{"report_id":"762e4d58-ac23-46f7-90c3-4bdeffb1102d","version":0,"status":"done","tags":["suspicious","telegram_bot"],"date":"2026-06-24T22:22:49Z","url":{"schema":"https","addr":"ledgersecuritycheck.org/","fqdn":"ledgersecuritycheck.org","domain":"ledgersecuritycheck.org","tld":"org"},"ip":{"addr":"18.168.91.127","port":0,"asn":16509,"as":"AMAZON-02","country":"United Kingdom","country_code":"GB"},"final":{"url":{"schema":"https","addr":"www.ledgersecuritycheck.org/","fqdn":"www.ledgersecuritycheck.org","domain":"ledgersecuritycheck.org","tld":"org"},"title":"Ledger Security Check","dom":{"size":19406,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (4194)","md5":"12484560ad1e02197aee8764ceccb814","sha1":"1c75dc572ddc978f158e75bbef2c859b8e41a12f","sha256":"68b8f81646e77da9108346c88cb8c04a76c3f19d1ec62116e62057007f73f03d","sha512":"d8a5b6b669a11c91e68750b16577da07b2df222a4b1f6c19b76ca77f72f0a126d1f74587a07816afcdd65128b2b714eea678ff61448efaa85336811a47be2065","ssdeep":"192:BrhIog9v1LAHjj0+iNfS5I+cHhq2LrASP7+iL+KbudUYf1Qv9THqSwaNMjJbMeM1:BrAhecLiMeMKaoaHsVj/Sm4Ho8OO","tlshash":"93929526c153151f066798fdb3f3c68a3323c103ed06c96cf69e53548f89a94aea9b4c","dom_hash":"domhash74ca640e0b0d467356c69c77370b65b4","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"ledgersecuritycheck.org/","fqdn":"ledgersecuritycheck.org","domain":"ledgersecuritycheck.org","tld":"org"},"ip":{"addr":"18.168.91.127","port":0,"asn":16509,"as":"AMAZON-02","country":"United Kingdom","country_code":"GB"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-07-29T22:22:49Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":5}},"detection":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-06-24","alert":"Detects file containing Telegram Bot API","trigger":"www.ledgersecuritycheck.org/","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-24","alert":"Sinkholed","trigger":"ledgersecuritycheck.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-24","alert":"Sinkholed","trigger":"ledgersecuritycheck.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-24","alert":"Sinkholed","trigger":"www.ledgersecuritycheck.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-24","alert":"Sinkholed","trigger":"www.ledgersecuritycheck.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"summary":[{"fqdn":"analytics.tiiny.site","ip":{"addr":"3.10.126.206","port":443,"asn":16509,"as":"AMAZON-02","country":"United Kingdom","country_code":"GB"},"domain_registered":"2020-04-21","domain_rank":5183494,"first_seen":"2022-07-02T08:24:07Z","last_seen":"2026-06-19T10:14:02.537351Z","alert_count":0,"request_count":2,"received_data":2018,"sent_data":1007,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.22.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"ledgersecuritycheck.org","ip":{"addr":"18.168.91.127","port":443,"asn":16509,"as":"AMAZON-02","country":"United Kingdom","country_code":"GB"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":2,"request_count":1,"received_data":264,"sent_data":492,"comment":"","tags":null,"fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}]},{"fqdn":"www.ledgersecuritycheck.org","ip":{"addr":"13.249.8.5","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"2026-06-19","domain_rank":0,"first_seen":"2026-06-24T22:22:49.13689Z","last_seen":"2026-06-24T22:22:49.13689Z","alert_count":6,"request_count":2,"received_data":31599,"sent_data":1026,"comment":"","tags":null,"fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Tiiny Host","description":"Tiiny Host is a web hosting service for static sites with support for custom domains, SSL, password protection, and built-in analytics.","website":"https://tiiny.host","common_platform_enumeration":"","icon":"Tiiny Host.png","categories":["PaaS"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":[{"url":{"schema":"https","addr":"www.ledgersecuritycheck.org/","fqdn":"www.ledgersecuritycheck.org","domain":"ledgersecuritycheck.org","tld":"org"},"ip":{"addr":"13.249.8.5","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"md5":"132b6471a0513045e60ab16591604596","sha1":"5c2fb5d55c82463ae17ec6f29e9bbd087ef0eeb7","sha256":"54058c09bd1ebf558a9830868c0a97fafcc298e6990f9331ab2350062575a9a2","sha512":"8a6145ef676e3d62545163a80365c74a870be84e40f92ba40281cf2e96a106a94a0b62d9616c1b8b79a523ac6ebae841bf8f69b39698262f1fcb1398666e0adc","size":5828,"token":"8915577688:AAHOUaedWsv8LXV9CmU825V_4bpUKF4BS3M","is_revoked":false,"bot":{"token":"8915577688:AAHOUaedWsv8LXV9CmU825V_4bpUKF4BS3M","user_id":"8915577688","username":"leddggrbot","first_name":"ledger","last_name":"","chat":{"chat_id":"8378317258","title":"","type":"private","bot_is":"member","total_users":2,"active_members":null,"admins":null},"pending_messages":0}}],"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"www.ledgersecuritycheck.org/","fqdn":"www.ledgersecuritycheck.org","domain":"ledgersecuritycheck.org","tld":"org"},"ip":{"addr":"13.249.8.5","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"132b6471a0513045e60ab16591604596","sha1":"5c2fb5d55c82463ae17ec6f29e9bbd087ef0eeb7","sha256":"54058c09bd1ebf558a9830868c0a97fafcc298e6990f9331ab2350062575a9a2","sha512":"8a6145ef676e3d62545163a80365c74a870be84e40f92ba40281cf2e96a106a94a0b62d9616c1b8b79a523ac6ebae841bf8f69b39698262f1fcb1398666e0adc","ssdeep":"96:jkz7XReGnHVYvpuZs733iIoK/IM6RFqgd5q+IaqV4TB+HCw6yHJBe5EWK:S7B5VYvp6s733RoK/IFRFqMqlaqV4TBq","tlshash":"dbc1221a2eb325210ab3b1bf37db615ab222403b2844de487d5c83051f91f645bbef9c","size":5828,"data":"","first_seen":"2026-06-24T22:22:54.63796Z","last_seen":"2026-06-24T22:22:54.63796Z","times_seen":1,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-06-24","alert":"Detects file containing Telegram Bot API","trigger":"www.ledgersecuritycheck.org/","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}},{"url":{"schema":"https","addr":"analytics.tiiny.site/js/plausible.js","fqdn":"analytics.tiiny.site","domain":"tiiny.site","tld":"site"},"ip":{"addr":"3.10.126.206","port":443,"asn":16509,"as":"AMAZON-02","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"5fce354514318424fd93ceb724f574d0","sha1":"4555a156f92cf24c5e68b965597019655b893ac2","sha256":"7eec3429c76cb48e5fd457c5afb71b7cf34bc4298d53023bae8aea715443b4a9","sha512":"c71512329ee1145bf975e068db5b3ab3c17d16b3cd1b3c0632c1e6e695e4e3f4ba57f0346afc0a0de67d92b0e076099f53d052ab4629752fe37a656ee3d26740","ssdeep":"","tlshash":"8521a59b6812f675cc789a62aa3f731631377174b805a4126002c6523c24e9f837cece","size":1332,"data":"","first_seen":"2023-03-07T01:03:26Z","last_seen":"2026-07-05T20:29:35.403541Z","times_seen":1295,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"log","text":"🔐 Ledger Security Check ready","filename":"https://www.ledgersecuritycheck.org/","line_number":0,"column_number":0},{"level":"log","text":"📨 Bot configured and ready to send to Telegram!","filename":"https://www.ledgersecuritycheck.org/","line_number":0,"column_number":0}]},"http":[{"url":{"schema":"https","addr":"ledgersecuritycheck.org/","fqdn":"ledgersecuritycheck.org","domain":"ledgersecuritycheck.org","tld":"org"},"ip":{"addr":"18.168.91.127","port":443,"asn":16509,"as":"AMAZON-02","country":"United Kingdom","country_code":"GB"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-06-24T22:22:16.875Z","timestamp":1782339736875,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledgersecuritycheck.org","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 20 Jun 2026 09:39:05 GMT","end":"Fri, 18 Sep 2026 09:39:04 GMT"},"fingerprint":{"sha1":"D5:2E:D1:43:38:59:A3:E7:D6:9C:40:B6:D5:42:43:F2:4D:E8:B7:22","sha256":"A8:75:87:6D:9C:A9:15:F8:AA:5E:BE:FC:B0:AC:A4:29:77:1C:EB:EC:88:06:1D:0D:D6:9A:15:3F:73:B1:D4:DF"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: ledgersecuritycheck.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nX-Powered-By: Express\r\nLocation: https://www.ledgersecuritycheck.org/\r\nVary: Accept\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 128\r\nDate: Wed, 24 Jun 2026 22:22:17 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-07T02:07:06.830948Z","times_seen":17047012,"resource_available":true,"data":null}},"time_used":596,"timings":{"blocked":-1,"dns":499,"connect":22,"send":0,"wait":23,"receive":0,"ssl":51},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-24","alert":"Sinkholed","trigger":"ledgersecuritycheck.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-24","alert":"Sinkholed","trigger":"ledgersecuritycheck.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.ledgersecuritycheck.org/","fqdn":"www.ledgersecuritycheck.org","domain":"ledgersecuritycheck.org","tld":"org"},"ip":{"addr":"13.249.8.5","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-06-24T22:22:17.484Z","timestamp":1782339737484,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.ledgersecuritycheck.org","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Jun 2026 00:00:00 GMT","end":"Sat, 02 Jan 2027 23:59:59 GMT"},"fingerprint":{"sha1":"E4:8E:DF:68:A5:68:F0:E1:7B:CA:43:59:98:1C:BC:BA:B5:93:D0:B0","sha256":"C7:AF:AD:18:00:C0:D5:FC:B1:90:6F:50:ED:FD:2E:C4:35:BF:DA:6E:3E:5B:68:35:BA:D4:72:7B:B5:47:D7:69"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: www.ledgersecuritycheck.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/html\r\nlast-modified: Sat, 20 Jun 2026 10:24:18 GMT\r\ncontent-encoding: gzip\r\ndate: Wed, 24 Jun 2026 22:22:18 GMT\r\ncache-control: no-cache, must-revalidate\r\netag: W/\"0781efc70976a4b1c472b772e34f7cce\"\r\nserver: Tiiny Host\r\nx-hosted-by: Tiiny Host\r\nvia: 1.1 c4c5dabdc780c35f0408131822b3a96a.cloudfront.net (CloudFront)\r\nx-cache: RefreshHit from cloudfront\r\nx-amz-cf-pop: ARN53-P3\r\nx-amz-cf-id: STSJOcNtIEA00T89G4p0Z4uO0kSZVN91l2Ks1cTMipFkOO60Cy6ENg==\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Tiiny Host","description":"Tiiny Host is a web hosting service for static sites with support for custom domains, SSL, password protection, and built-in analytics.","website":"https://tiiny.host","common_platform_enumeration":"","icon":"Tiiny Host.png","categories":["PaaS"]}],"data":{"size":15499,"size_decoded":4817,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (813), with CRLF line terminators","md5":"0781efc70976a4b1c472b772e34f7cce","sha1":"4e0cbe030898411d29660fd68c89e1bbc9b48212","sha256":"578c78509b9b831ddb544bbb29d9f11057fc2ae6a674a66fb89be4b163f59a90","sha512":"a77ac46b2eb4b4a10ffc236aca76fd03f0b1036ec580408b38fb7ed5c5cbdd373ddbddc39d8b77d56f8167da8adb4565f112c38ecadba39de058f4d18e91d5bf","ssdeep":"192:LJy7M32s+TSWo6PmiRBZTjJg6MPjJbMoPFnzodyyMJsypfUKkGYiYNME9sOq7yQX:JsWMoP2qsG/kPOOq7yQfP","tlshash":"a562841ad64219520933e3bdbfe3ca4ef7664127c001836d3ede52540fb95a4967af4c","first_seen":"2026-06-24T22:22:54.635107Z","last_seen":"2026-06-24T22:22:54.635107Z","times_seen":1,"resource_available":true,"data":null}},"time_used":567,"timings":{"blocked":-1,"dns":142,"connect":8,"send":0,"wait":236,"receive":0,"ssl":180},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-06-24","alert":"Detects file containing Telegram Bot API","trigger":"www.ledgersecuritycheck.org/","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-24","alert":"Sinkholed","trigger":"www.ledgersecuritycheck.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-24","alert":"Sinkholed","trigger":"www.ledgersecuritycheck.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]}},{"url":{"schema":"https","addr":"analytics.tiiny.site/js/plausible.js","fqdn":"analytics.tiiny.site","domain":"tiiny.site","tld":"site"},"ip":{"addr":"3.10.126.206","port":443,"asn":16509,"as":"AMAZON-02","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.ledgersecuritycheck.org/","date":"2026-06-24T22:22:18.496Z","timestamp":1782339738496,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.tiiny.site","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Jun 2026 20:00:44 GMT","end":"Sun, 20 Sep 2026 20:00:43 GMT"},"fingerprint":{"sha1":"42:F3:6F:62:CD:83:AA:2C:DE:B8:56:02:71:42:D2:46:BD:B4:8B:20","sha256":"4C:52:9F:50:AD:13:03:2A:98:57:7E:D8:EF:F2:57:09:25:68:7B:73:27:30:48:7C:30:96:08:6B:2F:77:11:37"}}},"request":{"raw":"GET /js/plausible.js HTTP/1.1\r\nHost: analytics.tiiny.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ledgersecuritycheck.org/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.22.1\r\nDate: Wed, 24 Jun 2026 22:22:18 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 1332\r\nConnection: keep-alive\r\naccess-control-allow-origin: *\r\ncache-control: max-age=0, private, must-revalidate\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.22.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1332,"size_decoded":1655,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1332), with no line terminators","md5":"5fce354514318424fd93ceb724f574d0","sha1":"4555a156f92cf24c5e68b965597019655b893ac2","sha256":"7eec3429c76cb48e5fd457c5afb71b7cf34bc4298d53023bae8aea715443b4a9","sha512":"c71512329ee1145bf975e068db5b3ab3c17d16b3cd1b3c0632c1e6e695e4e3f4ba57f0346afc0a0de67d92b0e076099f53d052ab4629752fe37a656ee3d26740","ssdeep":"","tlshash":"8521a59b6812f675cc789a62aa3f731631377174b805a4126002c6523c24e9f837cece","first_seen":"2023-03-07T01:03:26Z","last_seen":"2026-07-05T20:29:35.403541Z","times_seen":1295,"resource_available":true,"data":null}},"time_used":148,"timings":{"blocked":-1,"dns":28,"connect":23,"send":0,"wait":25,"receive":0,"ssl":72},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"analytics.tiiny.site/api/event","fqdn":"analytics.tiiny.site","domain":"tiiny.site","tld":"site"},"ip":{"addr":"3.10.126.206","port":443,"asn":16509,"as":"AMAZON-02","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.ledgersecuritycheck.org/","date":"2026-06-24T22:22:18.669Z","timestamp":1782339738669,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.tiiny.site","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Jun 2026 20:00:44 GMT","end":"Sun, 20 Sep 2026 20:00:43 GMT"},"fingerprint":{"sha1":"42:F3:6F:62:CD:83:AA:2C:DE:B8:56:02:71:42:D2:46:BD:B4:8B:20","sha256":"4C:52:9F:50:AD:13:03:2A:98:57:7E:D8:EF:F2:57:09:25:68:7B:73:27:30:48:7C:30:96:08:6B:2F:77:11:37"}}},"request":{"raw":"POST /api/event HTTP/1.1\r\nHost: analytics.tiiny.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: text/plain\r\nContent-Length: 111\r\nOrigin: https://www.ledgersecuritycheck.org\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ledgersecuritycheck.org/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/1.1 202 Accepted\r\nServer: nginx/1.22.1\r\nDate: Wed, 24 Jun 2026 22:22:18 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nContent-Length: 2\r\nConnection: keep-alive\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: \r\ncache-control: max-age=0, private, must-revalidate\r\nx-request-id: GLwkjJWOWX2nUzoB-vSB\r\n\r\n","headers":null,"cookies":null,"status_code":"202","status_text":"Accepted","fingerprints":[{"name":"Nginx:1.22.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2,"size_decoded":363,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text, with no line terminators","md5":"444bcb3a3fcf8389296c49467f27e1d6","sha1":"7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb","sha256":"2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df","sha512":"9fbbbb5a0f329f9782e2356fa41d89cf9b3694327c1a934d6af2a9df2d7f936ce83717fb513196a4ce5548471708cd7134c2ae99b3c357bcabb2eafc7b9b7570","ssdeep":"","tlshash":"c710000000000000300000000000000000000000000000000000000000000c0000c000","first_seen":"2023-03-08T02:32:37Z","last_seen":"2026-07-07T02:04:39.259989Z","times_seen":433303,"resource_available":true,"data":null}},"time_used":108,"timings":{"blocked":0,"dns":0,"connect":23,"send":0,"wait":36,"receive":0,"ssl":49},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.ledgersecuritycheck.org/favicon.ico","fqdn":"www.ledgersecuritycheck.org","domain":"ledgersecuritycheck.org","tld":"org"},"ip":{"addr":"13.249.8.5","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.ledgersecuritycheck.org/","date":"2026-06-24T22:22:18.776Z","timestamp":1782339738776,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.ledgersecuritycheck.org","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Fri, 19 Jun 2026 00:00:00 GMT","end":"Sat, 02 Jan 2027 23:59:59 GMT"},"fingerprint":{"sha1":"E4:8E:DF:68:A5:68:F0:E1:7B:CA:43:59:98:1C:BC:BA:B5:93:D0:B0","sha256":"C7:AF:AD:18:00:C0:D5:FC:B1:90:6F:50:ED:FD:2E:C4:35:BF:DA:6E:3E:5B:68:35:BA:D4:72:7B:B5:47:D7:69"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: www.ledgersecuritycheck.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.ledgersecuritycheck.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: application/octet-stream\r\ncontent-length: 15086\r\nlast-modified: Sat, 20 Jun 2026 10:24:18 GMT\r\ndate: Wed, 24 Jun 2026 22:22:19 GMT\r\ncache-control: no-cache, must-revalidate\r\netag: \"0fdeea3fc2431d1b14523cdab5e022ed\"\r\nserver: Tiiny Host\r\nx-hosted-by: Tiiny Host\r\nvia: 1.1 c4c5dabdc780c35f0408131822b3a96a.cloudfront.net (CloudFront)\r\nx-cache: RefreshHit from cloudfront\r\nx-amz-cf-pop: ARN53-P3\r\nx-amz-cf-id: SCF6bssCULYL1gCrcPcuLRdT-dccl8zOUX1rnAQWvR9sAt8r-77PUA==\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":15086,"size_decoded":15599,"mime_type":"application/octet-stream","magic":"MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel","md5":"0fdeea3fc2431d1b14523cdab5e022ed","sha1":"4920ffd6d2dda31fb6bd294f2c9517e0a4f2d5b9","sha256":"b9cd9673e19f8035f94313db15e7097addae810957a33e05824f7a04606680c6","sha512":"c8c609dd41010f40d7f922db1f23b55e9fccc20d493739627735845edf8ea3873559267a414e40ac02bf7eb331c48e4927b3678932723c352fd3010fa32fb21a","ssdeep":"96:jkTvKKFknkkpk8kkjkkZkkkkkkkkkNkkkkkkkkkkMkkkkkkkkk9ikkkkkkkkkk6x:jipcNGu6Q8","tlshash":"8d62006eb6a6efc5f84c0571fc96c7f86606ec4e9f05571325d877ab38b62a50406034","first_seen":"2025-12-27T07:01:04.974152Z","last_seen":"2026-07-04T09:05:12.358344Z","times_seen":60,"resource_available":false,"data":null}},"time_used":175,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":175,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-24","alert":"Sinkholed","trigger":"www.ledgersecuritycheck.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-24","alert":"Sinkholed","trigger":"www.ledgersecuritycheck.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}