{"report_id":"b3e29805-082c-4b43-b6f4-71691d525377","version":6,"status":"done","tags":["suspicious","telegram_bot"],"date":"2026-04-03T01:22:04Z","url":{"schema":"http","addr":"roblox.amadscolecy.xyz","fqdn":"roblox.amadscolecy.xyz","domain":"amadscolecy.xyz","tld":"xyz"},"ip":{"addr":"64.29.17.1","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"roblox.amadscolecy.xyz/","fqdn":"roblox.amadscolecy.xyz","domain":"amadscolecy.xyz","tld":"xyz"},"title":"Log in to Roblox","dom":{"size":495126,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (65117)","md5":"5b8d444680ccd684e6b19c9217f81e4f","sha1":"58ce547b6adb916b9a8ce8c73b47b6ec49f3ca87","sha256":"b7a829182400fcdedca80ec140063049d20560eb653b38b7ff6cf220b42ab5fe","sha512":"460d5d88f3a8d88ab1d31548eb5d00d7b9cac0ac19b02dd6c417cec8cac95bb986ce21dd7f331eb8d4722cf1ffff9beda94177e66e67c0501124eefad0bce197","ssdeep":"12288:Whx2EOqb9Ivu8K2Hz3njhokweKlZNchO0ioWPxmnOLk:PDqbP8v7wPakPk","tlshash":"92b401e8bcb3f96d537c5472f56e5c0c36c1cd1fd0c68b9b602326d98ad61e88b22859","dom_hash":"domhashfb3d664fa71af7c2e8b67a77a9547ac8","first_seen":"2026-04-03T01:22:07.558831Z","last_seen":"2026-04-03T01:22:07.558831Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"roblox.amadscolecy.xyz","fqdn":"roblox.amadscolecy.xyz","domain":"amadscolecy.xyz","tld":"xyz"},"ip":{"addr":"64.29.17.1","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-05-08T01:22:04Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-04-03","alert":"Detects file containing Telegram Bot API","trigger":"roblox.amadscolecy.xyz/","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"summary":[{"fqdn":"fonts.gstatic.com","ip":{"addr":"172.217.19.227","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-03-29T22:16:18.281815Z","alert_count":0,"request_count":3,"received_data":103616,"sent_data":1759,"comment":"","tags":null,"fingerprints":null},{"fqdn":"roblox.amadscolecy.xyz","ip":{"addr":"64.29.17.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"2026-04-01","domain_rank":0,"first_seen":"2026-04-03T01:22:04.491286Z","last_seen":"2026-04-03T01:22:04.491286Z","alert_count":2,"request_count":2,"received_data":496048,"sent_data":942,"comment":"","tags":null,"fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.251.38.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-03-29T22:20:07.848058Z","alert_count":0,"request_count":1,"received_data":13082,"sent_data":514,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":[{"url":{"schema":"https","addr":"roblox.amadscolecy.xyz/","fqdn":"roblox.amadscolecy.xyz","domain":"amadscolecy.xyz","tld":"xyz"},"ip":{"addr":"64.29.17.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"md5":"cc6766559b3fde7e44a9a8bb54d8cb03","sha1":"94b03ed57ed92394343d8b7f95c2b8494fbd605d","sha256":"f8b0f5d33654d60e7e5ed00198971ebab9e7c14de3106a6ca46ecf2a64dfd935","sha512":"e313e2a42664b75dd9f531e691d9153e606d8d426fb97164ff3df34f3e3e3a3cb399bc12255b1403dcac60890f397d3df843200e9d034493c7c098e9711e1470","size":1539,"token":"8500256514:AAFhgE5VAiOxYbTD8Lz8v8mHqomG1dZ536k","is_revoked":false,"bot":{"token":"8500256514:AAFhgE5VAiOxYbTD8Lz8v8mHqomG1dZ536k","user_id":"8500256514","username":"mereggbot","first_name":"Igyadameregetbot","last_name":"","chat":{"chat_id":"7195639191","title":"","type":"private","bot_is":"member","total_users":2,"active_members":null,"admins":null},"pending_messages":0}}],"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"roblox.amadscolecy.xyz/","fqdn":"roblox.amadscolecy.xyz","domain":"amadscolecy.xyz","tld":"xyz"},"ip":{"addr":"64.29.17.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"cc6766559b3fde7e44a9a8bb54d8cb03","sha1":"94b03ed57ed92394343d8b7f95c2b8494fbd605d","sha256":"f8b0f5d33654d60e7e5ed00198971ebab9e7c14de3106a6ca46ecf2a64dfd935","sha512":"e313e2a42664b75dd9f531e691d9153e606d8d426fb97164ff3df34f3e3e3a3cb399bc12255b1403dcac60890f397d3df843200e9d034493c7c098e9711e1470","ssdeep":"","tlshash":"dc31107738bb15300f67696b872f93613c1084123e0bec52b5ec02a88fd4e95d877ac8","size":1539,"data":"","first_seen":"2026-04-03T01:22:07.566278Z","last_seen":"2026-04-03T01:22:07.566278Z","times_seen":1,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-04-03","alert":"Detects file containing Telegram Bot API","trigger":"roblox.amadscolecy.xyz/","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"fonts.gstatic.com/s/nunitosans/v19/pe0TMImSLYBIv1o4X1M8ce2xCx3yop4tQpF_MeTm0lfGWVpNn64CL7U8upHZIbMV51Q42ptCp7t1R-tQLL50tE8.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.19.227","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://roblox.amadscolecy.xyz/","date":"2026-04-03T01:21:41.957Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 09 Mar 2026 08:37:39 GMT","end":"Mon, 01 Jun 2026 08:37:38 GMT"},"fingerprint":{"sha1":"31:A8:B5:C1:CD:F5:51:78:A9:8C:E3:B4:73:92:CF:C0:6D:69:48:19","sha256":"81:9A:84:FB:F5:4C:AB:82:DF:C1:27:CC:60:46:A6:23:A8:49:56:99:47:CF:C4:05:3F:0D:87:31:DD:2C:23:A2"}}},"request":{"raw":"GET /s/nunitosans/v19/pe0TMImSLYBIv1o4X1M8ce2xCx3yop4tQpF_MeTm0lfGWVpNn64CL7U8upHZIbMV51Q42ptCp7t1R-tQLL50tE8.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://roblox.amadscolecy.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 30992\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sat, 28 Mar 2026 00:44:15 GMT\r\nexpires: Sun, 28 Mar 2027 00:44:15 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Tue, 16 Sep 2025 13:31:55 GMT\r\ncontent-type: font/woff2\r\nage: 520647\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":30992,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 30992, version 1.0","md5":"7dc7d01533c963a285fd36c5abbb58a2","sha1":"73ee042eb471294fba713f6ab9f91a93fe464583","sha256":"4608fe39fa0f9651ce629e11e99708914f569823ab37bd9d564fccbec7e1a4a4","sha512":"436bd20867d1a283d586d6911e8c6aa40a1a331ee5a54245c72726497346042843de95ef6d562c755f793e3883aabbb81bc41786a24311015592f1eb0a9be1dd","ssdeep":"768:v0hv0VMEt1jVDpK36ZjTSVKGCz8VfDrJkNuIBvkxyw:v0VEvjnKKZSVY8VfDlafE","tlshash":"04d2f1954aef7208f02917fda3ca015a550610eccbdc5aa5bbe2dca885148614e8f6ed","first_seen":"2025-09-17T00:11:12.784576Z","last_seen":"2026-08-19T18:32:25.332663Z","times_seen":21365,"resource_available":false,"data":null}},"time_used":126,"timings":{"blocked":43,"dns":1,"connect":22,"send":0,"wait":17,"receive":3,"ssl":38},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"roblox.amadscolecy.xyz/favicon.ico","fqdn":"roblox.amadscolecy.xyz","domain":"amadscolecy.xyz","tld":"xyz"},"ip":{"addr":"64.29.17.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://roblox.amadscolecy.xyz/","date":"2026-04-03T01:21:42.102Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"roblox.amadscolecy.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 02 Apr 2026 12:59:04 GMT","end":"Wed, 01 Jul 2026 12:59:03 GMT"},"fingerprint":{"sha1":"6E:A0:DD:4E:36:1E:A9:43:3C:DF:D7:03:EA:8E:16:5A:39:5F:AD:93","sha256":"77:51:60:68:9E:00:1A:EE:53:9B:27:C1:11:56:42:D9:AE:BB:B8:95:E7:FB:62:1A:25:47:0C:09:1F:08:57:7D"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: roblox.amadscolecy.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://roblox.amadscolecy.xyz/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-type: text/plain; charset=utf-8\r\ndate: Fri, 03 Apr 2026 01:21:42 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-error: NOT_FOUND\r\nx-vercel-id: arn1::flnq6-1775179302102-6cdfd1d74369\r\ncontent-length: 79\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":79,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"c080499f5ae4ef9205b427b50255f828","sha1":"f37fa6b0281535b703b265d6505409325c66dcf0","sha256":"ffb3547f5906a4b5d1dae3d66e9268b36cae2c49d7bde3921a92d083fdae7e7f","sha512":"c5dd8440227652e2e2cdfdb081920e59359c4d92dadf140e4a5297d7b0b5524e16abd0cc7ad18215e33956c94da8beec6a73f0749d71c59fbb1e0f1a2d1b920e","ssdeep":"","tlshash":"7ea0121d01800e8833c805242085d139181882659a66910060c85101e20058d9340095","first_seen":"2026-04-03T01:22:07.562479Z","last_seen":"2026-04-03T01:22:07.562479Z","times_seen":1,"resource_available":false,"data":null}},"time_used":176,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":176,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"roblox.amadscolecy.xyz/","fqdn":"roblox.amadscolecy.xyz","domain":"amadscolecy.xyz","tld":"xyz"},"ip":{"addr":"64.29.17.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-04-03T01:21:41.450Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"roblox.amadscolecy.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 02 Apr 2026 12:59:04 GMT","end":"Wed, 01 Jul 2026 12:59:03 GMT"},"fingerprint":{"sha1":"6E:A0:DD:4E:36:1E:A9:43:3C:DF:D7:03:EA:8E:16:5A:39:5F:AD:93","sha256":"77:51:60:68:9E:00:1A:EE:53:9B:27:C1:11:56:42:D9:AE:BB:B8:95:E7:FB:62:1A:25:47:0C:09:1F:08:57:7D"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: roblox.amadscolecy.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-origin: *\r\nage: 281\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline\r\ncontent-encoding: br\r\ncontent-type: text/html; charset=utf-8\r\ndate: Fri, 03 Apr 2026 01:21:41 GMT\r\netag: W/\"dde587f3b24bbf557180c4575da7341b\"\r\nlast-modified: Fri, 03 Apr 2026 01:16:59 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::9wrmz-1775179301577-72e0403776c4\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":495152,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (65108)","md5":"dde587f3b24bbf557180c4575da7341b","sha1":"3335ce19f43b207a0f76eada07a6818c2688356b","sha256":"4f6c314f4d21bfc9e24304cdaf93f9168ed6e8e0c75552a7b3ec6fd0422aa78d","sha512":"853e41568fa15ed07dea663cf235ed9e68fe680cae799ad28ca5c302e68d2cf9cf91e3577038cc9f2cc9cb09a68020caa0600a049047c7dc22a2c9d11511840c","ssdeep":"12288:8hx2EOqb9Ivu8K2Hz3njhokweKlZNchO0ioWPxmnOLK:VDqbP8v7wPakPK","tlshash":"f2b401e8bcb3f96d137c5472f56e5c0c36c1cd1fd0c68b9b602726d98ad61e88b22859","first_seen":"2026-04-03T01:22:07.563635Z","last_seen":"2026-04-03T01:22:07.563635Z","times_seen":1,"resource_available":false,"data":null}},"time_used":263,"timings":{"blocked":124,"dns":98,"connect":1,"send":0,"wait":11,"receive":0,"ssl":25},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-04-03","alert":"Detects file containing Telegram Bot API","trigger":"roblox.amadscolecy.xyz/","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Nunito:wght@700;800;900\u0026family=Nunito+Sans:wght@400;500;600\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.251.38.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://roblox.amadscolecy.xyz/","date":"2026-04-03T01:21:41.781Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 09 Mar 2026 08:37:40 GMT","end":"Mon, 01 Jun 2026 08:37:39 GMT"},"fingerprint":{"sha1":"5F:99:6E:26:2A:3A:DA:FF:7F:0D:EE:C5:8B:2A:01:AE:28:26:AD:C4","sha256":"2B:88:E7:79:70:E5:E9:DE:0E:A9:0A:B8:F1:F5:C6:D6:10:77:F0:C9:0F:E6:2A:13:A3:D6:08:F9:89:A3:60:E8"}}},"request":{"raw":"GET /css2?family=Nunito:wght@700;800;900\u0026family=Nunito+Sans:wght@400;500;600\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://roblox.amadscolecy.xyz/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Fri, 03 Apr 2026 01:21:41 GMT\r\ndate: Fri, 03 Apr 2026 01:21:41 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":12396,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"cac6ecf2597af8e147ca559443399ef6","sha1":"716139cb18defb92af220137ce3087bd3524c2e0","sha256":"481257683b202221d326fa9e9be26fb50051e869e40225f5c278c731b5df4672","sha512":"71a1acb40438e212a0ab69cad9401cf5c860544777a81346887129dd7adb88bd564a7f255bd1b445cd2dd31a18624703764b4540cb1bca705ec29c2ce59d3636","ssdeep":"192:rHbywkkdiHyy1RkoRHhyWikvTvc3DvcK2vcCvct1vcvavc3UvcKdvc5vctOvcvL3:je9hjcr3AKNJkvx3PK+qDv43aKjfevF","tlshash":"e142ed90042ad440ea036cc237cfbf36ae4ea1513425c47daffc9898dcabc665325b4e","first_seen":"2026-04-03T01:22:07.564593Z","last_seen":"2026-04-03T01:22:07.564593Z","times_seen":1,"resource_available":false,"data":null}},"time_used":140,"timings":{"blocked":59,"dns":1,"connect":7,"send":0,"wait":20,"receive":0,"ssl":49},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/nunito/v32/XRXV3I6Li01BKofINeaB.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.19.227","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://roblox.amadscolecy.xyz/","date":"2026-04-03T01:21:41.926Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 09 Mar 2026 08:37:39 GMT","end":"Mon, 01 Jun 2026 08:37:38 GMT"},"fingerprint":{"sha1":"31:A8:B5:C1:CD:F5:51:78:A9:8C:E3:B4:73:92:CF:C0:6D:69:48:19","sha256":"81:9A:84:FB:F5:4C:AB:82:DF:C1:27:CC:60:46:A6:23:A8:49:56:99:47:CF:C4:05:3F:0D:87:31:DD:2C:23:A2"}}},"request":{"raw":"GET /s/nunito/v32/XRXV3I6Li01BKofINeaB.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://roblox.amadscolecy.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 39128\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 02 Apr 2026 08:16:42 GMT\r\nexpires: Fri, 02 Apr 2027 08:16:42 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Mon, 15 Sep 2025 17:03:34 GMT\r\ncontent-type: font/woff2\r\nage: 61500\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":39128,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 39128, version 1.0","md5":"166202cc391c71a57730bed12cbcb159","sha1":"76388dbfe374be06fdc6f9ba38d3f4e479025eeb","sha256":"ba344451eab25b217a165363b1982048a5e5830a0daf36577973955a04cac793","sha512":"9f4d1c14aa729e837b964898a1dd27e99ff674256c43326aa982cc0c17fa8b0d71a0b7df627f03cb4ac6ec7f22f0a19d65302743ff09187ce81414dde74c43e2","ssdeep":"768:lxbc6Qon+A9wOfdj2rELqjOmaLqLqKeI+00t0xIj:layndm0j2cqjOmGq+tbUIj","tlshash":"d9030284fd6a02d8c7fc1f6ef25a9f28272c2078440b6a9c44a79a6bd5975f84dd3330","first_seen":"2025-09-17T01:48:11.920934Z","last_seen":"2026-08-20T01:21:52.214202Z","times_seen":47901,"resource_available":false,"data":null}},"time_used":159,"timings":{"blocked":70,"dns":0,"connect":7,"send":0,"wait":9,"receive":9,"ssl":61},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/nunitosans/v19/pe0TMImSLYBIv1o4X1M8ce2xCx3yop4tQpF_MeTm0lfGWVpNn64CL7U8upHZIbMV51Q42ptCp7t1R-tQLL50tE8.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.19.227","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://roblox.amadscolecy.xyz/","date":"2026-04-03T01:21:41.938Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 09 Mar 2026 08:37:39 GMT","end":"Mon, 01 Jun 2026 08:37:38 GMT"},"fingerprint":{"sha1":"31:A8:B5:C1:CD:F5:51:78:A9:8C:E3:B4:73:92:CF:C0:6D:69:48:19","sha256":"81:9A:84:FB:F5:4C:AB:82:DF:C1:27:CC:60:46:A6:23:A8:49:56:99:47:CF:C4:05:3F:0D:87:31:DD:2C:23:A2"}}},"request":{"raw":"GET /s/nunitosans/v19/pe0TMImSLYBIv1o4X1M8ce2xCx3yop4tQpF_MeTm0lfGWVpNn64CL7U8upHZIbMV51Q42ptCp7t1R-tQLL50tE8.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://roblox.amadscolecy.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 30992\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sat, 28 Mar 2026 00:44:15 GMT\r\nexpires: Sun, 28 Mar 2027 00:44:15 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Tue, 16 Sep 2025 13:31:55 GMT\r\ncontent-type: font/woff2\r\nage: 520647\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":30992,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 30992, version 1.0","md5":"7dc7d01533c963a285fd36c5abbb58a2","sha1":"73ee042eb471294fba713f6ab9f91a93fe464583","sha256":"4608fe39fa0f9651ce629e11e99708914f569823ab37bd9d564fccbec7e1a4a4","sha512":"436bd20867d1a283d586d6911e8c6aa40a1a331ee5a54245c72726497346042843de95ef6d562c755f793e3883aabbb81bc41786a24311015592f1eb0a9be1dd","ssdeep":"768:v0hv0VMEt1jVDpK36ZjTSVKGCz8VfDrJkNuIBvkxyw:v0VEvjnKKZSVY8VfDlafE","tlshash":"04d2f1954aef7208f02917fda3ca015a550610eccbdc5aa5bbe2dca885148614e8f6ed","first_seen":"2025-09-17T00:11:12.784576Z","last_seen":"2026-08-19T18:32:25.332663Z","times_seen":21365,"resource_available":false,"data":null}},"time_used":144,"timings":{"blocked":62,"dns":1,"connect":21,"send":0,"wait":14,"receive":3,"ssl":40},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}