{"report_id":"7dbcbf43-9256-4405-8b23-b3b49e50f86f","version":0,"status":"done","tags":["suspicious","telegram_bot"],"date":"2026-08-31T18:54:18Z","url":{"schema":"http","addr":"doc-sign.live/","fqdn":"doc-sign.live","domain":"doc-sign.live","tld":"live"},"ip":{"addr":"172.67.174.16","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"doc-sign.live/","fqdn":"doc-sign.live","domain":"doc-sign.live","tld":"live"},"title":"DocuSign · View Document","dom":{"size":14701,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"044abecbd4eb70f75b3a680a8c1749e4","sha1":"0093ef0f0fc3489196ae541e7d97aaa9889557f2","sha256":"fa300ac89705cc98410fa366fc5b828d21bbc803599cc0f69106fb7ce30e072c","sha512":"b07fc779b414ee68ed38ebe98aea0169464da2c155e61ab5a9add74044c8f13e931b021b03837035b82aed8976f98fa3928d79fb13d9412ca1545cb7526a2ed6","ssdeep":"192:s0wG0qayFO/A3F0cG8V5K8d5bGlhhhrHjt5Kj+0Cma2hx/RyJrZNNZoCaZo0v2Cf:sO7FugSD7jxpOoG5","tlshash":"8d62869f56b700827d13e4a43fbb5b8a2256c007d845cc693fdd57888f89399e8a378d","dom_hash":"domhash8f065e3d0768368f9bc634f88d37d47f","first_seen":"2026-08-31T18:32:42.833542Z","last_seen":"2026-08-31T18:54:19.787696Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"doc-sign.live/","fqdn":"doc-sign.live","domain":"doc-sign.live","tld":"live"},"ip":{"addr":"172.67.174.16","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-05T18:54:18Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-08-31","alert":"Detects file containing Telegram Bot API","trigger":"doc-sign.live/","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-08-31","alert":"Detects file containing Telegram Bot API","trigger":"doc-sign.live/favicon.ico","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"summary":[{"fqdn":"doc-sign.live","ip":{"addr":"172.67.174.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-08-31T18:32:12.084095Z","last_seen":"2026-08-31T18:32:12.084095Z","alert_count":3,"request_count":2,"received_data":31190,"sent_data":984,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"cdnjs.cloudflare.com","ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2009-02-17","domain_rank":1222,"first_seen":"2012-05-23T12:49:49Z","last_seen":"2026-08-30T23:05:19.421151Z","alert_count":0,"request_count":2,"received_data":211030,"sent_data":1153,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":[{"url":{"schema":"https","addr":"doc-sign.live/","fqdn":"doc-sign.live","domain":"doc-sign.live","tld":"live"},"ip":{"addr":"172.67.174.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"md5":"e48497143a1f58711219244b0e499bef","sha1":"7617ab28e1a4ca1354ad23d1c08c3ab7d00ad811","sha256":"160b7f49bcef0dfbcbbb0faa104f20d62e1e95d6b696651d0db0f4792fc6b763","sha512":"7d493e7d22aacf449fe6b04284c94a865b2037c1d6f915b5699617728ca057e29edbb8ce6fc133d8c300a1fb03e17f4b3308a984d69dcf3d53b58ce26be5b791","size":3137,"token":"8973166900:AAGWWepz9J0dqEKLt7-kLi1L8WR-oiLO-5k","is_revoked":false,"bot":{"token":"8973166900:AAGWWepz9J0dqEKLt7-kLi1L8WR-oiLO-5k","user_id":"8973166900","username":"ScreenconnectTLBOT","first_name":"Screen_connect","last_name":"","chat":{"chat_id":"-5513153438","title":"Screen Connect","type":"group","bot_is":"member","total_users":5,"active_members":null,"admins":[{"user_id":7858079665,"username":"summit_kataria","first_name":"Sumit","last_name":"Kataria","is_bot":false}]},"pending_messages":0}}],"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"doc-sign.live/","fqdn":"doc-sign.live","domain":"doc-sign.live","tld":"live"},"ip":{"addr":"172.67.174.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"e48497143a1f58711219244b0e499bef","sha1":"7617ab28e1a4ca1354ad23d1c08c3ab7d00ad811","sha256":"160b7f49bcef0dfbcbbb0faa104f20d62e1e95d6b696651d0db0f4792fc6b763","sha512":"7d493e7d22aacf449fe6b04284c94a865b2037c1d6f915b5699617728ca057e29edbb8ce6fc133d8c300a1fb03e17f4b3308a984d69dcf3d53b58ce26be5b791","ssdeep":"","tlshash":"0151518f24bb46b4171734ba274f64003133e00b3988e9953b9e83c44fa576980a36cb","size":3137,"data":"","first_seen":"2026-08-31T18:32:42.846472Z","last_seen":"2026-08-31T18:54:19.792861Z","times_seen":2,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-08-31","alert":"Detects file containing Telegram Bot API","trigger":"doc-sign.live/","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"log","text":"✅ DocuSign page ready. The button will redirect to your Dropbox file.","filename":"https://doc-sign.live/","line_number":483,"column_number":21}]},"http":[{"url":{"schema":"https","addr":"doc-sign.live/","fqdn":"doc-sign.live","domain":"doc-sign.live","tld":"live"},"ip":{"addr":"172.67.174.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-31T18:53:49.765Z","timestamp":1788202429765,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"doc-sign.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 29 Aug 2026 16:35:22 GMT","end":"Fri, 27 Nov 2026 17:34:06 GMT"},"fingerprint":{"sha1":"49:CC:65:47:30:83:35:13:CB:16:7E:3F:8E:20:4D:4B:89:A0:72:49","sha256":"D4:58:A3:76:72:9F:F4:6C:A4:5D:3F:39:B1:1B:D8:C2:17:31:7A:9C:FE:B1:67:78:61:FF:97:46:98:1F:A7:58"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: doc-sign.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Mon, 31 Aug 2026 18:53:50 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Sat, 29 Aug 2026 17:23:10 GMT\r\nvary: accept-encoding\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\npriority: u=0,i\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9F88h1TCYJ%2FVV7CFeJo7kcY0pwooJziw2WDitw%2BX47cj7F0QA%2BDe4ICWubsvkjiVCTQkkyJMj74jnh9vkJOFexZT1YLgcyDf20gMgZzCdCwPRc5id%2FalQ%2Ff6DY0i2jqg\"}]}\r\ncontent-encoding: zstd\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a33e3d8378c20b28-CPH\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":14729,"size_decoded":4785,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"21a01c8386ecf99f05b4ec5c804491d7","sha1":"4c16f6f6d1f970f9c33ac8cfcc2824c84c6d0768","sha256":"1a9706145035cf4e07b4be3835e4e49b13aa9832a88b9c24d16653781afe7de8","sha512":"8b6d42fb610950962c9291f0066762c93476e6526480521998ae97cf8e0421289fd168502ecbc3495f0f9c743a10a5d42f01d4276bc4ab3842483c04d993720f","ssdeep":"192:Y5wOZ0qayFO/A3F0cG8V5K8d5bGlhhhrHjt5Kj+0Cma2hx/RyJrZWNZlJ5aZH7v3:YT7FugSD7jAT5OHb3","tlshash":"ec62869f56b700827d13e4a43fbb5b8a2256c007d945cc693fdd57888f89398e8a378d","first_seen":"2026-08-31T18:32:42.840254Z","last_seen":"2026-08-31T18:54:19.789775Z","times_seen":2,"resource_available":false,"data":null}},"time_used":371,"timings":{"blocked":-1,"dns":187,"connect":29,"send":0,"wait":152,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-08-31","alert":"Detects file containing Telegram Bot API","trigger":"doc-sign.live/","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://doc-sign.live/","date":"2026-08-31T18:53:50.480Z","timestamp":1788202430480,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 10 Jul 2026 07:07:58 GMT","end":"Thu, 08 Oct 2026 08:07:45 GMT"},"fingerprint":{"sha1":"DF:66:97:F5:13:A2:C0:81:D3:5B:60:C4:B0:7F:CD:78:F5:91:14:D5","sha256":"3C:F2:95:73:83:BA:4D:D9:CC:85:8F:BC:7D:2C:22:CF:F3:49:9A:3A:E4:1D:FC:AE:CB:07:3D:66:89:74:0E:C5"}}},"request":{"raw":"GET /ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://doc-sign.live/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 31 Aug 2026 18:53:50 GMT\r\ncontent-type: text/css; charset=utf-8\r\ncontent-length: 14850\r\ncf-cache-status: BYPASS\r\naccess-control-allow-origin: *\r\ncache-control: no-transform, public, s-maxage=30672000, max-age=30672000, immutable\r\ncontent-encoding: br\r\nlast-modified: Mon, 22 Nov 2021 21:02:51 GMT\r\nvary: Accept-Encoding\r\nx-cdnjs-cache: HIT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/r2\r\nstrict-transport-security: max-age=15780000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ckj1SMmsJNNmVLlY6y7cdwBqPDofK2WxN10zWmXCp9kBhtMLUL0lpL5LCuIAR0xKt%2BB2RcahmGBxFNBcjJQtZW8e7NVUVf6lc7p41myY%2BaPGU314IH5vAu1M2grySRoFXnIhdY7D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.01,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nserver: cloudflare\r\ncf-ray: a33e3d869af756ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":83981,"size_decoded":15839,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (65311)","md5":"3d5ef2bf867c4054a2f336cdbad9e1dc","sha1":"07228d1fa3245ee156a27a353f45758a3207849f","sha256":"a361e7885c36bacb3fd9cb068da207c3b9329962cac022d06e28923939f575e8","sha512":"168deb96b663fe4eee8d39c78380864760fb912b34bf82cb6a7c36aa4b18b91944ccefad71a10f428810d0a6a818ddbaff3ae7db42264750dfb8b5a73a8eda04","ssdeep":"1536:YlMVM6MVM9MVMKMVMRsVMNdhwJHQ9Kll3ITRUHrt+z:sdhgw9kITRULt+z","tlshash":"458376e8e44c05d56732c44baf55b378a1b6f73cd5810da9f02f590c29d26a822c6f7a","first_seen":"2023-04-09T08:23:50Z","last_seen":"2026-08-31T19:25:41.427315Z","times_seen":21844,"resource_available":true,"data":null}},"time_used":77,"timings":{"blocked":-1,"dns":3,"connect":11,"send":0,"wait":63,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"doc-sign.live/favicon.ico","fqdn":"doc-sign.live","domain":"doc-sign.live","tld":"live"},"ip":{"addr":"172.67.174.16","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://doc-sign.live/","date":"2026-08-31T18:53:50.593Z","timestamp":1788202430593,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"doc-sign.live","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 29 Aug 2026 16:35:22 GMT","end":"Fri, 27 Nov 2026 17:34:06 GMT"},"fingerprint":{"sha1":"49:CC:65:47:30:83:35:13:CB:16:7E:3F:8E:20:4D:4B:89:A0:72:49","sha256":"D4:58:A3:76:72:9F:F4:6C:A4:5D:3F:39:B1:1B:D8:C2:17:31:7A:9C:FE:B1:67:78:61:FF:97:46:98:1F:A7:58"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: doc-sign.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://doc-sign.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Mon, 31 Aug 2026 18:53:50 GMT\r\ncontent-type: text/html\r\nlast-modified: Sat, 29 Aug 2026 17:23:10 GMT\r\nvary: accept-encoding\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\npriority: u=6,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BUzyZx7lvjB9huF5LnXcuLCXkvNJ3t6x8Sa%2B8z50T4TLCieNLAyz%2FBKhKz2DzeliSosD9zIhHNQE5KDJDZNeZOEkCkaVRYwQ2SBjL17HNytlSTasCUUjxqzETsoc4VxZ\"}]}\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncontent-encoding: zstd\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a33e3d8748ed0b28-CPH\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":14729,"size_decoded":4811,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"21a01c8386ecf99f05b4ec5c804491d7","sha1":"4c16f6f6d1f970f9c33ac8cfcc2824c84c6d0768","sha256":"1a9706145035cf4e07b4be3835e4e49b13aa9832a88b9c24d16653781afe7de8","sha512":"8b6d42fb610950962c9291f0066762c93476e6526480521998ae97cf8e0421289fd168502ecbc3495f0f9c743a10a5d42f01d4276bc4ab3842483c04d993720f","ssdeep":"192:Y5wOZ0qayFO/A3F0cG8V5K8d5bGlhhhrHjt5Kj+0Cma2hx/RyJrZWNZlJ5aZH7v3:YT7FugSD7jAT5OHb3","tlshash":"ec62869f56b700827d13e4a43fbb5b8a2256c007d945cc693fdd57888f89398e8a378d","first_seen":"2026-08-31T18:32:42.840254Z","last_seen":"2026-08-31T18:54:19.789775Z","times_seen":2,"resource_available":false,"data":null}},"time_used":149,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":146,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-08-31","alert":"Detects file containing Telegram Bot API","trigger":"doc-sign.live/favicon.ico","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/webfonts/fa-solid-900.woff2","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://doc-sign.live/","date":"2026-08-31T18:53:50.627Z","timestamp":1788202430627,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 10 Jul 2026 07:07:58 GMT","end":"Thu, 08 Oct 2026 08:07:45 GMT"},"fingerprint":{"sha1":"DF:66:97:F5:13:A2:C0:81:D3:5B:60:C4:B0:7F:CD:78:F5:91:14:D5","sha256":"3C:F2:95:73:83:BA:4D:D9:CC:85:8F:BC:7D:2C:22:CF:F3:49:9A:3A:E4:1D:FC:AE:CB:07:3D:66:89:74:0E:C5"}}},"request":{"raw":"GET /ajax/libs/font-awesome/6.0.0-beta3/webfonts/fa-solid-900.woff2 HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://doc-sign.live\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 31 Aug 2026 18:53:50 GMT\r\ncontent-type: application/octet-stream; charset=utf-8\r\ncontent-length: 125064\r\ncf-cache-status: BYPASS\r\naccess-control-allow-origin: *\r\ncache-control: no-transform, public, s-maxage=30672000, max-age=30672000, immutable\r\nlast-modified: Mon, 22 Nov 2021 21:02:51 GMT\r\nvary: Accept-Encoding\r\nx-cdnjs-cache: HIT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/r2\r\nstrict-transport-security: max-age=15780000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MhL6%2Flse1XRgYUcr%2BPzu9jKxEhs03t9UqO9qdc0%2FpHb%2BqRSIS%2F7eT%2BZnx1rq3xjVFCCTrNm3rXiz9odxgKo58ADJuFDY6XFhJ4LCTJlDAlyWssJ9Kb9%2BpQO7%2BlSTY2iABMJ7P17D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.01,\"max_age\":604800}\r\npriority: u=5,i=?0\r\nserver: cloudflare\r\ncf-ray: a33e3d87787223eb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":125064,"size_decoded":126060,"mime_type":"application/octet-stream; charset=utf-8","magic":"Web Open Font Format (Version 2), TrueType, length 125064, version 768.67","md5":"57b380d27f14f16e737bcca7e849cf79","sha1":"2e4280929d4d76fc0e31601c98f167f14630c209","sha256":"94e1bbc1c2a41ebc73fa5253fd563256c0035b4d69181e48f9aef9e474a11251","sha512":"88dd2321cc4711333411a24dab612daa68caf7cc31c892405bcbb9e89629ca15fcdd781bb26d7485f5819b5b48170ec8eaa2135701f4695cf94a1cb0c15bf649","ssdeep":"3072:W0ZXsLdN0s2s3suUQwuHn6XEedsYoDAEMUdAgofJ:W0OdNj10uHwsYoMHPg+J","tlshash":"b0c3122be28d689365654613aedd23ae1e795b7d8c4b6315c1bb3046f7ac7b83003b13","first_seen":"2023-04-09T08:23:50Z","last_seen":"2026-08-31T18:54:19.792076Z","times_seen":15468,"resource_available":true,"data":null}},"time_used":76,"timings":{"blocked":-1,"dns":0,"connect":7,"send":0,"wait":63,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}