32b30015a913dc697bb7af0a61659043d60ac5293d9c12cccff9ad5ddb33d8","dom_hash":"domhasha7672a17f3516a38c65a180d13abb5e0","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"zoomeetingvideo.live","fqdn":"zoomeetingvideo.live","domain":"zoomeetingvideo.live","tld":"live"},"ip":{"addr":"31.177.109.168","port":0,"asn":56694,"as":"LLC Smart Ape","country":"Russia","country_code":"RU"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-26T10:41:44Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-07-22","alert":"Detects file containing Telegram Bot API","trigger":"zoomeetingvideo.live/","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"zoomeetingvideo.live","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"summary":[{"fqdn":"api.telegram.org","ip":{"addr":"149.154.166.110","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"domain_registered":"2003-12-15","domain_rank":206724,"first_seen":"2015-06-25T10:09:00Z","last_seen":"2026-07-21T20:53:14.116342Z","alert_count":0,"request_count":1,"received_data":334,"sent_data":617,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.30.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"zoomeetingvideo.live","ip":{"addr":"31.177.109.168","port":443,"asn":56694,"as":"LLC Smart Ape","country":"Russia","country_code":"RU"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-07-22T10:37:35.467711Z","last_seen":"2026-07-22T10:37:35.467711Z","alert_count":4,"request_count":2,"received_data":10139,"sent_data":1005,"comment":"","tags":null,"fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.28.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"zoomeetingvideo.live/","fqdn":"zoomeetingvideo.live","domain":"zoomeetingvideo.live","tld":"live"},"ip":{"addr":"31.177.109.168","port":443,"asn":56694,"as":"LLC Smart Ape","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"cca70a01a52a6a427a8c9e3fe3b7cce3","sha1":"3ec36bbb3c08138c19a9a237617ecd97dca2d605","sha256":"f6ee049640267574d169b2544ab87806f5bacab6ade87779d36fa3b57e2fe3e7","sha512":"13781812ab4e8f384ba21ef52428cdf375567c51599efb41f94be0cb9ac89897ca0a2d30b89156d3530a2aa4d6ae0946b8e24a623d216863eb6e96864f142d2c","ssdeep":"","tlshash":"d361dc2a32b741249e53dc6e63fbae0c70666117e809c5593c0c12cd9ff1e98dc627ea","size":3300,"data":"","first_seen":"2026-07-22T10:10:55.084256Z","last_seen":"2026-07-22T10:41:45.072535Z","times_seen":6,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-07-22","alert":"Detects file containing Telegram Bot API","trigger":"zoomeetingvideo.live/","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"api.telegram.org/bot8990935556:AAGQgqLbX2jJPVl4pVOyLeiHkUvra7_I11o/sendMessage","fqdn":"api.telegram.org","domain":"telegram.org","tld":"org"},"ip":{"addr":"149.154.166.110","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://zoomeetingvideo.live/","date":"2026-07-22T10:41:28.379Z","timestamp":1784716888379,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.telegram.org","organization":""},"issuer":{"commonName":"Go Daddy Secure Certificate Authority - G2","organization":"GoDaddy.com, Inc."},"validity":{"start":"Tue, 11 Nov 2025 15:14:09 GMT","end":"Sun, 13 Dec 2026 15:14:09 GMT"},"fingerprint":{"sha1":"EC:27:13:72:1E:6C:94:9F:47:59:A4:24:4F:AB:9B:02:E3:6E:54:41","sha256":"64:47:03:9A:C9:ED:B9:03:8C:07:6E:AA:3D:BF:75:4B:4C:C1:4E:C1:A5:8C:83:2D:3E:FD:0C:E7:F7:82:C2:71"}}},"request":{"raw":"OPTIONS /bot8990935556:AAGQgqLbX2jJPVl4pVOyLeiHkUvra7_I11o/sendMessage HTTP/1.1\r\nHost: api.telegram.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://zoomeetingvideo.live/\r\nOrigin: https://zoomeetingvideo.live\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 204 \r\nserver: nginx/1.30.1\r\ndate: Wed, 22 Jul 2026 10:41:28 GMT\r\naccess-control-max-age: 86400\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: content-type\r\naccess-control-expose-headers: Content-Length,Content-Type,Date,Server,Connection\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"","fingerprints":[{"name":"Nginx:1.30.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":334,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T22:24:31.668752Z","times_seen":17461888,"resource_available":true,"data":null}},"time_used":77,"timings":{"blocked":-1,"dns":3,"connect":22,"send":0,"wait":22,"receive":0,"ssl":29},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zoomeetingvideo.live/","fqdn":"zoomeetingvideo.live","domain":"zoomeetingvideo.live","tld":"live"},"ip":{"addr":"31.177.109.168","port":443,"asn":56694,"as":"LLC Smart Ape","country":"Russia","country_code":"RU"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-22T10:41:17.691Z","timestamp":1784716877691,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zoomeetingvideo.live","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 13:09:38 GMT","end":"Mon, 19 Oct 2026 13:09:37 GMT"},"fingerprint":{"sha1":"EC:95:2F:16:9B:F1:0C:26:2C:CA:66:B1:A7:84:C6:A7:C1:EA:FA:19","sha256":"ED:17:EB:71:DE:9D:04:56:7E:49:84:F5:1C:F2:34:90:B4:F9:DD:45:3D:81:07:EC:BB:79:B7:6E:14:3E:0F:D2"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: zoomeetingvideo.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.3 (Ubuntu)\r\nDate: Wed, 22 Jul 2026 10:41:17 GMT\r\nContent-Type: text/html\r\nLast-Modified: Tue, 21 Jul 2026 06:49:58 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"6a5f1696-2505\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.28.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9477,"size_decoded":3344,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with CRLF line terminators","md5":"bd3d5d233d7ac160c88030669ce50209","sha1":"2a41a88daacb88bc9500678b6edfa9790a63587b","sha256":"31a7bc9bd6cd74b353ea3482a8432315b0a13b46a5105af526b15b0bc254dc97","sha512":"30ccb1ec156dda4fbe49bf755daf006292088611d75e3a9c869d987391327c1292f8368c14504527df5a4d02a6efca711ce3dfacfe62194d0818300e024754a0","ssdeep":"192:fI1kGC+erapIdjldo72T6iPDCSGRt3ZXjDEcGxF:fIjSMbXjDEcQF","tlshash":"6b12842662610015a933de79abb29f0df6659183d206c2293d9c12cedff9984cd73bdc","first_seen":"2026-07-22T10:10:55.08008Z","last_seen":"2026-07-22T10:41:45.068117Z","times_seen":6,"resource_available":true,"data":null}},"time_used":165,"timings":{"blocked":0,"dns":4,"connect":49,"send":0,"wait":50,"receive":0,"ssl":61},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-07-22","alert":"Detects file containing Telegram Bot API","trigger":"zoomeetingvideo.live/","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"zoomeetingvideo.live","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]}},{"url":{"schema":"https","addr":"zoomeetingvideo.live/favicon.ico","fqdn":"zoomeetingvideo.live","domain":"zoomeetingvideo.live","tld":"live"},"ip":{"addr":"31.177.109.168","port":443,"asn":56694,"as":"LLC Smart Ape","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://zoomeetingvideo.live/","date":"2026-07-22T10:41:18.071Z","timestamp":1784716878071,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zoomeetingvideo.live","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 13:09:38 GMT","end":"Mon, 19 Oct 2026 13:09:37 GMT"},"fingerprint":{"sha1":"EC:95:2F:16:9B:F1:0C:26:2C:CA:66:B1:A7:84:C6:A7:C1:EA:FA:19","sha256":"ED:17:EB:71:DE:9D:04:56:7E:49:84:F5:1C:F2:34:90:B4:F9:DD:45:3D:81:07:EC:BB:79:B7:6E:14:3E:0F:D2"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: zoomeetingvideo.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zoomeetingvideo.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx/1.28.3 (Ubuntu)\r\nDate: Wed, 22 Jul 2026 10:41:18 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx:1.28.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":162,"size_decoded":340,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"a13cff29e34dd0decb4e7468d08f5f22","sha1":"65c6f6e54f390645dd4fd8fb8288449a463a1631","sha256":"7b61a0032297d2b400d3dd5e69556a8ca31adb717464c247aaf997f4b4de26f6","sha512":"b50b5c040cb0f9449a45b7235157954166550a0029c0f479cf4ce8091e2b4af718f3ef797fb9e3d5849176b86492ceecd7244c36ec41cb99626a5a3d2a8361bf","ssdeep":"","tlshash":"dcc08c6e2513bc4cc663217422c364a0c08e93a7a5aa82228480805331cb29a8ac7396","first_seen":"2026-05-04T00:40:16.081578Z","last_seen":"2026-07-22T22:27:52.248289Z","times_seen":2488,"resource_available":true,"data":null}},"time_used":49,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":49,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"zoomeetingvideo.live","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}