WEBSITE ANALYSIS REPORT

https://vr.znbbmwq.com/inv/Adobe_Installer.html

26 Sep 2026 · 00:37:39.000 UTCpublic

Report tags: adobe phishing suspicious telegram_bot
Submit tags: openphish

Request review

Phishing detected

6 detections · review the detection signals

Review evidence →

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

00:37:06.248 GET 200 document 1.15 MB 1719 ms 4 alerts

Transaction #07

Request / response

URL

GET HTTPS

https://vr.znbbmwq.com/inv/Adobe_Installer.html

IP / ASN

64.247.177.79

Unknown

Requested by: Not recorded

Resource information

File type: HTML document, ASCII text, with very long lines (31834)
MIME type: text/html
First seen (UTC): 26 Sep 2026 · 00:37:45.907 UTC
Last seen (UTC): 07 Oct 2026 · 05:56:45.901 UTC
Times seen: 2

Size: 1.15 MB (1200765 bytes)
MD5: b4772ee894795e531c70f3d17e9aa98f
SHA1: 2228562553373444388ae9e9755491943428284f
SHA256: 04b923364251d237fe454e3f0ccdf5cb332d1751092bd5bed064aa98c9f841c0

Certificate information

Issuer: Let's Encrypt · YR2
Subject: vr.znbbmwq.com
Protocol / cipher: TLSv1.3 · TLS_AES_128_GCM_SHA256
SHA1 fingerprint: 9F:15:87:5A:84:A1:3A:9A:2B:BC:27:AE:D0:3F:8B:A5:34:B8:9C:3F
Valid from: Tue, 22 Sep 2026 03:12:02 GMT
Valid until: Mon, 21 Dec 2026 03:12:01 GMT

Technology fingerprints

Apache HTTP Server (Web servers)

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
urlquery Phishing - Adobe	medium	Phishing
urlquery Suspicious - Suspicious Javascript code	medium	Suspicious
YARAhub by abuse.ch Detects file containing Telegram Bot API	medium	malware
DNS4EU Sinkholed	medium	Malicious

HTTP headers

Request headers

GET /inv/Adobe_Installer.html HTTP/1.1
Host: vr.znbbmwq.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br, zstd
Sec-GPC: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Priority: u=0, i
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/1.1 200 OK
Date: Sat, 26 Sep 2026 00:37:06 GMT
Server: Apache
Last-Modified: Fri, 25 Sep 2026 10:58:17 GMT
Accept-Ranges: bytes
Content-Length: 1200765
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html

00:37:07.665 GET 404 script 355 B 471 ms 2 alerts

00:37:07.669 GET 404 script 355 B 467 ms 2 alerts

00:37:07.872 GET 200 img 14.8 KB 233 ms 1 alerts

00:37:08.201 GET 404 img 355 B 154 ms 2 alerts

00:37:08.339 GET 200 img 639 B 67 ms 1 alerts

00:37:08.341 GET 200 img 769 B 87 ms 1 alerts

00:37:08.342 GET 200 img 174 B 100 ms 1 alerts

00:37:08.344 GET 200 img 2.1 KB 63 ms 1 alerts

https://vr.znbbmwq.com/inv/Adobe_Installer.html

Domain graph

Hostnames

Connections

Network requests

Transaction #07

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

Display preferences

Go to…

Notifications

Full request body

Full screenshot

>https://vr.znbbmwq.com/inv/Adobe_Installer.html

[Domain graph]

Hostnames

Connections

[Network requests]

Transaction #07

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

https://vr.znbbmwq.com/inv/Adobe_Installer.html

Domain graph

Network requests