{"report_id":"8cd6074a-a3d0-483a-aa6c-510aac4b7027","version":0,"status":"done","tags":["suspicious","telegram_bot"],"date":"2026-08-25T20:47:42Z","url":{"schema":"http","addr":"detsysscanner.xn--q9jyb4c/","fqdn":"detsysscanner.xn--q9jyb4c","domain":"detsysscanner.xn--q9jyb4c","tld":""},"ip":{"addr":"157.230.180.90","port":0,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"detsysscanner.xn--q9jyb4c/","fqdn":"detsysscanner.xn--q9jyb4c","domain":"detsysscanner.xn--q9jyb4c","tld":""},"title":"Microsoft SysScan — Browser \u0026 System Diagnostic Scanner","dom":{"size":25342,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (386)","md5":"e22a07f825a134a0444f99390c9dc8a7","sha1":"5f1bafcdd522468c7161e5311ad778c838a3c2ee","sha256":"2b4f1708c247b3be4ae6b16685cc5b024c7d1dbaa3ad646d6f9c30ecbf8ebac2","sha512":"6c001744bdc38b76126601b841d49f49876f3b0b329240b0998cc2fbb8bebda20e31deb1507e64e51ef46a6db6826c383b1321344e6e8d0ef09d43691285ec43","ssdeep":"384:Br0ohtg/f+kUCklnzuLzWPbaQLxTinX2KzUk:Se6+kLyaLz0a2xTinZr","tlshash":"9ab2f12061f9983780a745c966a26b7e6ef59703c90a1104f7ac4bf54fe3ccade37518","dom_hash":"domhash08d302c271cb6370cdaa731013fd5d30","first_seen":"2026-08-25T20:45:15.098107Z","last_seen":"2026-08-25T20:47:43.975977Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"detsysscanner.xn--q9jyb4c/","fqdn":"detsysscanner.xn--q9jyb4c","domain":"detsysscanner.xn--q9jyb4c","tld":""},"ip":{"addr":"157.230.180.90","port":0,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-29T20:47:42Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-08-25","alert":"Detects file containing Telegram Bot API","trigger":"detsysscanner.xn--q9jyb4c/sysscan-scanner.js","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-25","alert":"Phishing Block","trigger":"detsysscanner.xn--q9jyb4c","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"detsysscanner.xn--q9jyb4c","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"summary":[{"fqdn":"ipapi.co","ip":{"addr":"172.67.69.226","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2016-04-19","domain_rank":7936,"first_seen":"2017-01-31T09:07:01Z","last_seen":"2026-08-20T02:37:52.187777Z","alert_count":0,"request_count":1,"received_data":2547,"sent_data":476,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"detsysscanner.xn--q9jyb4c","ip":{"addr":"157.230.180.90","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-08-25T20:45:10.78878Z","last_seen":"2026-08-25T20:45:10.78878Z","alert_count":10,"request_count":4,"received_data":138298,"sent_data":1955,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"api.fontshare.com","ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"domain_registered":"2003-10-01","domain_rank":604295,"first_seen":"2021-03-02T20:36:57Z","last_seen":"2026-08-23T06:51:27.846639Z","alert_count":0,"request_count":1,"received_data":3084,"sent_data":565,"comment":"","tags":null,"fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":[{"url":{"schema":"https","addr":"detsysscanner.xn--q9jyb4c/sysscan-scanner.js","fqdn":"detsysscanner.xn--q9jyb4c","domain":"detsysscanner.xn--q9jyb4c","tld":""},"ip":{"addr":"157.230.180.90","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"md5":"2e76f7eb93e6b171c07f0c06071f2258","sha1":"3ddb30c73df7fde089769ead3a0e9a2820062642","sha256":"70ec0159ce4a161c6b438161dfd33e763e6f5043c178aa71bd3c66e27a8ba8ea","sha512":"9a02c2854f4ac27176a604b66903b63b6fa35a0be9cf92e1c138231b2024ed0c91f33ff6edf3114b7539d80de98195339c757e5ffcad621cb8b981b52f93d7cc","size":82936,"token":"8915799302:AAF1wzxwbhqX0r3cAYOJEsMlsYee_8_d3uA","is_revoked":false,"bot":{"token":"8915799302:AAF1wzxwbhqX0r3cAYOJEsMlsYee_8_d3uA","user_id":"8915799302","username":"comdpro_bot","first_name":"\u003c\u003cDPRO\u003e\u003e","last_name":"","chat":{"chat_id":"-1004447288952","title":"DPRO","type":"supergroup","bot_is":"administrator","total_users":7,"active_members":null,"admins":[{"user_id":7161369195,"username":"lonewolf1re","first_name":"Lone Wolf","last_name":"","is_bot":false},{"user_id":8356788977,"username":"daniel_webb23","first_name":"Daniel","last_name":"Webb","is_bot":false},{"user_id":8915799302,"username":"comdpro_bot","first_name":"\u003c\u003cDPRO\u003e\u003e","last_name":"","is_bot":true},{"user_id":7137925447,"username":"cmystic1","first_name":"C","last_name":"mystic","is_bot":false}]},"pending_messages":6}}],"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"detsysscanner.xn--q9jyb4c/sysscan-scanner.js","fqdn":"detsysscanner.xn--q9jyb4c","domain":"detsysscanner.xn--q9jyb4c","tld":""},"ip":{"addr":"157.230.180.90","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"2e76f7eb93e6b171c07f0c06071f2258","sha1":"3ddb30c73df7fde089769ead3a0e9a2820062642","sha256":"70ec0159ce4a161c6b438161dfd33e763e6f5043c178aa71bd3c66e27a8ba8ea","sha512":"9a02c2854f4ac27176a604b66903b63b6fa35a0be9cf92e1c138231b2024ed0c91f33ff6edf3114b7539d80de98195339c757e5ffcad621cb8b981b52f93d7cc","ssdeep":"768:/D39eRdU47sVJJjugaxCWmaASn1U9xqQTNv+zbJzX5/4P5iV:/DgRdLGJaFHj+9AUNWD45iV","tlshash":"ed83946a9576293505a360a95f9b61016321910b2e08fc4c3fce831c2f9d66f92f7bed","size":82936,"data":"","first_seen":"2026-08-25T20:45:15.102796Z","last_seen":"2026-08-25T21:38:40.292361Z","times_seen":4,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-08-25","alert":"Detects file containing Telegram Bot API","trigger":"detsysscanner.xn--q9jyb4c/sysscan-scanner.js","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"detsysscanner.xn--q9jyb4c/","fqdn":"detsysscanner.xn--q9jyb4c","domain":"detsysscanner.xn--q9jyb4c","tld":""},"ip":{"addr":"157.230.180.90","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-25T20:47:15.308Z","timestamp":1787690835308,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"detsysscanner.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 09:03:01 GMT","end":"Mon, 09 Nov 2026 09:03:00 GMT"},"fingerprint":{"sha1":"77:B3:71:51:3F:F8:E3:8D:1F:9C:8F:BA:4B:17:DD:D5:E2:FE:01:5D","sha256":"81:FD:49:DB:BD:BA:0E:C9:00:17:B1:D9:91:96:79:AF:30:05:CF:47:13:88:99:E9:7F:8E:71:47:11:EE:FD:51"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: detsysscanner.xn--q9jyb4c\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 20:47:15 GMT\r\ncontent-type: text/html\r\nlast-modified: Tue, 11 Aug 2026 08:31:28 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a7adde0-6297\"\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":25239,"size_decoded":6023,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (346)","md5":"e9e96226a165d9c68a89a7e4f01e23a0","sha1":"36c968d554aabc4e71ee8f92d45dc5072f564a29","sha256":"4da1793dc357a234c5fe1a7a9e5dae31177f198d5274d6cb52e7569ea0fb3c45","sha512":"cca4fc72a004890dae04d969e864cf67c8ecf9872134026fb72f89e0486422906e8e07db94521981a5e1474389a08717bacafa6425ff1b6dff991191a6d9334e","ssdeep":"384:vrBootg/c8k48CkvtipEWtcLPRxTin72fzUy:tXD8kW1pEdL5xTinM5","tlshash":"68b2f02061f8983780a745c967a29b3e6ef59343ca0a1104f7ac4be50fe3ccade37559","first_seen":"2026-08-25T20:45:15.108416Z","last_seen":"2026-08-25T21:38:40.2907Z","times_seen":4,"resource_available":false,"data":null}},"time_used":299,"timings":{"blocked":-1,"dns":3,"connect":97,"send":0,"wait":97,"receive":0,"ssl":101},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-25","alert":"Phishing Block","trigger":"detsysscanner.xn--q9jyb4c","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"detsysscanner.xn--q9jyb4c","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.fontshare.com/v2/css?f[]=satoshi@400,500,700,900\u0026f[]=jetbrains-mono@400,500,700\u0026display=swap","fqdn":"api.fontshare.com","domain":"fontshare.com","tld":"com"},"ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://detsysscanner.xn--q9jyb4c/","date":"2026-08-25T20:47:15.862Z","timestamp":1787690835862,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.fontshare.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 12 Aug 2026 11:02:22 GMT","end":"Tue, 10 Nov 2026 11:02:21 GMT"},"fingerprint":{"sha1":"69:47:B7:C8:96:DB:6E:32:43:04:72:6C:D2:39:29:8F:C3:31:33:36","sha256":"BA:97:33:5D:48:ED:D6:0F:A3:E5:33:7F:13:E8:CB:DC:E1:BE:18:1A:08:1E:1C:D1:BB:45:6E:E2:DD:DA:AF:15"}}},"request":{"raw":"GET /v2/css?f[]=satoshi@400,500,700,900\u0026f[]=jetbrains-mono@400,500,700\u0026display=swap HTTP/1.1\r\nHost: api.fontshare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://detsysscanner.xn--q9jyb4c/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 25 Aug 2026 20:47:15 GMT\r\ncontent-type: text/css; charset=utf-8\r\nvary: Accept-Encoding\r\nserver: BunnyCDN-NO1-830\r\ncdn-pullzone: 6318758\r\ncdn-requestcountrycode: NO\r\naccess-control-allow-headers: content-type, authorization, cookie\r\naccess-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=86400, stale-while-revalidate=604800\r\nx-request-id: GM8QEacVptY7fk0AAwVy\r\ncdn-proxyver: 1.62\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 200\r\ncdn-cachedat: 08/25/2026 13:40:45\r\ncdn-edgestorageid: 830\r\ncdn-requestid: 1bf94b471241e606c17cf0c3998df84e\r\ncdn-cache: HIT\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}],"data":{"size":2340,"size_decoded":1290,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"3d4ac42804672f363857ac55e385c61c","sha1":"9daa3a3de3702e2050354be54b4b2daf9e0468be","sha256":"1c055fbceec7a16d9572093fa0f30a7c962790eab0e939e129f099bab9af6669","sha512":"ed6c585c1f44d19119b3e3e446ac2f1de242f95d856effde417130c4b1dde8bf7c792f8431f99921e3e9388d1794209627e060dd0ed9cfedb76f97e9a0ac69c8","ssdeep":"","tlshash":"a741014239e030c948732c0877db1eec8d4d68131045e47e369ecb2caebae45439ab5c","first_seen":"2024-11-09T08:52:50.208783Z","last_seen":"2026-08-25T21:38:40.291238Z","times_seen":178,"resource_available":false,"data":null}},"time_used":64,"timings":{"blocked":-1,"dns":40,"connect":17,"send":0,"wait":2,"receive":-1,"ssl":5},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"detsysscanner.xn--q9jyb4c/sysscan-styles.css","fqdn":"detsysscanner.xn--q9jyb4c","domain":"detsysscanner.xn--q9jyb4c","tld":""},"ip":{"addr":"157.230.180.90","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://detsysscanner.xn--q9jyb4c/","date":"2026-08-25T20:47:15.863Z","timestamp":1787690835863,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"detsysscanner.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 09:03:01 GMT","end":"Mon, 09 Nov 2026 09:03:00 GMT"},"fingerprint":{"sha1":"77:B3:71:51:3F:F8:E3:8D:1F:9C:8F:BA:4B:17:DD:D5:E2:FE:01:5D","sha256":"81:FD:49:DB:BD:BA:0E:C9:00:17:B1:D9:91:96:79:AF:30:05:CF:47:13:88:99:E9:7F:8E:71:47:11:EE:FD:51"}}},"request":{"raw":"GET /sysscan-styles.css HTTP/1.1\r\nHost: detsysscanner.xn--q9jyb4c\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://detsysscanner.xn--q9jyb4c/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 20:47:15 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 11 Aug 2026 08:31:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a7adde1-6dd4\"\r\nexpires: Wed, 26 Aug 2026 08:47:15 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":28116,"size_decoded":6634,"mime_type":"text/css","magic":"Unicode text, UTF-8 text","md5":"e4f3ec6a5c986b999957e171cf7146a5","sha1":"0b9bbbe545fc341e66950ec1cc87382beae7873c","sha256":"91fd7b43da266a1d3b2fc76fc4e814e598c1601018466118a9b8be7e2c54f543","sha512":"03b60c37ea34990faf0d7484ffa200fd73637a0dd477108c375de7e92ad620ef4f9a6e1556e9398fffeb185ba4b9f4923b720e2bd7380b6c2fdb2e8ef8e8b60d","ssdeep":"384:ioqHpBRtW51SiCBBNIU/zx+yY2EK3nVayKF4XrCypKc:ioqHdtW51SiCbNIULwy4wVaq9","tlshash":"18c26792233452747d27ea7476875b4e735ca102990edabc6fe4100cdec93fa6663b8c","first_seen":"2026-08-25T20:43:57.45646Z","last_seen":"2026-08-25T21:38:40.291797Z","times_seen":17,"resource_available":false,"data":null}},"time_used":98,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":98,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-25","alert":"Phishing Block","trigger":"detsysscanner.xn--q9jyb4c","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"detsysscanner.xn--q9jyb4c","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"detsysscanner.xn--q9jyb4c/sysscan-scanner.js","fqdn":"detsysscanner.xn--q9jyb4c","domain":"detsysscanner.xn--q9jyb4c","tld":""},"ip":{"addr":"157.230.180.90","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://detsysscanner.xn--q9jyb4c/","date":"2026-08-25T20:47:15.864Z","timestamp":1787690835864,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"detsysscanner.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 09:03:01 GMT","end":"Mon, 09 Nov 2026 09:03:00 GMT"},"fingerprint":{"sha1":"77:B3:71:51:3F:F8:E3:8D:1F:9C:8F:BA:4B:17:DD:D5:E2:FE:01:5D","sha256":"81:FD:49:DB:BD:BA:0E:C9:00:17:B1:D9:91:96:79:AF:30:05:CF:47:13:88:99:E9:7F:8E:71:47:11:EE:FD:51"}}},"request":{"raw":"GET /sysscan-scanner.js HTTP/1.1\r\nHost: detsysscanner.xn--q9jyb4c\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://detsysscanner.xn--q9jyb4c/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 20:47:15 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 11 Aug 2026 08:31:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a7adde1-143fa\"\r\nexpires: Wed, 26 Aug 2026 08:47:15 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":82938,"size_decoded":23016,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (315)","md5":"2e76f7eb93e6b171c07f0c06071f2258","sha1":"3ddb30c73df7fde089769ead3a0e9a2820062642","sha256":"70ec0159ce4a161c6b438161dfd33e763e6f5043c178aa71bd3c66e27a8ba8ea","sha512":"9a02c2854f4ac27176a604b66903b63b6fa35a0be9cf92e1c138231b2024ed0c91f33ff6edf3114b7539d80de98195339c757e5ffcad621cb8b981b52f93d7cc","ssdeep":"768:/D39eRdU47sVJJjugaxCWmaASn1U9xqQTNv+zbJzX5/4P5iV:/DgRdLGJaFHj+9AUNWD45iV","tlshash":"ed83946a9576293505a360a95f9b61016321910b2e08fc4c3fce831c2f9d66f92f7bed","first_seen":"2026-08-25T20:45:15.102796Z","last_seen":"2026-08-25T21:38:40.292361Z","times_seen":4,"resource_available":true,"data":null}},"time_used":195,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":195,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-08-25","alert":"Detects file containing Telegram Bot API","trigger":"detsysscanner.xn--q9jyb4c/sysscan-scanner.js","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-25","alert":"Phishing Block","trigger":"detsysscanner.xn--q9jyb4c","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"detsysscanner.xn--q9jyb4c","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]}},{"url":{"schema":"https","addr":"detsysscanner.xn--q9jyb4c/favicon.svg","fqdn":"detsysscanner.xn--q9jyb4c","domain":"detsysscanner.xn--q9jyb4c","tld":""},"ip":{"addr":"157.230.180.90","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://detsysscanner.xn--q9jyb4c/","date":"2026-08-25T20:47:16.078Z","timestamp":1787690836078,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"detsysscanner.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 09:03:01 GMT","end":"Mon, 09 Nov 2026 09:03:00 GMT"},"fingerprint":{"sha1":"77:B3:71:51:3F:F8:E3:8D:1F:9C:8F:BA:4B:17:DD:D5:E2:FE:01:5D","sha256":"81:FD:49:DB:BD:BA:0E:C9:00:17:B1:D9:91:96:79:AF:30:05:CF:47:13:88:99:E9:7F:8E:71:47:11:EE:FD:51"}}},"request":{"raw":"GET /favicon.svg HTTP/1.1\r\nHost: detsysscanner.xn--q9jyb4c\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://detsysscanner.xn--q9jyb4c/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 20:47:16 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 755\r\nlast-modified: Tue, 11 Aug 2026 08:31:27 GMT\r\netag: \"6a7adddf-2f3\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":755,"size_decoded":1027,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"484d76251c2e1278bfe341c96c4d2414","sha1":"badfd8212fc08f78acb3e892454427b554f57dbe","sha256":"f848aaa8c7599928b7910eaecec780051c1777940c7c3e530afa0bf148359bf7","sha512":"2e8ad60f015f8a843581ecabb4ec08c95e30e1d6fcc757d0abe45630450415ced0bb0d8de00903ff8f44cb3a3ead26c79ef5584eaaaadaf51f9b3aa6cd2e308e","ssdeep":"","tlshash":"0a016812e59c811bc304870dd60cb969338fa2d39ba68100b1986b2a1a385e75dde3bc","first_seen":"2026-08-25T20:43:57.447582Z","last_seen":"2026-08-25T21:38:40.290069Z","times_seen":17,"resource_available":false,"data":null}},"time_used":98,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":98,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"detsysscanner.xn--q9jyb4c","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-25","alert":"Phishing Block","trigger":"detsysscanner.xn--q9jyb4c","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ipapi.co/json/","fqdn":"ipapi.co","domain":"ipapi.co","tld":"co"},"ip":{"addr":"172.67.69.226","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://detsysscanner.xn--q9jyb4c/","date":"2026-08-25T20:47:16.080Z","timestamp":1787690836080,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"ipapi.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 13 Aug 2026 09:56:10 GMT","end":"Wed, 11 Nov 2026 10:56:07 GMT"},"fingerprint":{"sha1":"F3:18:40:3B:2F:29:8F:72:5D:C9:F9:8D:83:FF:1A:13:26:F5:A1:7A","sha256":"17:EB:45:1D:BC:F6:67:CB:CB:85:0A:03:6F:55:93:30:F8:33:F4:78:1A:C0:46:17:64:09:C8:78:62:38:02:5D"}}},"request":{"raw":"GET /json/ HTTP/1.1\r\nHost: ipapi.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://detsysscanner.xn--q9jyb4c/\r\nOrigin: https://detsysscanner.xn--q9jyb4c\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 25 Aug 2026 20:47:22 GMT\r\ncontent-type: application/json\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\nallow: OPTIONS, GET, POST, HEAD, OPTIONS\r\nx-frame-options: DENY\r\nvary: Host, origin\r\naccess-control-allow-origin: https://detsysscanner.xn--q9jyb4c\r\nx-content-type-options: nosniff\r\nreferrer-policy: same-origin\r\ncross-origin-opener-policy: same-origin\r\ncontent-security-policy-report-only: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.stripe.com https://*.paddle.com https://www.google.com https://www.gstatic.com https://maps.gstatic.com https://maps.googleapis.com https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/; style-src 'self' 'unsafe-inline' https://*.paddle.com https://fonts.gstatic.com https://fonts.googleapis.com; img-src 'self' data: https://ipapi.co https://maps.gstatic.com https://maps.googleapis.com https://*.stripe.com; font-src 'self' data: https://fonts.gstatic.com https://fonts.googleapis.com; frame-src 'self' https://www.google.com https://*.stripe.com https://*.paddle.com https://www.google.com/recaptcha/ https://recaptcha.google.com/recaptcha/ https://challenges.cloudflare.com/; connect-src 'self' https://ipapi.co/ https://*.paddle.com https://*.stripe.com https://maps.googleapis.com https://www.google.com/recaptcha/; object-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'self';\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ppKVn4lkaFlYzI7eE6stl7cyNmgOa0ifBA5ohI%2BARVc%2B8ORTvggRUV%2FTXs%2BhOaZEWMdvDw85tvxyCYvcQmGKf0pEX4NWM9qs%2FX5%2F7lXQuzPV95%2F26CZQg49X\"}]}\r\ncontent-encoding: br\r\ncf-ray: a30d73957f7156b4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":742,"size_decoded":2158,"mime_type":"application/json","magic":"JSON text data","md5":"c9a83cf7b79bb169afa15370aaa9d642","sha1":"e0fb50e54473bf4468fe35add9fd6f777c8633dc","sha256":"9513f5d1cb329721ac415720ce53669e0e98329f191ef9bacb323dd35b4134c1","sha512":"b937a919074c16e74b79086e2d1037911cd8578d04669f9bb90914c0cf579bf200fee329b8282a3c700eddfe26dbe73407141bd88a949e219f394fdc0d672e41","ssdeep":"","tlshash":"5a01df68e4780f7b9cb813587078691b113422176e563a8e7bd4a74d0f8d8bf30b135e","first_seen":"2026-08-17T05:59:44.876786Z","last_seen":"2026-08-25T22:54:01.928294Z","times_seen":314,"resource_available":false,"data":null}},"time_used":6628,"timings":{"blocked":0,"dns":7,"connect":1,"send":0,"wait":233,"receive":0,"ssl":6386},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}