{"report_id":"7e833f63-bfb3-4c00-8636-368a1288b8a1","version":6,"status":"done","tags":["suspicious","telegram_bot"],"date":"2026-04-01T17:43:36Z","url":{"schema":"http","addr":"aquamarine-babka-45edc2.netlify.app/","fqdn":"aquamarine-babka-45edc2.netlify.app","domain":"aquamarine-babka-45edc2.netlify.app","tld":"netlify.app"},"ip":{"addr":"63.176.8.218","port":0,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"final":{"url":{"schema":"https","addr":"aquamarine-babka-45edc2.netlify.app/","fqdn":"aquamarine-babka-45edc2.netlify.app","domain":"aquamarine-babka-45edc2.netlify.app","tld":"netlify.app"},"title":"Log in to Roblox","dom":{"size":21574,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"c80886d931ba58b72ed0f1dc2a8ddd14","sha1":"e00f48b810e81b0caab84ef336d4fce44b48f361","sha256":"e67e4b3793338ef6cd459ede9d5a7e76ddd3f2ceb28649e31968fb1c3f8138a4","sha512":"434dc41df8dab450f1ef7514ed413c674031b56fc635099cf9ce20b729e50f2c9811791e3473afe7cde7bf240f020346cd97ae80bdfacc2732c76ab820f058ed","ssdeep":"384:BrdHed8PE5qbeDjsmCEzxeoALPjlKo7nfFNDzX:7g8PE5qbeDVxeo+P4GNNDzX","tlshash":"6ca2b5af2ef714167953b079679b67053236c01be10acd283efc13588f86a944e73799","dom_hash":"domhash32dab62161eec022d3c60cf6587c1e5b","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"aquamarine-babka-45edc2.netlify.app/","fqdn":"aquamarine-babka-45edc2.netlify.app","domain":"aquamarine-babka-45edc2.netlify.app","tld":"netlify.app"},"ip":{"addr":"63.176.8.218","port":0,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-05-06T17:43:36Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":1,"urlquery":2,"analyzer":4}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-04-01T17:43:03Z","timestamp":1775065383,"ip_dst":{"addr":"35.157.26.135","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"ip_src":{"addr":"Client IP","port":34718,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET HUNTING Suspicious Netlify Hosted TLS SNI Request - Possible Phishing Landing","source":"{\"timestamp\":\"2026-04-01T17:43:03.015481+0000\",\"flow_id\":885454100940248,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.12\",\"src_port\":34718,\"dest_ip\":\"35.157.26.135\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2032760,\"rev\":1,\"signature\":\"ET HUNTING Suspicious Netlify Hosted TLS SNI Request - Possible Phishing Landing\",\"category\":\"Possible Social Engineering Attempted\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Web_Browsers\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2021_04_14\"],\"deployment\":[\"Perimeter\"],\"mitre_tactic_id\":[\"TA0001\"],\"mitre_tactic_name\":[\"Initial_Access\"],\"mitre_technique_id\":[\"T1566\"],\"mitre_technique_name\":[\"Phishing\"],\"signature_severity\":[\"Critical\"],\"tag\":[\"Phishing\"],\"updated_at\":[\"2021_04_14\"]}},\"tls\":{\"sni\":\"aquamarine-babka-45edc2.netlify.app\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"f4febc55ea12b31ae17cfb7e614afda8\",\"string\":\"771,4865,43-51\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":937,\"bytes_toclient\":3504,\"start\":\"2026-04-01T17:43:02.968152+0000\"}}"}],"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-04-01","alert":"Detects file containing Telegram Bot API","trigger":"aquamarine-babka-45edc2.netlify.app/","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-01","alert":"Sinkholed","trigger":"aquamarine-babka-45edc2.netlify.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-01","alert":"Phishing Block","trigger":"aquamarine-babka-45edc2.netlify.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-01","alert":"Sinkholed","trigger":"aquamarine-babka-45edc2.netlify.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"summary":[{"fqdn":"aquamarine-babka-45edc2.netlify.app","ip":{"addr":"35.157.26.135","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"domain_registered":"2018-05-08","domain_rank":0,"first_seen":"2026-02-20T13:50:42.991294Z","last_seen":"2026-02-20T13:50:42.991294Z","alert_count":14,"request_count":4,"received_data":7923534,"sent_data":2042,"comment":"","tags":null,"fingerprints":[{"name":"Netlify","description":"Netlify providers hosting and server-less backend services for web applications and static websites.","website":"https://www.netlify.com/","common_platform_enumeration":"","icon":"Netlify.svg","categories":["PaaS","CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":[{"url":{"schema":"https","addr":"aquamarine-babka-45edc2.netlify.app/","fqdn":"aquamarine-babka-45edc2.netlify.app","domain":"aquamarine-babka-45edc2.netlify.app","tld":"netlify.app"},"ip":{"addr":"35.157.26.135","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"md5":"c23e6297ff7ade0099642cca0bc717cf","sha1":"e582d0a2f117d241906f3c0edf85bea70cddf51a","sha256":"6add85ccc8676b38ebf622f2b7e6a007c1fc243ac480bd955eea8255c9b335a5","sha512":"2ae327185ec58ce2ad5b6526f05d71ba259066730517204917a1b9c0f0ae79d99c752db984b6dd1d53a4638a5049f128c7ffec7df6b668336aad1f5de2a11e11","size":8060,"token":"8575079756:AAGHr0G43VejMqQcAH74bmXIT15N6RNUR-U","is_revoked":false,"bot":{"token":"8575079756:AAGHr0G43VejMqQcAH74bmXIT15N6RNUR-U","user_id":"8575079756","username":"pizda_nurika_bolshaya_bot","first_name":"личный бот скам ссылок Nex1s","last_name":"","chat":{"chat_id":"7166904036","title":"","type":"private","bot_is":"member","total_users":2,"active_members":null,"admins":null},"pending_messages":1}}],"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"aquamarine-babka-45edc2.netlify.app/","fqdn":"aquamarine-babka-45edc2.netlify.app","domain":"aquamarine-babka-45edc2.netlify.app","tld":"netlify.app"},"ip":{"addr":"35.157.26.135","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":true,"md5":"c23e6297ff7ade0099642cca0bc717cf","sha1":"e582d0a2f117d241906f3c0edf85bea70cddf51a","sha256":"6add85ccc8676b38ebf622f2b7e6a007c1fc243ac480bd955eea8255c9b335a5","sha512":"2ae327185ec58ce2ad5b6526f05d71ba259066730517204917a1b9c0f0ae79d99c752db984b6dd1d53a4638a5049f128c7ffec7df6b668336aad1f5de2a11e11","ssdeep":"192:k5w9ALAjZAjTBKZaW4l1DnfuAxyxQJd9dz0t:koALPjlKo7nfFNDzC","tlshash":"91f164be26fa04311bb3b0b3a24b61453a37402f3a4ada5076fe47452fd2e614b77593","size":8060,"data":"","first_seen":"2026-02-20T13:50:45.886039Z","last_seen":"2026-04-01T17:43:38.461676Z","times_seen":3,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-04-01","alert":"Detects file containing Telegram Bot API","trigger":"aquamarine-babka-45edc2.netlify.app/","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"aquamarine-babka-45edc2.netlify.app/AQAKR7AJivrfmH99lyAXDr8loUsm6fsVE9H7EP5GVBS66F8MLanvmspt9MQhss5MkD0s0oTRhTcjaeG9D44M7YSYfeA%20(1).png","fqdn":"aquamarine-babka-45edc2.netlify.app","domain":"aquamarine-babka-45edc2.netlify.app","tld":"netlify.app"},"ip":{"addr":"35.157.26.135","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://aquamarine-babka-45edc2.netlify.app/","date":"2026-04-01T17:43:03.238Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.netlify.app","organization":"Netlify, Inc"},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Mon, 16 Feb 2026 00:00:00 GMT","end":"Fri, 19 Mar 2027 23:59:59 GMT"},"fingerprint":{"sha1":"34:CF:A1:69:24:C8:27:24:03:C7:7C:E7:F2:A1:8C:86:4A:EB:8B:FA","sha256":"BC:3A:81:34:C2:1A:84:2E:64:EA:34:D4:88:82:6D:D2:BA:50:F5:9A:3B:CB:AE:D1:E6:B7:1A:42:42:DE:14:78"}}},"request":{"raw":"GET /AQAKR7AJivrfmH99lyAXDr8loUsm6fsVE9H7EP5GVBS66F8MLanvmspt9MQhss5MkD0s0oTRhTcjaeG9D44M7YSYfeA%20(1).png HTTP/1.1\r\nHost: aquamarine-babka-45edc2.netlify.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://aquamarine-babka-45edc2.netlify.app/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\nage: 16560\r\ncache-control: public,max-age=0,must-revalidate\r\ncache-status: \"Netlify Edge\"; hit\r\ncontent-type: image/png\r\ndate: Wed, 01 Apr 2026 17:43:03 GMT\r\netag: \"9e37567ec96e6845d447717da13f5a6a-ssl\"\r\nserver: Netlify\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-nf-request-id: 01KN528G9QJ3E7WB6RDA6RK828\r\ncontent-length: 7824245\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Netlify","description":"Netlify providers hosting and server-less backend services for web applications and static websites.","website":"https://www.netlify.com/","common_platform_enumeration":"","icon":"Netlify.svg","categories":["PaaS","CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7824245,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 4800 x 2700, 8-bit/color RGB, non-interlaced","md5":"44d3c3d6a6f35b8b89efb0c28ac1df2d","sha1":"2f94284d24d72e9e59820abdf8be3343bf2cb8be","sha256":"2f3e12b3146155210e32a3974784cd5bcc25efb77d1dc5fcba5ab58dc9f270dd","sha512":"337e9ee8a3e50ab24723353cc7e707ff750fbfd0496a9ca6e3114be897ceb19bd1b9ea48968e07be6df0bdb1ca6c75f9174bd4acb36822dadb2651395b52b38e","ssdeep":"24576:YT/FIslRJ3Y7wHQnAogVNm15NqX4V+TsGpl:Q/OaRJy5neM5NfVY","tlshash":"7e253333c1ccea75d06a1367aab82fc4b0b55c859c4238c29b5216af359dfc5bc963c6","first_seen":"2026-02-20T13:50:45.884029Z","last_seen":"2026-04-01T17:43:38.451076Z","times_seen":3,"resource_available":false,"data":null}},"time_used":417,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":58,"receive":359,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-01","alert":"Sinkholed","trigger":"aquamarine-babka-45edc2.netlify.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-01","alert":"Phishing Block","trigger":"aquamarine-babka-45edc2.netlify.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-01","alert":"Sinkholed","trigger":"aquamarine-babka-45edc2.netlify.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"aquamarine-babka-45edc2.netlify.app/17490612323993-Photoroom.png","fqdn":"aquamarine-babka-45edc2.netlify.app","domain":"aquamarine-babka-45edc2.netlify.app","tld":"netlify.app"},"ip":{"addr":"35.157.26.135","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://aquamarine-babka-45edc2.netlify.app/","date":"2026-04-01T17:43:03.228Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.netlify.app","organization":"Netlify, Inc"},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Mon, 16 Feb 2026 00:00:00 GMT","end":"Fri, 19 Mar 2027 23:59:59 GMT"},"fingerprint":{"sha1":"34:CF:A1:69:24:C8:27:24:03:C7:7C:E7:F2:A1:8C:86:4A:EB:8B:FA","sha256":"BC:3A:81:34:C2:1A:84:2E:64:EA:34:D4:88:82:6D:D2:BA:50:F5:9A:3B:CB:AE:D1:E6:B7:1A:42:42:DE:14:78"}}},"request":{"raw":"GET /17490612323993-Photoroom.png HTTP/1.1\r\nHost: aquamarine-babka-45edc2.netlify.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://aquamarine-babka-45edc2.netlify.app/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\nage: 16560\r\ncache-control: public,max-age=0,must-revalidate\r\ncache-status: \"Netlify Edge\"; hit\r\ncontent-type: image/png\r\ndate: Wed, 01 Apr 2026 17:43:03 GMT\r\netag: \"787966f59f3272a877e6a377ae37f8e8-ssl\"\r\nserver: Netlify\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-nf-request-id: 01KN528G9D5T67RX9G580JWGNE\r\ncontent-length: 71599\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Netlify","description":"Netlify providers hosting and server-less backend services for web applications and static websites.","website":"https://www.netlify.com/","common_platform_enumeration":"","icon":"Netlify.svg","categories":["PaaS","CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":71599,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1280 x 938, 8-bit/color RGBA, non-interlaced","md5":"96fca1ed26bc04fe123737de5c6ea975","sha1":"92b6eaf5d5aa8fca48b4673ea128eab7ea2040bb","sha256":"6defb1b6a9522f06877862ff78867881422c4c61d8b732712ad079770841d80f","sha512":"6a7ed4d2b54464c9ac2cfcafbb7db12775e431d273cd48471ad4892224c0b530af37cb008f494007ccec081d6892fc861aa052480e815369cb901c0229e89f67","ssdeep":"1536:n1bvktjMBthLFyBufwwLP4b2c6FC9+XpFFroXy1okDRcAQEH730+:1Oo4uwws6FC9+5F9UoRchS","tlshash":"be63aeabcc857a6f651011aab79339e2f8b5688771755f5f6f3891360c1b2c0f632ca0","first_seen":"2026-02-20T13:50:45.882708Z","last_seen":"2026-04-01T17:43:38.454055Z","times_seen":3,"resource_available":false,"data":null}},"time_used":67,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":44,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-01","alert":"Phishing Block","trigger":"aquamarine-babka-45edc2.netlify.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-01","alert":"Sinkholed","trigger":"aquamarine-babka-45edc2.netlify.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-01","alert":"Sinkholed","trigger":"aquamarine-babka-45edc2.netlify.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"aquamarine-babka-45edc2.netlify.app/favicon.ico","fqdn":"aquamarine-babka-45edc2.netlify.app","domain":"aquamarine-babka-45edc2.netlify.app","tld":"netlify.app"},"ip":{"addr":"35.157.26.135","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://aquamarine-babka-45edc2.netlify.app/","date":"2026-04-01T17:43:03.446Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.netlify.app","organization":"Netlify, Inc"},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Mon, 16 Feb 2026 00:00:00 GMT","end":"Fri, 19 Mar 2027 23:59:59 GMT"},"fingerprint":{"sha1":"34:CF:A1:69:24:C8:27:24:03:C7:7C:E7:F2:A1:8C:86:4A:EB:8B:FA","sha256":"BC:3A:81:34:C2:1A:84:2E:64:EA:34:D4:88:82:6D:D2:BA:50:F5:9A:3B:CB:AE:D1:E6:B7:1A:42:42:DE:14:78"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: aquamarine-babka-45edc2.netlify.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://aquamarine-babka-45edc2.netlify.app/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nage: 16558\r\ncache-control: public,max-age=0,must-revalidate\r\ncache-status: \"Netlify Edge\"; hit\r\ncontent-encoding: br\r\ncontent-type: text/html; charset=utf-8\r\ndate: Wed, 01 Apr 2026 17:43:03 GMT\r\netag: 1768632146-ssl-df\r\nserver: Netlify\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding\r\nx-nf-request-id: 01KN528GG9B9MJ35CNGCH25BKJ\r\ncontent-length: 1217\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Netlify","description":"Netlify providers hosting and server-less backend services for web applications and static websites.","website":"https://www.netlify.com/","common_platform_enumeration":"","icon":"Netlify.svg","categories":["PaaS","CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3449,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"0f89e18d0abacb99149c5e59bf69b5e1","sha1":"9e1ebb10be890c5855eec444233c028270d3e65a","sha256":"8514f0009a58c6e0acb5468f88037732b59b70af5e524f452e3bef8fb33effc5","sha512":"5275d80f3f8f1f5e0d1b6b6b0745732a69d669d66dcdab418fc5a2094bffcb81ff1d34252c97c6dffe5470f0d359a3be03cfd3dfe3d729bf186917c8cf21ece0","ssdeep":"","tlshash":"1f61848dc9a7209b5c93643e27eb560a2274a247cd46da4c3fde6348cf492f214d36ac","first_seen":"2024-12-12T10:00:11.490986Z","last_seen":"2026-07-24T03:18:44.911081Z","times_seen":13599,"resource_available":true,"data":null}},"time_used":209,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":209,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-01","alert":"Sinkholed","trigger":"aquamarine-babka-45edc2.netlify.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-01","alert":"Phishing Block","trigger":"aquamarine-babka-45edc2.netlify.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-01","alert":"Sinkholed","trigger":"aquamarine-babka-45edc2.netlify.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"aquamarine-babka-45edc2.netlify.app/","fqdn":"aquamarine-babka-45edc2.netlify.app","domain":"aquamarine-babka-45edc2.netlify.app","tld":"netlify.app"},"ip":{"addr":"35.157.26.135","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-04-01T17:43:02.953Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.netlify.app","organization":"Netlify, Inc"},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Mon, 16 Feb 2026 00:00:00 GMT","end":"Fri, 19 Mar 2027 23:59:59 GMT"},"fingerprint":{"sha1":"34:CF:A1:69:24:C8:27:24:03:C7:7C:E7:F2:A1:8C:86:4A:EB:8B:FA","sha256":"BC:3A:81:34:C2:1A:84:2E:64:EA:34:D4:88:82:6D:D2:BA:50:F5:9A:3B:CB:AE:D1:E6:B7:1A:42:42:DE:14:78"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: aquamarine-babka-45edc2.netlify.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\nage: 16561\r\ncache-control: public,max-age=0,must-revalidate\r\ncache-status: \"Netlify Edge\"; hit\r\ncontent-encoding: br\r\ncontent-type: text/html; charset=UTF-8\r\ndate: Wed, 01 Apr 2026 17:43:03 GMT\r\netag: \"10793da7ff687c08d6f6b5ae44e379e2-ssl-df\"\r\nserver: Netlify\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding\r\nx-nf-request-id: 01KN528G3TB7P3TX029ETVWJ3X\r\ncontent-length: 5661\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Netlify","description":"Netlify providers hosting and server-less backend services for web applications and static websites.","website":"https://www.netlify.com/","common_platform_enumeration":"","icon":"Netlify.svg","categories":["PaaS","CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":22470,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with CRLF line terminators","md5":"bf1e9e58f3b668b03ed2bb3eb848e2c8","sha1":"136489eff7fae17e2fcef7e4754401814c34413a","sha256":"83f54527587324895fb5f8049f58e80e6b8c3e7621a6cf5b3bc51af2fd9af240","sha512":"36c2b41cb78f91586ccf77f2fc3ba9c34ac6c3a06eb16738e7e6e2d6527c8220683125e81ae45b6f28bab9dc96abed97da77f34fce34e3f5e3d167cb1d8141ae","ssdeep":"384:x1DmVsO4C4+Miz/1paR+x13K+vxhAdQ8Z8P:naVsO4e/1ARU3n8Z8P","tlshash":"e4a2952aaa4514067533b3b9eb635609f777402ba302c6687efc02561fb69048b73fdd","first_seen":"2026-02-20T13:50:45.881477Z","last_seen":"2026-04-01T17:43:38.458971Z","times_seen":3,"resource_available":false,"data":null}},"time_used":213,"timings":{"blocked":94,"dns":15,"connect":23,"send":0,"wait":24,"receive":1,"ssl":52},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-04-01","alert":"Detects file containing Telegram Bot API","trigger":"aquamarine-babka-45edc2.netlify.app/","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-01","alert":"Phishing Block","trigger":"aquamarine-babka-45edc2.netlify.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-04-01","alert":"Sinkholed","trigger":"aquamarine-babka-45edc2.netlify.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-01","alert":"Sinkholed","trigger":"aquamarine-babka-45edc2.netlify.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]}}]}