{"report_id":"b9047891-9bf5-4502-8fec-b52d0cd392c4","version":0,"status":"done","tags":[],"date":"2026-09-05T02:18:49Z","url":{"schema":"https","addr":"telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":0,"asn":0,"as":"","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812?swfix=1","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"title":"Telegram","dom":{"size":30317,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (4694)","md5":"c8e77b790dc4be8f42689415d5e22102","sha1":"6984abc4622fd58396c7ce50565e94e7fd011b1f","sha256":"6441b9e46ed7d53fe2a9df50162dd593a8964548c7eaa1e116d4b4c42f5d94ba","sha512":"5f44961f8ce3bb4bd689792e2a3aea5ab29481e566c5d17aac8f851355f367e005ef1800200998ce253387276d6475b05407d1162807aa146eea161ba1b04e8a","ssdeep":"384:R/M2Y3YrJ9232Wjyg3h+aak1rSvf7u//EGZn5iiL5BfVFB83:9Ci92mWj73hAgrS37g/Ek5rdBtFB83","tlshash":"a0d21b7151f4049a6103f2ceed84aa1e2f86a0bfdf554716b3dc2db67be3c91c42a548","dom_hash":"domhasha2acea12c26b21d2d15a2ed62a979377","first_seen":"2026-09-05T02:18:59.513667Z","last_seen":"2026-09-05T02:18:59.513667Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":0,"asn":0,"as":"","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-10T02:18:49Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":8}},"detection":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-09-05","alert":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","trigger":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/bc07wufawyw8.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"@imp0rtp3 (modified by Florian Roth)","date":"2020-09-06","description":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","reference":"https://imp0rtp3.wordpress.com/2021/08/12/tetris","rule":"apt_CN_Tetris_JS_advanced_1"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-09-05","alert":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","trigger":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/pjuylvc7wvrs.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"@imp0rtp3 (modified by Florian Roth)","date":"2020-09-06","description":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","reference":"https://imp0rtp3.wordpress.com/2021/08/12/tetris","rule":"apt_CN_Tetris_JS_advanced_1"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-09-05","alert":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","trigger":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/gcfn9ezg0p5w.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"@imp0rtp3 (modified by Florian Roth)","date":"2020-09-06","description":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","reference":"https://imp0rtp3.wordpress.com/2021/08/12/tetris","rule":"apt_CN_Tetris_JS_advanced_1"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-09-05","alert":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","trigger":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/fotrem5ns4qc.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"@imp0rtp3 (modified by Florian Roth)","date":"2020-09-06","description":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","reference":"https://imp0rtp3.wordpress.com/2021/08/12/tetris","rule":"apt_CN_Tetris_JS_advanced_1"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-09-05","alert":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","trigger":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/ibyw3cqxgxog.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"@imp0rtp3 (modified by Florian Roth)","date":"2020-09-06","description":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","reference":"https://imp0rtp3.wordpress.com/2021/08/12/tetris","rule":"apt_CN_Tetris_JS_advanced_1"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-09-05","alert":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","trigger":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/kompuwfks7is.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"@imp0rtp3 (modified by Florian Roth)","date":"2020-09-06","description":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","reference":"https://imp0rtp3.wordpress.com/2021/08/12/tetris","rule":"apt_CN_Tetris_JS_advanced_1"}},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"telegram-premiuma.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"telegram-premiuma.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"cdn.jsdelivr.net","ip":{"addr":"151.101.129.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2012-05-16","domain_rank":1678,"first_seen":"2012-09-30T00:15:09Z","last_seen":"2026-08-30T23:14:54.105192Z","alert_count":0,"request_count":3,"received_data":12143,"sent_data":1641,"comment":"","tags":null,"fingerprints":null},{"fqdn":"static.tildacdn.com","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2015-07-28","domain_rank":335217,"first_seen":"2017-01-30T11:49:16Z","last_seen":"2026-09-01T00:34:19.879294Z","alert_count":0,"request_count":3,"received_data":5170,"sent_data":1650,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"telegram-premiuma.com","ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"domain_registered":"2026-08-19","domain_rank":0,"first_seen":"2026-09-05T02:18:53.99798Z","last_seen":"2026-09-05T02:18:53.99798Z","alert_count":79,"request_count":35,"received_data":7428097,"sent_data":22439,"comment":"","tags":null,"fingerprints":[{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"14f9aecad86a0ea744c11cc8eeb77404","sha1":"9a7c7e82b0ce8d91ff49d783a4a1a59b88506611","sha256":"4558ad841c5646fc98f2b54e12332644053dca7539eb5ff9f178828f8beb07af","sha512":"9e34ae5aa4b96e4cd1f4ff4f0e4867cc783844c6eb88d1f70e141df27afb77e78ccdc644746969222389a7b74056bde85bf59ec3fce0dcc62e111abf8cb4836b","ssdeep":"","tlshash":"246141c432e3652f2143926fda4a884d5295802fa57c7e24777c26901fad53fa6b38fc","size":3457,"data":"","first_seen":"2026-09-05T02:18:59.562342Z","last_seen":"2026-09-05T02:18:59.562342Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"350fd6ef6446635f7a8f608434a405ec","sha1":"a4b6c275ac2c80ec925b5c0c5c6abb79ba897356","sha256":"d21021784cda31eeae5c8295e047a14bda6ed5a9b5963fca9e7ceb398a9c9179","sha512":"c80ee0076d4ed85badaca8443b52e2c2820bcaf7dcb87a92888de21fa312441d7723db2de5538396ae706099b859fccec8a7c246d24b39fc6538c4bcd7d2ce29","ssdeep":"","tlshash":"c53000000000000000030000000000000c000000030000000000000000000000000000","size":4,"data":"","first_seen":"2023-03-07T01:03:00Z","last_seen":"2026-09-05T02:18:59.56402Z","times_seen":1275,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/bc07wufawyw8.js","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"27b2ca5a9941d15593a63f05719ffa5e","sha1":"4e0658a78b1f78348e73993a83f6ad48d8ea5d33","sha256":"51f01379996b752011e1531940af2a0d7d46235ed402294c67d0432991c4db73","sha512":"c5d0439c5f3afe72130f2ff6eb26104ced399fba69f24bc649e9ddbb24fad8b2fee173ae9bf6674fe165412e1f1824669f8589dbc9f83a699c8c1e6b8f8ce7bc","ssdeep":"768:5hVs9UGPsB8pRlA8wjToIv+bMsNMaCCJeeLufdiCqfEeHm/KHIRKYDjvHR0FrVmc:X9Ga8pRlA8AToIvwf6HECcrmJlgQTXc","tlshash":"39635063b7c01a361a4b9fb7b31bb9e0ce2539297525089bd1047fb4ad49532dae0f31","size":67969,"data":"","first_seen":"2026-09-04T07:11:34.797113Z","last_seen":"2026-09-05T02:18:59.518975Z","times_seen":2,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-09-05","alert":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","trigger":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/bc07wufawyw8.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"@imp0rtp3 (modified by Florian Roth)","date":"2020-09-06","description":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","reference":"https://imp0rtp3.wordpress.com/2021/08/12/tetris","rule":"apt_CN_Tetris_JS_advanced_1"}}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/pjuylvc7wvrs.js","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"importedModule","is_inline":false,"md5":"12dc7983df5179102beb36ce55c658f4","sha1":"8883a4b8e34a3c0580e7ffefa2e723028f301312","sha256":"a161166c16b7009e4d9a50ad5a12732a4079f0cff1b2df49fc976428db249a6e","sha512":"b3ea53bf62d0b123f508417fdbdb3633a9e8830043fcfed21303aa9a29cfde623fdd904f1eb36f683827d13de922ba28b200e736e8e87483c6e26ae9b7b5d2df","ssdeep":"768:6jEliYPtm20fow/VwnPmtT4aG/tL6W0PjTUwtheroqaUR11pqmmtJ19MNZTGnmhl:6/JZ1u7dTzY+5R","tlshash":"9fa37f25f7c050d86ab7ee53ab13fe60e079ac9d36a040dcd945ab386c63336157ac72","size":101395,"data":"","first_seen":"2026-09-04T07:11:34.768523Z","last_seen":"2026-09-05T02:18:59.534849Z","times_seen":2,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-09-05","alert":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","trigger":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/pjuylvc7wvrs.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"@imp0rtp3 (modified by Florian Roth)","date":"2020-09-06","description":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","reference":"https://imp0rtp3.wordpress.com/2021/08/12/tetris","rule":"apt_CN_Tetris_JS_advanced_1"}}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812?swfix=1","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"e793380eeb4d9dd56d840e6fa423581a","sha1":"13d637218c6071c38f01c20bca809ec83d62f87a","sha256":"ea60025c5aa7523439c315174f9689e949a1d0022978b7181d77d5191e5db004","sha512":"3da72c500ca4fc9165f4437a48572fe552b8a5be40b3b91ae546751372de04b71807b9fa5ee53f597be932a8e58a0fdc6995d4cd5d097c9f2bce106e4dc90ccf","ssdeep":"96:yhSYK+OpITS/Yu/MNv3+AG/ueK/2roUGe2GDY6P1/6/:yhSYK+eIu9M39G5K/2rF32GxP1y/","tlshash":"81c14497335010486e216bc31bda40899a57a501a76859bcf3ccae517fddb8b50fcbdc","size":5860,"data":"","first_seen":"2026-09-05T02:18:59.564568Z","last_seen":"2026-09-05T02:18:59.564568Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812?swfix=1","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"350fd6ef6446635f7a8f608434a405ec","sha1":"a4b6c275ac2c80ec925b5c0c5c6abb79ba897356","sha256":"d21021784cda31eeae5c8295e047a14bda6ed5a9b5963fca9e7ceb398a9c9179","sha512":"c80ee0076d4ed85badaca8443b52e2c2820bcaf7dcb87a92888de21fa312441d7723db2de5538396ae706099b859fccec8a7c246d24b39fc6538c4bcd7d2ce29","ssdeep":"","tlshash":"c53000000000000000030000000000000c000000030000000000000000000000000000","size":4,"data":"","first_seen":"2023-03-07T01:03:00Z","last_seen":"2026-09-05T02:18:59.56402Z","times_seen":1275,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/xgyhts3s0118.js","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"57aee72c35b72ff479df47293c9e72b8","sha1":"6f2c2d50eed20dd025ec409f7f405c7f3295825d","sha256":"3ba9659bb13af0bd9ef80aa0dde6b13f1c7d2cd9e19fbd16f29fea978211cefd","sha512":"88f169fcd8c598e4faa1a663d6527ba6ed3d31b5daa5b2031a99911b7f597f07836aeaa71061f69e77b02a9dfd52060d88b1900b08b6124edc153ae0a05fa47e","ssdeep":"768:/dJC913uEGN7utz57CYRJR0ErBXZjBipgkQmUSgegjYWIs4BkRHqNKg:r5mJCIRhreW6s4qHM","tlshash":"ccc28440f3804496a7078fb7b71ab9d4d51aa85d7341498be6187f78fd8a622caf1f30","size":26267,"data":"","first_seen":"2026-09-05T02:18:59.560583Z","last_seen":"2026-09-05T02:18:59.560583Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/n3cq8sp3tq48.js","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"317c23c3acb9a6e84f145e0d7b397ad8","sha1":"16ab52f0e7551f2452c37bd14d56654ae39bf53e","sha256":"faa09bb4a35682602df3dc483d23e9a51e0defce10117f8fcbe61615a616f5fe","sha512":"0486ac475c8acf60fadd2567d03fadb0eb94d234734b50ee673fb2cd814a0ce58100e7dd256b78e721a2e68d8e85c6556d8a90f55854ee78e4c35439b162a21e","ssdeep":"","tlshash":"03512504abc05a915317bfeb3a1eb8e0ed167caa3b454586f2557ef8fc54811c5a0f30","size":3017,"data":"","first_seen":"2026-09-05T02:18:59.546667Z","last_seen":"2026-09-05T02:18:59.546667Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/gcfn9ezg0p5w.js","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"importedModule","is_inline":false,"md5":"d6c58b435330f4c0b4a2fcd2eb71614a","sha1":"7575b51e86d6f2fcafcea82bff3a315b134c6747","sha256":"15c066aea06141c08ec9a032a18f2ef184a8a0bb2da2466fd06725c522ab0ba2","sha512":"72ea15c93a096cd08be7f5725898b22cd408f3f3c79dc8fb6b958ec88283bd434c32f1d781d244d1fb23517d59003915a9205c538b8400ff13ac5b999e3d2d55","ssdeep":"3072:aji8xU8aOHOeZWspykj42KANbOEJa5mp7488iSh0xekpy4zAwtQpLpCweZ4r2mzF:QAiHBl4hv7BnOfR3ZiMAMwB02","tlshash":"9fd48b49c788450a30b39b325902fde4da89ae14b56ca75df98cbf365f42211a3fbc71","size":630962,"data":"","first_seen":"2026-09-04T07:11:34.779527Z","last_seen":"2026-09-05T02:18:59.540483Z","times_seen":2,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-09-05","alert":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","trigger":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/gcfn9ezg0p5w.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"@imp0rtp3 (modified by Florian Roth)","date":"2020-09-06","description":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","reference":"https://imp0rtp3.wordpress.com/2021/08/12/tetris","rule":"apt_CN_Tetris_JS_advanced_1"}}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/fotrem5ns4qc.js","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"7081753ce4592c832eacfd7b1b9d1da0","sha1":"74921682fd1d455412c2a20d06b0060662804cf8","sha256":"3ebb69453ef627017649001c1532dfd9a3e393030217bd0f65c72758c46f05b0","sha512":"c2725ebd443cca8100a64084f32d1efd17f0ccdb39a432d62863cba2a194d55a12ff036c2d468f66b0d1e747e6276cd029685f5ad2635bfd365d0e3a99b0fadb","ssdeep":"768:jv2cLvd5S+pMpsJfXp/p+XQXdJIySw+vJ8Q1y3b0gaUXeTMjYE2zk1l04UJuxaGa:TpPS87RQ80gaUXeTMjYE2zal04wuxaGa","tlshash":"41f26411ab800a2133978fb7771bb4f4ea05692a754109afe0147fb4ef59533e6e1e31","size":36124,"data":"","first_seen":"2026-09-05T02:18:59.531787Z","last_seen":"2026-09-05T02:18:59.531787Z","times_seen":1,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-09-05","alert":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","trigger":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/fotrem5ns4qc.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"@imp0rtp3 (modified by Florian Roth)","date":"2020-09-06","description":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","reference":"https://imp0rtp3.wordpress.com/2021/08/12/tetris","rule":"apt_CN_Tetris_JS_advanced_1"}}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/jakzao5z71vc.js","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"importedModule","is_inline":false,"md5":"ea8c83fd7de7f0707e18efb5a4584ed9","sha1":"7d5875279ac30dbbb6637682073c2376afcb1e24","sha256":"49c21269c061921023068b5d3bbf833a0a33bced50ae72dd0e6ce1bb35226b0b","sha512":"c2c7b9f75789585f7be98bba6292e62a35d5e840a372c30a7aa81618d33ec0e8120c1cd7c78c23224ff2a42f60baaf6810463038a1f1e0cd31aa7bbc09eda3a8","ssdeep":"96:H2XgTdkSnfP6AoFdzUe33QNhqVtA5H/4BQeT6iwdLswJ:WXASSnfToFtUagNUVe5fG9wRJ","tlshash":"6bf132488f8a465d3123ff33f517f560d6b509057642e449e84bbf34ac2a73899bacb4","size":7843,"data":"","first_seen":"2026-09-04T07:11:34.82782Z","last_seen":"2026-09-05T02:18:59.530161Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/ibyw3cqxgxog.js","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"bba270f5fac7c55a39d17fc9b7d3aec4","sha1":"70d2896fb4bfa2427828a9efeb80051ef34169cc","sha256":"c3c8d557e7981d42b3fe4c4b36eb96e3a1933b91a9a034cdf2ff56c71963ea44","sha512":"452e0750c30ae60c032bbe768c6cb999509ed802373788f6019506d2404d4c1edc12f6956000db7ee754e9607aab04355a894ebc85cbff551677f31df67fbce7","ssdeep":"6144:6sgUA8UiUXEVYLq6XE5qK3U9JZilO7resFG0FcfFDYo:6sgUp2LnAcZdhGwo","tlshash":"c974938263c05849565bdfbb3b2bb5e0e5152e5e7b80085ff2007eb4ede4522aad4f31","size":368835,"data":"","first_seen":"2026-09-05T02:18:59.543551Z","last_seen":"2026-09-05T02:18:59.543551Z","times_seen":1,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-09-05","alert":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","trigger":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/ibyw3cqxgxog.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"@imp0rtp3 (modified by Florian Roth)","date":"2020-09-06","description":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","reference":"https://imp0rtp3.wordpress.com/2021/08/12/tetris","rule":"apt_CN_Tetris_JS_advanced_1"}}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/747biwsusmw5.js","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"c675d0a749090677fe7d66906720381d","sha1":"4b774730937ca3832db1fd0fa63fd2274d79597b","sha256":"3b1a6d99e274b7ea5f9f62387ca809d0d2a26c1b5e1c80dc15bd7603a68e962f","sha512":"b5d742fd99c59229d569e362f272b8d12e0db4077a493872cf0a43d4fc73cca1c647bd44f8c6f97231e179b7ad8e692c93bcb5b729cf378d3cc07b260f7745bc","ssdeep":"49152:7qJg8HlCjGVzPCdliM2GL5NeRXgOQJaGrXbXBeoagZ5xJl4RFTD/Qtoh:Tu","tlshash":"b4755022a7c01c613207df777726b5e1f61519693b4c085be5083fb8ee89236b9e4db2","size":1702297,"data":"","first_seen":"2026-09-04T07:11:34.841623Z","last_seen":"2026-09-05T02:18:59.566251Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"Function","is_inline":false,"md5":"0a41a06209e7a611ecd12759a7a4ae51","sha1":"b152f7cbc6022044232ca82422b918ddb61ed6e3","sha256":"601575bd2c450acd6f4ca1552f24e241f691b219a1e851609430f0df979c533d","sha512":"35f408283aa2f9fc72362ffc41c31e33fced3765c16591a662dafdbd1a3e06f55b9236222dc63260775b114c4c9c1833352ea81b673519b38522559fe07193a4","ssdeep":"","tlshash":"b29004d530c35101475313fd14573cc4d03444707c5c4d415041f4513cdd13c53554dd","size":45,"data":"","first_seen":"2025-02-21T20:51:48.743936Z","last_seen":"2026-09-05T02:18:59.567326Z","times_seen":97,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/kpeoip5hxvx5.js","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"b4607642067a984ccb3a3f438fbf86c7","sha1":"6b29c1527d763a8417bbf4e6809bb1a71bb494f9","sha256":"b62e6aa9f407c31101fe6f886188427fcb213c2c84512bbefbcbf0bfbd6eedf6","sha512":"01265341f7486d92250b9d4da49b65d3b79bc062cb72e23fd66249797454958668bb321851a6574b0c7c3cc3d4579f09f8145cb314123a10ec7e6f6ca0824b6a","ssdeep":"384:8I2YsAa0BR+RHp5AYZaAToW3Vw4Hm6KN4s2vK3kIJk:86sA9IHnAYZ/ToW3Vw4Hm6KN4s2wkIJk","tlshash":"5372cf62f340aa251317dfde323e74f5c62e75d4b5041c8be118aeb86ec9325da80e78","size":16277,"data":"","first_seen":"2026-09-04T07:11:34.829417Z","last_seen":"2026-09-05T02:18:59.548673Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/assets/img/ba849c05.svg","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812?swfix=1","date":"2026-09-05T02:18:18.975Z","timestamp":1788574698975,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegram-premiuma.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 20 Aug 2026 13:03:55 GMT","end":"Wed, 18 Nov 2026 13:03:54 GMT"},"fingerprint":{"sha1":"B2:17:4B:E9:D3:06:9F:8E:37:18:3D:02:E4:A3:BC:87:68:22:07:A5","sha256":"D2:AD:1D:5B:0A:8B:60:55:6F:18:10:D4:BA:B8:C0:3E:8F:6A:55:62:4A:F9:CE:6E:47:D8:F5:F5:9B:CD:28:A1"}}},"request":{"raw":"GET /bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/assets/img/ba849c05.svg HTTP/1.1\r\nHost: telegram-premiuma.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812?swfix=1\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=973d74b6e7628daa52211632267b00ba\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: private, max-age=3600, must-revalidate\r\ncontent-encoding: gzip\r\ncontent-type: image/svg+xml\r\ndate: Sat, 05 Sep 2026 02:18:19 GMT\r\nvary: Accept-Encoding\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":1129,"size_decoded":905,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"bc208e78b5c74f31c5af2adaa9d28fba","sha1":"12fd9b9021ceb6d0ed6b2aaae7edf38469c9e906","sha256":"3d3b072ee25684a0d6f68751cdb1f7cf9b89336da8954e6c04bb826df6399325","sha512":"a92828a028ca62ee601cddda2a0413633a01ae3e9c1eb767097e26a0c6b09206fc623e5fd9e38c28c3448eebd6f3e677e01f9a9464cae79f7da17046ee995042","ssdeep":"","tlshash":"3c21e11a4341877eb9614214a394548273f0dcc790e4ead88a6b3567e49c4e8625c3f5","first_seen":"2026-09-05T02:18:59.514892Z","last_seen":"2026-09-05T02:18:59.514892Z","times_seen":1,"resource_available":false,"data":null}},"time_used":121,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":121,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"telegram-premiuma.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"telegram-premiuma.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812?swfix=1","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-05T02:18:15.784Z","timestamp":1788574695784,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegram-premiuma.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 20 Aug 2026 13:03:55 GMT","end":"Wed, 18 Nov 2026 13:03:54 GMT"},"fingerprint":{"sha1":"B2:17:4B:E9:D3:06:9F:8E:37:18:3D:02:E4:A3:BC:87:68:22:07:A5","sha256":"D2:AD:1D:5B:0A:8B:60:55:6F:18:10:D4:BA:B8:C0:3E:8F:6A:55:62:4A:F9:CE:6E:47:D8:F5:F5:9B:CD:28:A1"}}},"request":{"raw":"GET /976cb069dbe6ab0729efa766e63c0812?swfix=1 HTTP/1.1\r\nHost: telegram-premiuma.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812\r\nCookie: PHPSESSID=973d74b6e7628daa52211632267b00ba\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: no-store, no-cache, must-revalidate\r\ncontent-encoding: gzip\r\ncontent-type: text/html; charset=UTF-8\r\ndate: Sat, 05 Sep 2026 02:18:15 GMT\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\npragma: no-cache\r\nvary: Accept-Encoding\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":24939,"size_decoded":9667,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (4694)","md5":"354587e8e170c8551a9cdb21ee842f4a","sha1":"54951f6cf0285820f9619dc30425c0eb79e3d312","sha256":"692317d25331a26ffd8e46071e2f02c7a89aba58805c6135874402bf58689010","sha512":"72fb84e307505e5102c9bb374ef8f9fc41d7beebb457678422a8607ecf70c611cdd2bcffcc3e7856ba01382978f4082a087cfd3518464f8217a4074d74ebb70d","ssdeep":"384:92Y3YrJ9F32Wjyg3h+aak1rSvf7u//EGZn5iiL5S2:Ti9FmWj73hAgrS37g/Ek5rdS2","tlshash":"abb20bb151f40089a103f2cade496a1e1e87e0bfaf96432573dc6da67ff3c95c41a948","first_seen":"2026-09-05T02:18:59.515906Z","last_seen":"2026-09-05T02:18:59.515906Z","times_seen":1,"resource_available":false,"data":null}},"time_used":124,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":124,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"telegram-premiuma.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"telegram-premiuma.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/if2otukoi3s9.css","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812","date":"2026-09-05T02:18:15.263Z","timestamp":1788574695263,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegram-premiuma.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 20 Aug 2026 13:03:55 GMT","end":"Wed, 18 Nov 2026 13:03:54 GMT"},"fingerprint":{"sha1":"B2:17:4B:E9:D3:06:9F:8E:37:18:3D:02:E4:A3:BC:87:68:22:07:A5","sha256":"D2:AD:1D:5B:0A:8B:60:55:6F:18:10:D4:BA:B8:C0:3E:8F:6A:55:62:4A:F9:CE:6E:47:D8:F5:F5:9B:CD:28:A1"}}},"request":{"raw":"GET /bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/if2otukoi3s9.css HTTP/1.1\r\nHost: telegram-premiuma.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812\r\nCookie: PHPSESSID=973d74b6e7628daa52211632267b00ba\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: private, max-age=3600, must-revalidate\r\ncontent-encoding: gzip\r\ncontent-type: text/css;charset=UTF-8\r\ndate: Sat, 05 Sep 2026 02:18:15 GMT\r\nvary: Accept-Encoding\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":908793,"size_decoded":258150,"mime_type":"text/css; charset=UTF-8","magic":"Unicode text, UTF-8 text, with very long lines (65534), with no line terminators","md5":"5bee4a67cf253fabea2589d99828f3e4","sha1":"227139a22b71910db13a8a7ec52b5af54f8b24df","sha256":"8d0cfcbb9e0bae090677b5aa21caa57321a6660671f6f0cc6053aa5f7bc10c6d","sha512":"f8cc42433888ab9cb8f4c49d6a96699c065f57bf2ef9c671c2eae200db419d3734a3578042eebc9d9b9193ff1d4887e63dd8aee50bf3366f4ad52eb7f7743480","ssdeep":"24576:HJY2xXf8PQhqMrxJ1axWJEci10/qQDjii6fTtx2OZQWPbuNmlXlFAV1ZRdSz7aKz:mqHJAhIFcPrcmPg1ZRdSz7aKUa5GMO4V","tlshash":"c8150b759790303ce437c63a7ad4abcc1138d881ee234badf157a625c2c76e62636b4d","first_seen":"2026-09-04T07:11:34.727315Z","last_seen":"2026-09-05T02:18:59.517328Z","times_seen":2,"resource_available":false,"data":null}},"time_used":128,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":128,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"telegram-premiuma.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"telegram-premiuma.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/favicon.ico","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.129.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812","date":"2026-09-05T02:18:15.270Z","timestamp":1788574695270,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"jsdelivr.net","organization":""},"issuer":{"commonName":"GlobalSign Atlas R3 DV TLS CA 2026 Q2","organization":"GlobalSign nv-sa"},"validity":{"start":"Wed, 20 May 2026 15:48:47 GMT","end":"Sat, 05 Dec 2026 14:48:47 GMT"},"fingerprint":{"sha1":"D4:05:C2:EC:C7:EE:2B:D0:08:68:0D:3D:33:77:48:78:43:E7:D1:E1","sha256":"ED:84:90:EE:71:BC:6B:5E:B3:D2:50:B0:23:3A:06:0D:E0:50:C6:B6:A9:09:36:E6:CE:FE:E8:66:89:EB:4E:C5"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://telegram-premiuma.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-length: 1506\r\ncache-control: public, max-age=31536000\r\netag: \"1536-I2gXux9vPOs5yfMlZdgosG1aC4M\"\r\ncontent-type: image/x-icon\r\ncontent-encoding: br\r\naccept-ranges: bytes\r\ndate: Sat, 05 Sep 2026 02:18:15 GMT\r\nage: 668\r\nx-served-by: cache-fra-eddf8230115-FRA, cache-bma-essb1270039-BMA\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":5430,"size_decoded":1927,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel","md5":"aa285fc5c7a8bbf9a84f378e7ef77d76","sha1":"236817bb1f6f3ceb39c9f32565d828b06d5a0b83","sha256":"008d56e45155d8312f6920ab31b96f22577b7695bf0e986597554d130f0b395c","sha512":"6987c9652d8adaa67aa53838ecba267c1e125208ff35837ec9ea2d5c5668ae31521ec772f7d3b66d3ca14022bc98becc486754172aab7505150533855e56b9df","ssdeep":"48:9qB7AcqG4lhSHi7NKkBTLzmLYDBha+QT2ZhVoamX7+oV5aDtaaKsjBdP32:UUcqG4lhgiB3LzLBhlW7+iEhaaK9","tlshash":"4ab1dc50affe5578cba18b3040727e788957444f58484b722b349bc33eb6b9e0f27995","first_seen":"2023-05-15T12:25:24Z","last_seen":"2026-09-05T02:18:59.518379Z","times_seen":161,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/bc07wufawyw8.js","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812?swfix=1","date":"2026-09-05T02:18:15.967Z","timestamp":1788574695967,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegram-premiuma.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 20 Aug 2026 13:03:55 GMT","end":"Wed, 18 Nov 2026 13:03:54 GMT"},"fingerprint":{"sha1":"B2:17:4B:E9:D3:06:9F:8E:37:18:3D:02:E4:A3:BC:87:68:22:07:A5","sha256":"D2:AD:1D:5B:0A:8B:60:55:6F:18:10:D4:BA:B8:C0:3E:8F:6A:55:62:4A:F9:CE:6E:47:D8:F5:F5:9B:CD:28:A1"}}},"request":{"raw":"GET /bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/bc07wufawyw8.js HTTP/1.1\r\nHost: telegram-premiuma.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812?swfix=1\r\nCookie: PHPSESSID=973d74b6e7628daa52211632267b00ba\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: private, max-age=3600, must-revalidate\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Sat, 05 Sep 2026 02:18:16 GMT\r\nvary: Accept-Encoding\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":67969,"size_decoded":22589,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65119), with no line terminators","md5":"27b2ca5a9941d15593a63f05719ffa5e","sha1":"4e0658a78b1f78348e73993a83f6ad48d8ea5d33","sha256":"51f01379996b752011e1531940af2a0d7d46235ed402294c67d0432991c4db73","sha512":"c5d0439c5f3afe72130f2ff6eb26104ced399fba69f24bc649e9ddbb24fad8b2fee173ae9bf6674fe165412e1f1824669f8589dbc9f83a699c8c1e6b8f8ce7bc","ssdeep":"768:5hVs9UGPsB8pRlA8wjToIv+bMsNMaCCJeeLufdiCqfEeHm/KHIRKYDjvHR0FrVmc:X9Ga8pRlA8AToIvwf6HECcrmJlgQTXc","tlshash":"39635063b7c01a361a4b9fb7b31bb9e0ce2539297525089bd1047fb4ad49532dae0f31","first_seen":"2026-09-04T07:11:34.797113Z","last_seen":"2026-09-05T02:18:59.518975Z","times_seen":2,"resource_available":true,"data":null}},"time_used":114,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":114,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-09-05","alert":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","trigger":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/bc07wufawyw8.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"@imp0rtp3 (modified by Florian Roth)","date":"2020-09-06","description":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","reference":"https://imp0rtp3.wordpress.com/2021/08/12/tetris","rule":"apt_CN_Tetris_JS_advanced_1"}},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"telegram-premiuma.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"telegram-premiuma.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"static.tildacdn.com/favicon.ico","fqdn":"static.tildacdn.com","domain":"tildacdn.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812","date":"2026-09-05T02:18:14.718Z","timestamp":1788574694718,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: static.tildacdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://telegram-premiuma.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-05T03:58:35.283591Z","times_seen":18285635,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"static.tildacdn.com/favicon.ico","fqdn":"static.tildacdn.com","domain":"tildacdn.com","tld":"com"},"ip":{"addr":"95.181.182.182","port":443,"asn":210756,"as":"EdgeCenter LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812","date":"2026-09-05T02:18:15.267Z","timestamp":1788574695267,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.tildacdn.com","organization":""},"issuer":{"commonName":"GlobeSSL DV CA","organization":"CentralNic Luxembourg Sàrl"},"validity":{"start":"Tue, 03 Feb 2026 00:00:00 GMT","end":"Sat, 20 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"9E:6F:B5:96:E2:36:65:FE:13:E9:4D:8B:A3:FA:0B:53:A6:95:4D:EA","sha256":"07:14:4E:62:F1:DF:1C:54:FC:C2:84:2A:7F:F4:9C:8C:93:51:8B:FD:44:C4:9E:E6:85:88:30:AD:E7:42:2C:55"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: static.tildacdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://telegram-premiuma.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 05 Sep 2026 02:18:15 GMT\r\ncontent-type: image/vnd.microsoft.icon\r\ncontent-length: 1718\r\naccess-control-expose-headers: Cache-Control, Content-Language, Content-Type, Expires, Last-Modified, Pragma, Etag, X-Timestamp, X-Trans-Id, X-Openstack-Request-Id, Content-Length, Accept-Ranges, Expires, Cache-Control\r\netag: \"539cb98730871486358e58b899ac739e\"\r\nlast-modified: Tue, 06 Nov 2018 14:10:35 GMT\r\nx-container-storage-policy-index: 0\r\nx-container-storage-policy-name: Policy-0\r\nx-timestamp: 1541513434.04197\r\nx-trans-id: 15648e4d0c81153a\r\nage: 0\r\ntserver: 11\r\nexpires: Wed, 04 Nov 2026 02:18:15 GMT\r\ncache-control: max-age=5184000\r\naccess-control-allow-origin: *\r\ncache: HIT, STALE\r\nx-cached-since: 2024-10-23T15:09:15+00:00, 2025-08-21T10:27:22+00:00\r\nx-node: m9-up-gc45, m9-up-gc228\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1718,"size_decoded":2585,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 16-bit/color RGBA, non-interlaced","md5":"539cb98730871486358e58b899ac739e","sha1":"74bb1950b16a7c76d80870a513ad0f0158b6818b","sha256":"9c41ad6c9283238f7c984d799ee3434e898a32ab9f0a6ef5fd46815e7597924d","sha512":"1e2701b95f7de432a6538a352c5725406ce7c1f98d0853019414d46f21e0de583d1dd9486b8777eb96cf9e9ba87b80c1d110c4b24232995cc091ad18cd461817","ssdeep":"","tlshash":"06311d2f9550dd2fc5be072230e73644428b191e2bf058570c759e3b1995fc83015df1","first_seen":"2023-04-14T14:28:33Z","last_seen":"2026-09-05T02:18:59.520663Z","times_seen":563,"resource_available":false,"data":null}},"time_used":157,"timings":{"blocked":-1,"dns":0,"connect":47,"send":0,"wait":48,"receive":8,"ssl":54},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/1xahgwbu4ko3.css","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812?swfix=1","date":"2026-09-05T02:18:15.971Z","timestamp":1788574695971,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegram-premiuma.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 20 Aug 2026 13:03:55 GMT","end":"Wed, 18 Nov 2026 13:03:54 GMT"},"fingerprint":{"sha1":"B2:17:4B:E9:D3:06:9F:8E:37:18:3D:02:E4:A3:BC:87:68:22:07:A5","sha256":"D2:AD:1D:5B:0A:8B:60:55:6F:18:10:D4:BA:B8:C0:3E:8F:6A:55:62:4A:F9:CE:6E:47:D8:F5:F5:9B:CD:28:A1"}}},"request":{"raw":"GET /bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/1xahgwbu4ko3.css HTTP/1.1\r\nHost: telegram-premiuma.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812?swfix=1\r\nCookie: PHPSESSID=973d74b6e7628daa52211632267b00ba\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: private, max-age=3600, must-revalidate\r\ncontent-encoding: gzip\r\ncontent-type: text/css;charset=UTF-8\r\ndate: Sat, 05 Sep 2026 02:18:16 GMT\r\nvary: Accept-Encoding\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":11253,"size_decoded":3852,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text, with very long lines (11253), with no line terminators","md5":"5735b2c1d3095150921f5c731b2f137a","sha1":"f12e2ca4c511ac1ba3b061bcee3340882d748509","sha256":"a384bf557671dc837ef1bbda5c2f821992560f0b6cba8bfdd63f39885a67d904","sha512":"581151dc1cc05526160e9a401ece497f1e7511a663718ec5040bba943ab54a0f10ecf0f094db59ba3bc62be9ad7b19df6adf64937e1537dd4fe8da91e3c28a7b","ssdeep":"192:ThC0kdc7STB5C+yJio220h1wcWPrwU3BRCjGFJquaM4XTByp+9Nn:teW5Q1wcWPrwU3BaGmuXQNn","tlshash":"ae3287f6e7aca03f783ed467a8855ade22149816dd3727dbfa55e52c40c72731120b48","first_seen":"2026-09-04T07:11:34.78178Z","last_seen":"2026-09-05T02:18:59.526026Z","times_seen":2,"resource_available":false,"data":null}},"time_used":110,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":110,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"telegram-premiuma.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"telegram-premiuma.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"static.tildacdn.com/favicon.ico","fqdn":"static.tildacdn.com","domain":"tildacdn.com","tld":"com"},"ip":{"addr":"95.181.182.182","port":443,"asn":210756,"as":"EdgeCenter LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812?swfix=1","date":"2026-09-05T02:18:15.979Z","timestamp":1788574695979,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.tildacdn.com","organization":""},"issuer":{"commonName":"GlobeSSL DV CA","organization":"CentralNic Luxembourg Sàrl"},"validity":{"start":"Tue, 03 Feb 2026 00:00:00 GMT","end":"Sat, 20 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"9E:6F:B5:96:E2:36:65:FE:13:E9:4D:8B:A3:FA:0B:53:A6:95:4D:EA","sha256":"07:14:4E:62:F1:DF:1C:54:FC:C2:84:2A:7F:F4:9C:8C:93:51:8B:FD:44:C4:9E:E6:85:88:30:AD:E7:42:2C:55"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: static.tildacdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://telegram-premiuma.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 05 Sep 2026 02:18:15 GMT\r\ncontent-type: image/vnd.microsoft.icon\r\ncontent-length: 1718\r\naccess-control-expose-headers: Cache-Control, Content-Language, Content-Type, Expires, Last-Modified, Pragma, Etag, X-Timestamp, X-Trans-Id, X-Openstack-Request-Id, Content-Length, Accept-Ranges, Expires, Cache-Control\r\netag: \"539cb98730871486358e58b899ac739e\"\r\nlast-modified: Tue, 06 Nov 2018 14:10:35 GMT\r\nx-container-storage-policy-index: 0\r\nx-container-storage-policy-name: Policy-0\r\nx-timestamp: 1541513434.04197\r\nx-trans-id: 15648e4d0c81153a\r\nage: 0\r\ntserver: 11\r\nexpires: Wed, 04 Nov 2026 02:18:15 GMT\r\ncache-control: max-age=5184000\r\naccess-control-allow-origin: *\r\ncache: HIT, STALE\r\nx-cached-since: 2024-10-23T15:09:15+00:00, 2025-08-21T10:27:22+00:00\r\nx-node: m9-up-gc45, m9-up-gc228\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1718,"size_decoded":2585,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 16-bit/color RGBA, non-interlaced","md5":"539cb98730871486358e58b899ac739e","sha1":"74bb1950b16a7c76d80870a513ad0f0158b6818b","sha256":"9c41ad6c9283238f7c984d799ee3434e898a32ab9f0a6ef5fd46815e7597924d","sha512":"1e2701b95f7de432a6538a352c5725406ce7c1f98d0853019414d46f21e0de583d1dd9486b8777eb96cf9e9ba87b80c1d110c4b24232995cc091ad18cd461817","ssdeep":"","tlshash":"06311d2f9550dd2fc5be072230e73644428b191e2bf058570c759e3b1995fc83015df1","first_seen":"2023-04-14T14:28:33Z","last_seen":"2026-09-05T02:18:59.520663Z","times_seen":563,"resource_available":false,"data":null}},"time_used":51,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":48,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/jakzao5z71vc.js","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812?swfix=1","date":"2026-09-05T02:18:16.958Z","timestamp":1788574696958,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegram-premiuma.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 20 Aug 2026 13:03:55 GMT","end":"Wed, 18 Nov 2026 13:03:54 GMT"},"fingerprint":{"sha1":"B2:17:4B:E9:D3:06:9F:8E:37:18:3D:02:E4:A3:BC:87:68:22:07:A5","sha256":"D2:AD:1D:5B:0A:8B:60:55:6F:18:10:D4:BA:B8:C0:3E:8F:6A:55:62:4A:F9:CE:6E:47:D8:F5:F5:9B:CD:28:A1"}}},"request":{"raw":"GET /bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/jakzao5z71vc.js HTTP/1.1\r\nHost: telegram-premiuma.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/747biwsusmw5.js\r\nCookie: PHPSESSID=973d74b6e7628daa52211632267b00ba\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: private, max-age=3600, must-revalidate\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Sat, 05 Sep 2026 02:18:17 GMT\r\nvary: Accept-Encoding\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":7843,"size_decoded":2646,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (7843), with no line terminators","md5":"ea8c83fd7de7f0707e18efb5a4584ed9","sha1":"7d5875279ac30dbbb6637682073c2376afcb1e24","sha256":"49c21269c061921023068b5d3bbf833a0a33bced50ae72dd0e6ce1bb35226b0b","sha512":"c2c7b9f75789585f7be98bba6292e62a35d5e840a372c30a7aa81618d33ec0e8120c1cd7c78c23224ff2a42f60baaf6810463038a1f1e0cd31aa7bbc09eda3a8","ssdeep":"96:H2XgTdkSnfP6AoFdzUe33QNhqVtA5H/4BQeT6iwdLswJ:WXASSnfToFtUagNUVe5fG9wRJ","tlshash":"6bf132488f8a465d3123ff33f517f560d6b509057642e449e84bbf34ac2a73899bacb4","first_seen":"2026-09-04T07:11:34.82782Z","last_seen":"2026-09-05T02:18:59.530161Z","times_seen":2,"resource_available":true,"data":null}},"time_used":120,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":120,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"telegram-premiuma.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"telegram-premiuma.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/fotrem5ns4qc.js","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812?swfix=1","date":"2026-09-05T02:18:17.240Z","timestamp":1788574697240,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegram-premiuma.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 20 Aug 2026 13:03:55 GMT","end":"Wed, 18 Nov 2026 13:03:54 GMT"},"fingerprint":{"sha1":"B2:17:4B:E9:D3:06:9F:8E:37:18:3D:02:E4:A3:BC:87:68:22:07:A5","sha256":"D2:AD:1D:5B:0A:8B:60:55:6F:18:10:D4:BA:B8:C0:3E:8F:6A:55:62:4A:F9:CE:6E:47:D8:F5:F5:9B:CD:28:A1"}}},"request":{"raw":"GET /bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/fotrem5ns4qc.js HTTP/1.1\r\nHost: telegram-premiuma.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812?swfix=1\r\nCookie: PHPSESSID=973d74b6e7628daa52211632267b00ba\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: private, max-age=3600, must-revalidate\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Sat, 05 Sep 2026 02:18:17 GMT\r\nvary: Accept-Encoding\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":36124,"size_decoded":12237,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (36124), with no line terminators","md5":"7081753ce4592c832eacfd7b1b9d1da0","sha1":"74921682fd1d455412c2a20d06b0060662804cf8","sha256":"3ebb69453ef627017649001c1532dfd9a3e393030217bd0f65c72758c46f05b0","sha512":"c2725ebd443cca8100a64084f32d1efd17f0ccdb39a432d62863cba2a194d55a12ff036c2d468f66b0d1e747e6276cd029685f5ad2635bfd365d0e3a99b0fadb","ssdeep":"768:jv2cLvd5S+pMpsJfXp/p+XQXdJIySw+vJ8Q1y3b0gaUXeTMjYE2zk1l04UJuxaGa:TpPS87RQ80gaUXeTMjYE2zal04wuxaGa","tlshash":"41f26411ab800a2133978fb7771bb4f4ea05692a754109afe0147fb4ef59533e6e1e31","first_seen":"2026-09-05T02:18:59.531787Z","last_seen":"2026-09-05T02:18:59.531787Z","times_seen":1,"resource_available":true,"data":null}},"time_used":126,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":126,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-09-05","alert":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","trigger":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/fotrem5ns4qc.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"@imp0rtp3 (modified by Florian Roth)","date":"2020-09-06","description":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","reference":"https://imp0rtp3.wordpress.com/2021/08/12/tetris","rule":"apt_CN_Tetris_JS_advanced_1"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"telegram-premiuma.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"telegram-premiuma.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/favicon.ico","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.129.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812","date":"2026-09-05T02:18:14.715Z","timestamp":1788574694715,"http_version":"HTTP/2","security_state":"secure","security_info":null,"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://telegram-premiuma.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=31536000\r\netag: \"1536-I2gXux9vPOs5yfMlZdgosG1aC4M\"\r\ncontent-type: image/x-icon\r\ncontent-encoding: br\r\naccept-ranges: bytes\r\nage: 667\r\ndate: Sat, 05 Sep 2026 02:18:14 GMT\r\nx-served-by: cache-fra-eddf8230115-FRA, cache-bma-essb1270030-BMA\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\ncontent-length: 1506\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-05T03:58:35.283591Z","times_seen":18285635,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-05T02:18:14.950Z","timestamp":1788574694950,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegram-premiuma.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 20 Aug 2026 13:03:55 GMT","end":"Wed, 18 Nov 2026 13:03:54 GMT"},"fingerprint":{"sha1":"B2:17:4B:E9:D3:06:9F:8E:37:18:3D:02:E4:A3:BC:87:68:22:07:A5","sha256":"D2:AD:1D:5B:0A:8B:60:55:6F:18:10:D4:BA:B8:C0:3E:8F:6A:55:62:4A:F9:CE:6E:47:D8:F5:F5:9B:CD:28:A1"}}},"request":{"raw":"GET /976cb069dbe6ab0729efa766e63c0812 HTTP/1.1\r\nHost: telegram-premiuma.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=973d74b6e7628daa52211632267b00ba\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: no-store, no-cache, must-revalidate\r\ncontent-encoding: gzip\r\ncontent-type: text/html; charset=UTF-8\r\ndate: Sat, 05 Sep 2026 02:18:15 GMT\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\npragma: no-cache\r\nvary: Accept-Encoding\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":22259,"size_decoded":9215,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (4556)","md5":"9f75a3296b918cd9d9d148fec5a5cf1b","sha1":"d06ae96f4fdb95b352aafdd460a03e078f51531d","sha256":"5f3024743b7cc43bc8944bc75abb5c958bbc746140e82c9bb8be96c3590d7243","sha512":"7fb3a3c3b478c1db24579ae91723888667d4392d5b8688b98915431a21dd46d25e25ff35aa45c3b174122121057515ca6486e765c30ae780dc46fe8197bb6a52","ssdeep":"384:9lMY36MISqoqexDu6bUAbvu//EGZn5iiL5S2:bKMVqozxDBbvg/Ek5rdS2","tlshash":"aba2e9b140f6509a6103f28dde046f1e2e8694ffaf5a431572bc2ea67ff3895c917818","first_seen":"2026-09-05T02:18:59.533097Z","last_seen":"2026-09-05T02:18:59.533097Z","times_seen":1,"resource_available":false,"data":null}},"time_used":133,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":133,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"telegram-premiuma.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"telegram-premiuma.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/pjuylvc7wvrs.js","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812?swfix=1","date":"2026-09-05T02:18:16.959Z","timestamp":1788574696959,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegram-premiuma.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 20 Aug 2026 13:03:55 GMT","end":"Wed, 18 Nov 2026 13:03:54 GMT"},"fingerprint":{"sha1":"B2:17:4B:E9:D3:06:9F:8E:37:18:3D:02:E4:A3:BC:87:68:22:07:A5","sha256":"D2:AD:1D:5B:0A:8B:60:55:6F:18:10:D4:BA:B8:C0:3E:8F:6A:55:62:4A:F9:CE:6E:47:D8:F5:F5:9B:CD:28:A1"}}},"request":{"raw":"GET /bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/pjuylvc7wvrs.js HTTP/1.1\r\nHost: telegram-premiuma.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/747biwsusmw5.js\r\nCookie: PHPSESSID=973d74b6e7628daa52211632267b00ba\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: private, max-age=3600, must-revalidate\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Sat, 05 Sep 2026 02:18:17 GMT\r\nvary: Accept-Encoding\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":101395,"size_decoded":19584,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65531), with no line terminators","md5":"12dc7983df5179102beb36ce55c658f4","sha1":"8883a4b8e34a3c0580e7ffefa2e723028f301312","sha256":"a161166c16b7009e4d9a50ad5a12732a4079f0cff1b2df49fc976428db249a6e","sha512":"b3ea53bf62d0b123f508417fdbdb3633a9e8830043fcfed21303aa9a29cfde623fdd904f1eb36f683827d13de922ba28b200e736e8e87483c6e26ae9b7b5d2df","ssdeep":"768:6jEliYPtm20fow/VwnPmtT4aG/tL6W0PjTUwtheroqaUR11pqmmtJ19MNZTGnmhl:6/JZ1u7dTzY+5R","tlshash":"9fa37f25f7c050d86ab7ee53ab13fe60e079ac9d36a040dcd945ab386c63336157ac72","first_seen":"2026-09-04T07:11:34.768523Z","last_seen":"2026-09-05T02:18:59.534849Z","times_seen":2,"resource_available":true,"data":null}},"time_used":130,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":130,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-09-05","alert":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","trigger":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/pjuylvc7wvrs.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"@imp0rtp3 (modified by Florian Roth)","date":"2020-09-06","description":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","reference":"https://imp0rtp3.wordpress.com/2021/08/12/tetris","rule":"apt_CN_Tetris_JS_advanced_1"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"telegram-premiuma.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"telegram-premiuma.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/assets/fonts/81dea67f.woff2","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812?swfix=1","date":"2026-09-05T02:18:19.096Z","timestamp":1788574699096,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegram-premiuma.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 20 Aug 2026 13:03:55 GMT","end":"Wed, 18 Nov 2026 13:03:54 GMT"},"fingerprint":{"sha1":"B2:17:4B:E9:D3:06:9F:8E:37:18:3D:02:E4:A3:BC:87:68:22:07:A5","sha256":"D2:AD:1D:5B:0A:8B:60:55:6F:18:10:D4:BA:B8:C0:3E:8F:6A:55:62:4A:F9:CE:6E:47:D8:F5:F5:9B:CD:28:A1"}}},"request":{"raw":"GET /bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/assets/fonts/81dea67f.woff2 HTTP/1.1\r\nHost: telegram-premiuma.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/if2otukoi3s9.css\r\nCookie: PHPSESSID=973d74b6e7628daa52211632267b00ba\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\ncache-control: private, max-age=3600, must-revalidate\r\ncontent-type: font/woff2\r\ndate: Sat, 05 Sep 2026 02:18:19 GMT\r\ncontent-length: 8024\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":8024,"size_decoded":8221,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 8024, version 1.0","md5":"073578b7f22768baa58cf9a87380538a","sha1":"702b779b7ea064cc4713f2234dc74b1097aee389","sha256":"f36d71c69bcec4ce625d2923d36a4b1f64bbc2e5691c99cf8a4f3b0f79d1edb4","sha512":"627d5a3ba36e5f057e74ce2828fbd86b50cbbe01605cc0523366333b8ce86d45ab383d0ec6195794112b96b307682d7bdd28b9c6b40189ccac4a6aad09d05b00","ssdeep":"192:cP+/jSJI4FjukEJlRF/bYtreKfmjsD1UyQrPG6:cP+WTju1RbMTmjsG9Pt","tlshash":"9af18e171dd83238c4046cbed33297e60e1c2f776c7127b4f554d4f085a87b4a99e458","first_seen":"2023-04-05T09:25:54Z","last_seen":"2026-09-05T02:18:59.536635Z","times_seen":3128,"resource_available":false,"data":null}},"time_used":139,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":139,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"telegram-premiuma.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"telegram-premiuma.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/favicon.ico","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.129.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812?swfix=1","date":"2026-09-05T02:18:15.974Z","timestamp":1788574695974,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"jsdelivr.net","organization":""},"issuer":{"commonName":"GlobalSign Atlas R3 DV TLS CA 2026 Q2","organization":"GlobalSign nv-sa"},"validity":{"start":"Wed, 20 May 2026 15:48:47 GMT","end":"Sat, 05 Dec 2026 14:48:47 GMT"},"fingerprint":{"sha1":"D4:05:C2:EC:C7:EE:2B:D0:08:68:0D:3D:33:77:48:78:43:E7:D1:E1","sha256":"ED:84:90:EE:71:BC:6B:5E:B3:D2:50:B0:23:3A:06:0D:E0:50:C6:B6:A9:09:36:E6:CE:FE:E8:66:89:EB:4E:C5"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://telegram-premiuma.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-length: 1506\r\ncache-control: public, max-age=31536000\r\netag: \"1536-I2gXux9vPOs5yfMlZdgosG1aC4M\"\r\ncontent-type: image/x-icon\r\ncontent-encoding: br\r\naccept-ranges: bytes\r\ndate: Sat, 05 Sep 2026 02:18:15 GMT\r\nage: 669\r\nx-served-by: cache-fra-eddf8230115-FRA, cache-bma-essb1270039-BMA\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":5430,"size_decoded":1927,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel","md5":"aa285fc5c7a8bbf9a84f378e7ef77d76","sha1":"236817bb1f6f3ceb39c9f32565d828b06d5a0b83","sha256":"008d56e45155d8312f6920ab31b96f22577b7695bf0e986597554d130f0b395c","sha512":"6987c9652d8adaa67aa53838ecba267c1e125208ff35837ec9ea2d5c5668ae31521ec772f7d3b66d3ca14022bc98becc486754172aab7505150533855e56b9df","ssdeep":"48:9qB7AcqG4lhSHi7NKkBTLzmLYDBha+QT2ZhVoamX7+oV5aDtaaKsjBdP32:UUcqG4lhgiB3LzLBhlW7+iEhaaK9","tlshash":"4ab1dc50affe5578cba18b3040727e788957444f58484b722b349bc33eb6b9e0f27995","first_seen":"2023-05-15T12:25:24Z","last_seen":"2026-09-05T02:18:59.518379Z","times_seen":161,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/1xahgwbu4ko3.css","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812","date":"2026-09-05T02:18:14.521Z","timestamp":1788574694521,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegram-premiuma.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 20 Aug 2026 13:03:55 GMT","end":"Wed, 18 Nov 2026 13:03:54 GMT"},"fingerprint":{"sha1":"B2:17:4B:E9:D3:06:9F:8E:37:18:3D:02:E4:A3:BC:87:68:22:07:A5","sha256":"D2:AD:1D:5B:0A:8B:60:55:6F:18:10:D4:BA:B8:C0:3E:8F:6A:55:62:4A:F9:CE:6E:47:D8:F5:F5:9B:CD:28:A1"}}},"request":{"raw":"GET /bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/1xahgwbu4ko3.css HTTP/1.1\r\nHost: telegram-premiuma.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812\r\nCookie: PHPSESSID=973d74b6e7628daa52211632267b00ba\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: private, max-age=3600, must-revalidate\r\ncontent-encoding: gzip\r\ncontent-type: text/css;charset=UTF-8\r\ndate: Sat, 05 Sep 2026 02:18:14 GMT\r\nvary: Accept-Encoding\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":11253,"size_decoded":3852,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text, with very long lines (11253), with no line terminators","md5":"5735b2c1d3095150921f5c731b2f137a","sha1":"f12e2ca4c511ac1ba3b061bcee3340882d748509","sha256":"a384bf557671dc837ef1bbda5c2f821992560f0b6cba8bfdd63f39885a67d904","sha512":"581151dc1cc05526160e9a401ece497f1e7511a663718ec5040bba943ab54a0f10ecf0f094db59ba3bc62be9ad7b19df6adf64937e1537dd4fe8da91e3c28a7b","ssdeep":"192:ThC0kdc7STB5C+yJio220h1wcWPrwU3BRCjGFJquaM4XTByp+9Nn:teW5Q1wcWPrwU3BaGmuXQNn","tlshash":"ae3287f6e7aca03f783ed467a8855ade22149816dd3727dbfa55e52c40c72731120b48","first_seen":"2026-09-04T07:11:34.78178Z","last_seen":"2026-09-05T02:18:59.526026Z","times_seen":2,"resource_available":false,"data":null}},"time_used":207,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":207,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"telegram-premiuma.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"telegram-premiuma.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/assets/img/ade2f7c8.png","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812?swfix=1","date":"2026-09-05T02:18:16.545Z","timestamp":1788574696545,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegram-premiuma.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 20 Aug 2026 13:03:55 GMT","end":"Wed, 18 Nov 2026 13:03:54 GMT"},"fingerprint":{"sha1":"B2:17:4B:E9:D3:06:9F:8E:37:18:3D:02:E4:A3:BC:87:68:22:07:A5","sha256":"D2:AD:1D:5B:0A:8B:60:55:6F:18:10:D4:BA:B8:C0:3E:8F:6A:55:62:4A:F9:CE:6E:47:D8:F5:F5:9B:CD:28:A1"}}},"request":{"raw":"GET /bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/assets/img/ade2f7c8.png HTTP/1.1\r\nHost: telegram-premiuma.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812?swfix=1\r\nCookie: PHPSESSID=973d74b6e7628daa52211632267b00ba\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: private, max-age=3600, must-revalidate\r\ncontent-type: image/png\r\ndate: Sat, 05 Sep 2026 02:18:16 GMT\r\ncontent-length: 1023\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":1023,"size_decoded":1197,"mime_type":"image/png","magic":"PNG image data, 16 x 16, 8-bit colormap, non-interlaced","md5":"d83a87a32db5d4e241e03addda510425","sha1":"2b1eb9216d33027fff26604e4c7fe517733df8f1","sha256":"74f89bcbf67c99eeb5c36c7d34e273cf79afa7a7e5c2a03d64024c92b20a4dd0","sha512":"cbc1e61a90754e590c3cd3dad131437d93cf846259143f28378d00c9ffece70218771c95d446f761ea92e15c6027224b0ec934e37fd94d1171a275655f8b7a5d","ssdeep":"","tlshash":"e01175c61794a67bd1db7e7303d92786ec6cc80631c01d42e9cb499dc82c5c0065d61e","first_seen":"2026-09-05T02:18:59.537291Z","last_seen":"2026-09-05T02:18:59.537291Z","times_seen":1,"resource_available":false,"data":null}},"time_used":119,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":119,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"telegram-premiuma.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"telegram-premiuma.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/bc07wufawyw8.js","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812","date":"2026-09-05T02:18:14.517Z","timestamp":1788574694517,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegram-premiuma.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 20 Aug 2026 13:03:55 GMT","end":"Wed, 18 Nov 2026 13:03:54 GMT"},"fingerprint":{"sha1":"B2:17:4B:E9:D3:06:9F:8E:37:18:3D:02:E4:A3:BC:87:68:22:07:A5","sha256":"D2:AD:1D:5B:0A:8B:60:55:6F:18:10:D4:BA:B8:C0:3E:8F:6A:55:62:4A:F9:CE:6E:47:D8:F5:F5:9B:CD:28:A1"}}},"request":{"raw":"GET /bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/bc07wufawyw8.js HTTP/1.1\r\nHost: telegram-premiuma.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812\r\nCookie: PHPSESSID=973d74b6e7628daa52211632267b00ba\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: private, max-age=3600, must-revalidate\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Sat, 05 Sep 2026 02:18:14 GMT\r\nvary: Accept-Encoding\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":67969,"size_decoded":22589,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65119), with no line terminators","md5":"27b2ca5a9941d15593a63f05719ffa5e","sha1":"4e0658a78b1f78348e73993a83f6ad48d8ea5d33","sha256":"51f01379996b752011e1531940af2a0d7d46235ed402294c67d0432991c4db73","sha512":"c5d0439c5f3afe72130f2ff6eb26104ced399fba69f24bc649e9ddbb24fad8b2fee173ae9bf6674fe165412e1f1824669f8589dbc9f83a699c8c1e6b8f8ce7bc","ssdeep":"768:5hVs9UGPsB8pRlA8wjToIv+bMsNMaCCJeeLufdiCqfEeHm/KHIRKYDjvHR0FrVmc:X9Ga8pRlA8AToIvwf6HECcrmJlgQTXc","tlshash":"39635063b7c01a361a4b9fb7b31bb9e0ce2539297525089bd1047fb4ad49532dae0f31","first_seen":"2026-09-04T07:11:34.797113Z","last_seen":"2026-09-05T02:18:59.518975Z","times_seen":2,"resource_available":true,"data":null}},"time_used":146,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":146,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-09-05","alert":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","trigger":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/bc07wufawyw8.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"@imp0rtp3 (modified by Florian Roth)","date":"2020-09-06","description":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","reference":"https://imp0rtp3.wordpress.com/2021/08/12/tetris","rule":"apt_CN_Tetris_JS_advanced_1"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"telegram-premiuma.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"telegram-premiuma.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/747biwsusmw5.js","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812","date":"2026-09-05T02:18:14.518Z","timestamp":1788574694518,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegram-premiuma.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 20 Aug 2026 13:03:55 GMT","end":"Wed, 18 Nov 2026 13:03:54 GMT"},"fingerprint":{"sha1":"B2:17:4B:E9:D3:06:9F:8E:37:18:3D:02:E4:A3:BC:87:68:22:07:A5","sha256":"D2:AD:1D:5B:0A:8B:60:55:6F:18:10:D4:BA:B8:C0:3E:8F:6A:55:62:4A:F9:CE:6E:47:D8:F5:F5:9B:CD:28:A1"}}},"request":{"raw":"GET /bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/747biwsusmw5.js HTTP/1.1\r\nHost: telegram-premiuma.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812\r\nCookie: PHPSESSID=973d74b6e7628daa52211632267b00ba\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: private, max-age=3600, must-revalidate\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Sat, 05 Sep 2026 02:18:14 GMT\r\nvary: Accept-Encoding\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-05T03:58:35.283591Z","times_seen":18285635,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"telegram-premiuma.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"telegram-premiuma.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/assets/fonts/81dea67f.woff2","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812","date":"2026-09-05T02:18:14.961Z","timestamp":1788574694961,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegram-premiuma.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 20 Aug 2026 13:03:55 GMT","end":"Wed, 18 Nov 2026 13:03:54 GMT"},"fingerprint":{"sha1":"B2:17:4B:E9:D3:06:9F:8E:37:18:3D:02:E4:A3:BC:87:68:22:07:A5","sha256":"D2:AD:1D:5B:0A:8B:60:55:6F:18:10:D4:BA:B8:C0:3E:8F:6A:55:62:4A:F9:CE:6E:47:D8:F5:F5:9B:CD:28:A1"}}},"request":{"raw":"GET /bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/assets/fonts/81dea67f.woff2 HTTP/1.1\r\nHost: telegram-premiuma.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/if2otukoi3s9.css\r\nCookie: PHPSESSID=973d74b6e7628daa52211632267b00ba\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\ncache-control: private, max-age=3600, must-revalidate\r\ncontent-type: font/woff2\r\ndate: Sat, 05 Sep 2026 02:18:15 GMT\r\ncontent-length: 8024\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":8024,"size_decoded":8221,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 8024, version 1.0","md5":"073578b7f22768baa58cf9a87380538a","sha1":"702b779b7ea064cc4713f2234dc74b1097aee389","sha256":"f36d71c69bcec4ce625d2923d36a4b1f64bbc2e5691c99cf8a4f3b0f79d1edb4","sha512":"627d5a3ba36e5f057e74ce2828fbd86b50cbbe01605cc0523366333b8ce86d45ab383d0ec6195794112b96b307682d7bdd28b9c6b40189ccac4a6aad09d05b00","ssdeep":"192:cP+/jSJI4FjukEJlRF/bYtreKfmjsD1UyQrPG6:cP+WTju1RbMTmjsG9Pt","tlshash":"9af18e171dd83238c4046cbed33297e60e1c2f776c7127b4f554d4f085a87b4a99e458","first_seen":"2023-04-05T09:25:54Z","last_seen":"2026-09-05T02:18:59.536635Z","times_seen":3128,"resource_available":false,"data":null}},"time_used":110,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":110,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"telegram-premiuma.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"telegram-premiuma.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/747biwsusmw5.js","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812?swfix=1","date":"2026-09-05T02:18:15.968Z","timestamp":1788574695968,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegram-premiuma.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 20 Aug 2026 13:03:55 GMT","end":"Wed, 18 Nov 2026 13:03:54 GMT"},"fingerprint":{"sha1":"B2:17:4B:E9:D3:06:9F:8E:37:18:3D:02:E4:A3:BC:87:68:22:07:A5","sha256":"D2:AD:1D:5B:0A:8B:60:55:6F:18:10:D4:BA:B8:C0:3E:8F:6A:55:62:4A:F9:CE:6E:47:D8:F5:F5:9B:CD:28:A1"}}},"request":{"raw":"GET /bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/747biwsusmw5.js HTTP/1.1\r\nHost: telegram-premiuma.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812?swfix=1\r\nCookie: PHPSESSID=973d74b6e7628daa52211632267b00ba\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: private, max-age=3600, must-revalidate\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Sat, 05 Sep 2026 02:18:16 GMT\r\nvary: Accept-Encoding\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":1702297,"size_decoded":541423,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (64158), with no line terminators","md5":"e40373012675a754a9ef24a783a2ed4a","sha1":"59df12d9ae9fb9a41cb612ddc0d36fb8e30f4be3","sha256":"13c09250e3c5778f1c01606708ba0a5770ecb6600907c809d8546d05877da5d5","sha512":"97e7f9f72ee93292f84968d728d9f3ff63cc984a71644398baee3400297942160358d97c3a93fd76b765a31cd74e9e816f5edc7c66a8745999a81fdd341c977e","ssdeep":"24576:7qy0JGJ2jgzwHlCjGVzPCdliM2GLuRinTlNXORXgOQJaGri7:7qJg8HlCjGVzPCdliM2GL5NeRXgOQJaz","tlshash":"f3251e2297c52c203217ef77b626b6d1f61118593b4c185bd4083fb8ee89236b9f5db2","first_seen":"2026-09-04T07:11:34.787578Z","last_seen":"2026-09-05T02:18:59.538538Z","times_seen":2,"resource_available":false,"data":null}},"time_used":123,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":123,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"telegram-premiuma.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"telegram-premiuma.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/gcfn9ezg0p5w.js","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812?swfix=1","date":"2026-09-05T02:18:16.953Z","timestamp":1788574696953,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegram-premiuma.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 20 Aug 2026 13:03:55 GMT","end":"Wed, 18 Nov 2026 13:03:54 GMT"},"fingerprint":{"sha1":"B2:17:4B:E9:D3:06:9F:8E:37:18:3D:02:E4:A3:BC:87:68:22:07:A5","sha256":"D2:AD:1D:5B:0A:8B:60:55:6F:18:10:D4:BA:B8:C0:3E:8F:6A:55:62:4A:F9:CE:6E:47:D8:F5:F5:9B:CD:28:A1"}}},"request":{"raw":"GET /bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/gcfn9ezg0p5w.js HTTP/1.1\r\nHost: telegram-premiuma.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/747biwsusmw5.js\r\nCookie: PHPSESSID=973d74b6e7628daa52211632267b00ba\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: private, max-age=3600, must-revalidate\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Sat, 05 Sep 2026 02:18:17 GMT\r\nvary: Accept-Encoding\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":630962,"size_decoded":146216,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65513), with no line terminators","md5":"d6c58b435330f4c0b4a2fcd2eb71614a","sha1":"7575b51e86d6f2fcafcea82bff3a315b134c6747","sha256":"15c066aea06141c08ec9a032a18f2ef184a8a0bb2da2466fd06725c522ab0ba2","sha512":"72ea15c93a096cd08be7f5725898b22cd408f3f3c79dc8fb6b958ec88283bd434c32f1d781d244d1fb23517d59003915a9205c538b8400ff13ac5b999e3d2d55","ssdeep":"3072:aji8xU8aOHOeZWspykj42KANbOEJa5mp7488iSh0xekpy4zAwtQpLpCweZ4r2mzF:QAiHBl4hv7BnOfR3ZiMAMwB02","tlshash":"9fd48b49c788450a30b39b325902fde4da89ae14b56ca75df98cbf365f42211a3fbc71","first_seen":"2026-09-04T07:11:34.779527Z","last_seen":"2026-09-05T02:18:59.540483Z","times_seen":2,"resource_available":true,"data":null}},"time_used":130,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":130,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-09-05","alert":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","trigger":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/gcfn9ezg0p5w.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"@imp0rtp3 (modified by Florian Roth)","date":"2020-09-06","description":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","reference":"https://imp0rtp3.wordpress.com/2021/08/12/tetris","rule":"apt_CN_Tetris_JS_advanced_1"}},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"telegram-premiuma.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"telegram-premiuma.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/bc07wufawyw8.js","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812","date":"2026-09-05T02:18:15.260Z","timestamp":1788574695260,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegram-premiuma.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 20 Aug 2026 13:03:55 GMT","end":"Wed, 18 Nov 2026 13:03:54 GMT"},"fingerprint":{"sha1":"B2:17:4B:E9:D3:06:9F:8E:37:18:3D:02:E4:A3:BC:87:68:22:07:A5","sha256":"D2:AD:1D:5B:0A:8B:60:55:6F:18:10:D4:BA:B8:C0:3E:8F:6A:55:62:4A:F9:CE:6E:47:D8:F5:F5:9B:CD:28:A1"}}},"request":{"raw":"GET /bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/bc07wufawyw8.js HTTP/1.1\r\nHost: telegram-premiuma.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812\r\nCookie: PHPSESSID=973d74b6e7628daa52211632267b00ba\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: private, max-age=3600, must-revalidate\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Sat, 05 Sep 2026 02:18:15 GMT\r\nvary: Accept-Encoding\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":67969,"size_decoded":22589,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65119), with no line terminators","md5":"27b2ca5a9941d15593a63f05719ffa5e","sha1":"4e0658a78b1f78348e73993a83f6ad48d8ea5d33","sha256":"51f01379996b752011e1531940af2a0d7d46235ed402294c67d0432991c4db73","sha512":"c5d0439c5f3afe72130f2ff6eb26104ced399fba69f24bc649e9ddbb24fad8b2fee173ae9bf6674fe165412e1f1824669f8589dbc9f83a699c8c1e6b8f8ce7bc","ssdeep":"768:5hVs9UGPsB8pRlA8wjToIv+bMsNMaCCJeeLufdiCqfEeHm/KHIRKYDjvHR0FrVmc:X9Ga8pRlA8AToIvwf6HECcrmJlgQTXc","tlshash":"39635063b7c01a361a4b9fb7b31bb9e0ce2539297525089bd1047fb4ad49532dae0f31","first_seen":"2026-09-04T07:11:34.797113Z","last_seen":"2026-09-05T02:18:59.518975Z","times_seen":2,"resource_available":true,"data":null}},"time_used":129,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":129,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-09-05","alert":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","trigger":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/bc07wufawyw8.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"@imp0rtp3 (modified by Florian Roth)","date":"2020-09-06","description":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","reference":"https://imp0rtp3.wordpress.com/2021/08/12/tetris","rule":"apt_CN_Tetris_JS_advanced_1"}},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"telegram-premiuma.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"telegram-premiuma.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/assets/img/c2fdb14f.png","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812?swfix=1","date":"2026-09-05T02:18:16.544Z","timestamp":1788574696544,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegram-premiuma.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 20 Aug 2026 13:03:55 GMT","end":"Wed, 18 Nov 2026 13:03:54 GMT"},"fingerprint":{"sha1":"B2:17:4B:E9:D3:06:9F:8E:37:18:3D:02:E4:A3:BC:87:68:22:07:A5","sha256":"D2:AD:1D:5B:0A:8B:60:55:6F:18:10:D4:BA:B8:C0:3E:8F:6A:55:62:4A:F9:CE:6E:47:D8:F5:F5:9B:CD:28:A1"}}},"request":{"raw":"GET /bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/assets/img/c2fdb14f.png HTTP/1.1\r\nHost: telegram-premiuma.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812?swfix=1\r\nCookie: PHPSESSID=973d74b6e7628daa52211632267b00ba\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: private, max-age=3600, must-revalidate\r\ncontent-type: image/png\r\ndate: Sat, 05 Sep 2026 02:18:16 GMT\r\ncontent-length: 9037\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":9037,"size_decoded":9211,"mime_type":"image/png","magic":"PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced","md5":"7d9d7b90d86c817c635ca393efd6c2bc","sha1":"1049de76d7d29a16381e8f216e8bb3a2f0cb9085","sha256":"ae46c30401c4c516f9f07830effefdac2d2a5895bab1799840abf96c5b4c35b4","sha512":"2237b3ec09569e88dbd51b38af96bbceae76b563e4f0ea9615e7be57ae8a464c5a9beeda5a183acb27808a349d628d5677c811158a675a104ac6d958ac132c2b","ssdeep":"192:MSOPMxBuIuGdsN/Afww5K5GcM+HALXeH1iTLnjB1qw9pyopP4E:LjTusCbw53eHs11l9pP4E","tlshash":"0012bfd50a6dc7b5db3d350ebaaea1523eba50c21b27400c87c5784bd1296f2c8fc5c8","first_seen":"2026-09-05T02:18:59.541769Z","last_seen":"2026-09-05T02:18:59.541769Z","times_seen":1,"resource_available":false,"data":null}},"time_used":110,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":110,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"telegram-premiuma.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"telegram-premiuma.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/if2otukoi3s9.css","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812","date":"2026-09-05T02:18:14.520Z","timestamp":1788574694520,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegram-premiuma.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 20 Aug 2026 13:03:55 GMT","end":"Wed, 18 Nov 2026 13:03:54 GMT"},"fingerprint":{"sha1":"B2:17:4B:E9:D3:06:9F:8E:37:18:3D:02:E4:A3:BC:87:68:22:07:A5","sha256":"D2:AD:1D:5B:0A:8B:60:55:6F:18:10:D4:BA:B8:C0:3E:8F:6A:55:62:4A:F9:CE:6E:47:D8:F5:F5:9B:CD:28:A1"}}},"request":{"raw":"GET /bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/if2otukoi3s9.css HTTP/1.1\r\nHost: telegram-premiuma.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812\r\nCookie: PHPSESSID=973d74b6e7628daa52211632267b00ba\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: private, max-age=3600, must-revalidate\r\ncontent-encoding: gzip\r\ncontent-type: text/css;charset=UTF-8\r\ndate: Sat, 05 Sep 2026 02:18:14 GMT\r\nvary: Accept-Encoding\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-05T03:58:35.283591Z","times_seen":18285635,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"telegram-premiuma.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"telegram-premiuma.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/ibyw3cqxgxog.js","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812?swfix=1","date":"2026-09-05T02:18:17.378Z","timestamp":1788574697378,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegram-premiuma.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 20 Aug 2026 13:03:55 GMT","end":"Wed, 18 Nov 2026 13:03:54 GMT"},"fingerprint":{"sha1":"B2:17:4B:E9:D3:06:9F:8E:37:18:3D:02:E4:A3:BC:87:68:22:07:A5","sha256":"D2:AD:1D:5B:0A:8B:60:55:6F:18:10:D4:BA:B8:C0:3E:8F:6A:55:62:4A:F9:CE:6E:47:D8:F5:F5:9B:CD:28:A1"}}},"request":{"raw":"GET /bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/ibyw3cqxgxog.js HTTP/1.1\r\nHost: telegram-premiuma.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812?swfix=1\r\nCookie: PHPSESSID=973d74b6e7628daa52211632267b00ba\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: private, max-age=3600, must-revalidate\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Sat, 05 Sep 2026 02:18:17 GMT\r\nvary: Accept-Encoding\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":368835,"size_decoded":124105,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65500), with no line terminators","md5":"bba270f5fac7c55a39d17fc9b7d3aec4","sha1":"70d2896fb4bfa2427828a9efeb80051ef34169cc","sha256":"c3c8d557e7981d42b3fe4c4b36eb96e3a1933b91a9a034cdf2ff56c71963ea44","sha512":"452e0750c30ae60c032bbe768c6cb999509ed802373788f6019506d2404d4c1edc12f6956000db7ee754e9607aab04355a894ebc85cbff551677f31df67fbce7","ssdeep":"6144:6sgUA8UiUXEVYLq6XE5qK3U9JZilO7resFG0FcfFDYo:6sgUp2LnAcZdhGwo","tlshash":"c974938263c05849565bdfbb3b2bb5e0e5152e5e7b80085ff2007eb4ede4522aad4f31","first_seen":"2026-09-05T02:18:59.543551Z","last_seen":"2026-09-05T02:18:59.543551Z","times_seen":1,"resource_available":true,"data":null}},"time_used":113,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":113,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-09-05","alert":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","trigger":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/ibyw3cqxgxog.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"@imp0rtp3 (modified by Florian Roth)","date":"2020-09-06","description":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","reference":"https://imp0rtp3.wordpress.com/2021/08/12/tetris","rule":"apt_CN_Tetris_JS_advanced_1"}},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"telegram-premiuma.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"telegram-premiuma.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/1xahgwbu4ko3.css","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812","date":"2026-09-05T02:18:15.264Z","timestamp":1788574695264,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegram-premiuma.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 20 Aug 2026 13:03:55 GMT","end":"Wed, 18 Nov 2026 13:03:54 GMT"},"fingerprint":{"sha1":"B2:17:4B:E9:D3:06:9F:8E:37:18:3D:02:E4:A3:BC:87:68:22:07:A5","sha256":"D2:AD:1D:5B:0A:8B:60:55:6F:18:10:D4:BA:B8:C0:3E:8F:6A:55:62:4A:F9:CE:6E:47:D8:F5:F5:9B:CD:28:A1"}}},"request":{"raw":"GET /bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/1xahgwbu4ko3.css HTTP/1.1\r\nHost: telegram-premiuma.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812\r\nCookie: PHPSESSID=973d74b6e7628daa52211632267b00ba\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: private, max-age=3600, must-revalidate\r\ncontent-encoding: gzip\r\ncontent-type: text/css;charset=UTF-8\r\ndate: Sat, 05 Sep 2026 02:18:15 GMT\r\nvary: Accept-Encoding\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":11253,"size_decoded":3852,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text, with very long lines (11253), with no line terminators","md5":"5735b2c1d3095150921f5c731b2f137a","sha1":"f12e2ca4c511ac1ba3b061bcee3340882d748509","sha256":"a384bf557671dc837ef1bbda5c2f821992560f0b6cba8bfdd63f39885a67d904","sha512":"581151dc1cc05526160e9a401ece497f1e7511a663718ec5040bba943ab54a0f10ecf0f094db59ba3bc62be9ad7b19df6adf64937e1537dd4fe8da91e3c28a7b","ssdeep":"192:ThC0kdc7STB5C+yJio220h1wcWPrwU3BRCjGFJquaM4XTByp+9Nn:teW5Q1wcWPrwU3BaGmuXQNn","tlshash":"ae3287f6e7aca03f783ed467a8855ade22149816dd3727dbfa55e52c40c72731120b48","first_seen":"2026-09-04T07:11:34.78178Z","last_seen":"2026-09-05T02:18:59.526026Z","times_seen":2,"resource_available":false,"data":null}},"time_used":125,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":125,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"telegram-premiuma.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"telegram-premiuma.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/assets/fonts/5aaa5a46.woff2","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812?swfix=1","date":"2026-09-05T02:18:16.227Z","timestamp":1788574696227,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegram-premiuma.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 20 Aug 2026 13:03:55 GMT","end":"Wed, 18 Nov 2026 13:03:54 GMT"},"fingerprint":{"sha1":"B2:17:4B:E9:D3:06:9F:8E:37:18:3D:02:E4:A3:BC:87:68:22:07:A5","sha256":"D2:AD:1D:5B:0A:8B:60:55:6F:18:10:D4:BA:B8:C0:3E:8F:6A:55:62:4A:F9:CE:6E:47:D8:F5:F5:9B:CD:28:A1"}}},"request":{"raw":"GET /bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/assets/fonts/5aaa5a46.woff2 HTTP/1.1\r\nHost: telegram-premiuma.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/if2otukoi3s9.css\r\nCookie: PHPSESSID=973d74b6e7628daa52211632267b00ba\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\ncache-control: private, max-age=3600, must-revalidate\r\ncontent-type: font/woff2\r\ndate: Sat, 05 Sep 2026 02:18:16 GMT\r\ncontent-length: 11016\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":11016,"size_decoded":11214,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 11016, version 1.0","md5":"15fa3062f8929bd3b05fdca5259db412","sha1":"6ff06a34f68ad0324ddec1bbe4d453c959178b36","sha256":"5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479","sha512":"07e96d7520b4ede158e77bef10a01a33cd8be7d263fe6900f89c023e65e4a63570e8a442dec2e96030fb563b25610005a748d48f9330fd31eb91b37d1003d376","ssdeep":"192:Tysuo7z1NVoTUYAKVOO7YVxRwHQUXFI5xoBwH9f4d9QFmOfiS:TvdvVoTSjOYR4QUVIgBwpFLaS","tlshash":"6e32af8071ff1c50ff85c2f69be68efa2c2b1895c619016f5240b476397525e9c294bb","first_seen":"2023-04-05T09:25:54Z","last_seen":"2026-09-05T02:18:59.544707Z","times_seen":34655,"resource_available":false,"data":null}},"time_used":121,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":121,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"telegram-premiuma.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"telegram-premiuma.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/assets/fonts/e0a88b3a.woff2","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812?swfix=1","date":"2026-09-05T02:18:17.554Z","timestamp":1788574697554,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegram-premiuma.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 20 Aug 2026 13:03:55 GMT","end":"Wed, 18 Nov 2026 13:03:54 GMT"},"fingerprint":{"sha1":"B2:17:4B:E9:D3:06:9F:8E:37:18:3D:02:E4:A3:BC:87:68:22:07:A5","sha256":"D2:AD:1D:5B:0A:8B:60:55:6F:18:10:D4:BA:B8:C0:3E:8F:6A:55:62:4A:F9:CE:6E:47:D8:F5:F5:9B:CD:28:A1"}}},"request":{"raw":"GET /bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/assets/fonts/e0a88b3a.woff2 HTTP/1.1\r\nHost: telegram-premiuma.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/if2otukoi3s9.css\r\nCookie: PHPSESSID=973d74b6e7628daa52211632267b00ba\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\ncache-control: private, max-age=3600, must-revalidate\r\ncontent-type: font/woff2\r\ndate: Sat, 05 Sep 2026 02:18:17 GMT\r\ncontent-length: 11056\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":11056,"size_decoded":11254,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 11056, version 1.0","md5":"07db243db21ed0a6b4ff05ff429686b7","sha1":"5d62925fdd7ed8e80f206d095ed093994f13d276","sha256":"ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e","sha512":"d34d15e91ba706886f7b098b5a42b3e31d374fda47d6e873f10b40fbea78d848921d124fc17045e77c432bcf2b4d4adfe5aeca4c3122cec199ac92e3124541ec","ssdeep":"192:duC8R1LnQKFt7DX2XFEu+zjdNr/ucPDf/Teifn/m1t7w9vxUBpZRCo++TkXT0R97:dL8bQKFt32XF/+zhNr/uS6i+tU9v6RCM","tlshash":"9d32bf0731ed12a1f9e8b3b1b9adc3490ce275f00bbc52da8669787ed43660e95d0078","first_seen":"2023-04-05T09:25:54Z","last_seen":"2026-09-05T02:18:59.545346Z","times_seen":7986,"resource_available":false,"data":null}},"time_used":122,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":122,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"telegram-premiuma.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"telegram-premiuma.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/assets/fonts/4d59fe39.woff2","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812?swfix=1","date":"2026-09-05T02:18:19.094Z","timestamp":1788574699094,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegram-premiuma.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 20 Aug 2026 13:03:55 GMT","end":"Wed, 18 Nov 2026 13:03:54 GMT"},"fingerprint":{"sha1":"B2:17:4B:E9:D3:06:9F:8E:37:18:3D:02:E4:A3:BC:87:68:22:07:A5","sha256":"D2:AD:1D:5B:0A:8B:60:55:6F:18:10:D4:BA:B8:C0:3E:8F:6A:55:62:4A:F9:CE:6E:47:D8:F5:F5:9B:CD:28:A1"}}},"request":{"raw":"GET /bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/assets/fonts/4d59fe39.woff2 HTTP/1.1\r\nHost: telegram-premiuma.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/if2otukoi3s9.css\r\nCookie: PHPSESSID=973d74b6e7628daa52211632267b00ba\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\ncache-control: private, max-age=3600, must-revalidate\r\ncontent-type: font/woff2\r\ndate: Sat, 05 Sep 2026 02:18:19 GMT\r\ncontent-length: 6720\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":6720,"size_decoded":6917,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 6720, version 1.0","md5":"ddbe8450ae34795dee574854e9b01533","sha1":"5c9aaeb1b9de21b0fb4c7d9b92276dc5ab81b8ab","sha256":"daf6c28c5a080458eba26ba64a95b1fcff823944d429ccb84e8a4f3a0baf05ca","sha512":"df3d13f930835b6dd7946612f71e4a55115d64eb0c5202f81d43df6e7fd1f0602bb31b3ef73cc386e2b6f3b33ecd83b06cf580e734f04e1a87dd2c0462d92479","ssdeep":"192:GUXoJC3HQRHnOj14WFTGX1XX1s1G3LH0X0+P:1oPk14g6RDr0X0c","tlshash":"60d19ee4f9d467dce608ae23e704732e97430633c952fbb5825699a49c42607fece1e0","first_seen":"2023-04-05T09:25:54Z","last_seen":"2026-09-05T02:18:59.545997Z","times_seen":3046,"resource_available":false,"data":null}},"time_used":141,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":141,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"telegram-premiuma.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"telegram-premiuma.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/n3cq8sp3tq48.js","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812?swfix=1","date":"2026-09-05T02:18:17.244Z","timestamp":1788574697244,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegram-premiuma.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 20 Aug 2026 13:03:55 GMT","end":"Wed, 18 Nov 2026 13:03:54 GMT"},"fingerprint":{"sha1":"B2:17:4B:E9:D3:06:9F:8E:37:18:3D:02:E4:A3:BC:87:68:22:07:A5","sha256":"D2:AD:1D:5B:0A:8B:60:55:6F:18:10:D4:BA:B8:C0:3E:8F:6A:55:62:4A:F9:CE:6E:47:D8:F5:F5:9B:CD:28:A1"}}},"request":{"raw":"GET /bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/n3cq8sp3tq48.js HTTP/1.1\r\nHost: telegram-premiuma.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812?swfix=1\r\nCookie: PHPSESSID=973d74b6e7628daa52211632267b00ba\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: private, max-age=3600, must-revalidate\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Sat, 05 Sep 2026 02:18:17 GMT\r\nvary: Accept-Encoding\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":3017,"size_decoded":1510,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (3017), with no line terminators","md5":"317c23c3acb9a6e84f145e0d7b397ad8","sha1":"16ab52f0e7551f2452c37bd14d56654ae39bf53e","sha256":"faa09bb4a35682602df3dc483d23e9a51e0defce10117f8fcbe61615a616f5fe","sha512":"0486ac475c8acf60fadd2567d03fadb0eb94d234734b50ee673fb2cd814a0ce58100e7dd256b78e721a2e68d8e85c6556d8a90f55854ee78e4c35439b162a21e","ssdeep":"","tlshash":"03512504abc05a915317bfeb3a1eb8e0ed167caa3b454586f2557ef8fc54811c5a0f30","first_seen":"2026-09-05T02:18:59.546667Z","last_seen":"2026-09-05T02:18:59.546667Z","times_seen":1,"resource_available":true,"data":null}},"time_used":118,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":118,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"telegram-premiuma.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"telegram-premiuma.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/if2otukoi3s9.css","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812?swfix=1","date":"2026-09-05T02:18:15.970Z","timestamp":1788574695970,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegram-premiuma.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 20 Aug 2026 13:03:55 GMT","end":"Wed, 18 Nov 2026 13:03:54 GMT"},"fingerprint":{"sha1":"B2:17:4B:E9:D3:06:9F:8E:37:18:3D:02:E4:A3:BC:87:68:22:07:A5","sha256":"D2:AD:1D:5B:0A:8B:60:55:6F:18:10:D4:BA:B8:C0:3E:8F:6A:55:62:4A:F9:CE:6E:47:D8:F5:F5:9B:CD:28:A1"}}},"request":{"raw":"GET /bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/if2otukoi3s9.css HTTP/1.1\r\nHost: telegram-premiuma.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812?swfix=1\r\nCookie: PHPSESSID=973d74b6e7628daa52211632267b00ba\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: private, max-age=3600, must-revalidate\r\ncontent-encoding: gzip\r\ncontent-type: text/css;charset=UTF-8\r\ndate: Sat, 05 Sep 2026 02:18:16 GMT\r\nvary: Accept-Encoding\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":908793,"size_decoded":258150,"mime_type":"text/css; charset=UTF-8","magic":"Unicode text, UTF-8 text, with very long lines (65534), with no line terminators","md5":"5bee4a67cf253fabea2589d99828f3e4","sha1":"227139a22b71910db13a8a7ec52b5af54f8b24df","sha256":"8d0cfcbb9e0bae090677b5aa21caa57321a6660671f6f0cc6053aa5f7bc10c6d","sha512":"f8cc42433888ab9cb8f4c49d6a96699c065f57bf2ef9c671c2eae200db419d3734a3578042eebc9d9b9193ff1d4887e63dd8aee50bf3366f4ad52eb7f7743480","ssdeep":"24576:HJY2xXf8PQhqMrxJ1axWJEci10/qQDjii6fTtx2OZQWPbuNmlXlFAV1ZRdSz7aKz:mqHJAhIFcPrcmPg1ZRdSz7aKUa5GMO4V","tlshash":"c8150b759790303ce437c63a7ad4abcc1138d881ee234badf157a625c2c76e62636b4d","first_seen":"2026-09-04T07:11:34.727315Z","last_seen":"2026-09-05T02:18:59.517328Z","times_seen":2,"resource_available":false,"data":null}},"time_used":127,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":127,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"telegram-premiuma.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"telegram-premiuma.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/kpeoip5hxvx5.js","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812?swfix=1","date":"2026-09-05T02:18:17.242Z","timestamp":1788574697242,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegram-premiuma.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 20 Aug 2026 13:03:55 GMT","end":"Wed, 18 Nov 2026 13:03:54 GMT"},"fingerprint":{"sha1":"B2:17:4B:E9:D3:06:9F:8E:37:18:3D:02:E4:A3:BC:87:68:22:07:A5","sha256":"D2:AD:1D:5B:0A:8B:60:55:6F:18:10:D4:BA:B8:C0:3E:8F:6A:55:62:4A:F9:CE:6E:47:D8:F5:F5:9B:CD:28:A1"}}},"request":{"raw":"GET /bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/kpeoip5hxvx5.js HTTP/1.1\r\nHost: telegram-premiuma.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812?swfix=1\r\nCookie: PHPSESSID=973d74b6e7628daa52211632267b00ba\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: private, max-age=3600, must-revalidate\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Sat, 05 Sep 2026 02:18:17 GMT\r\nvary: Accept-Encoding\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":16277,"size_decoded":5261,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (16277), with no line terminators","md5":"b4607642067a984ccb3a3f438fbf86c7","sha1":"6b29c1527d763a8417bbf4e6809bb1a71bb494f9","sha256":"b62e6aa9f407c31101fe6f886188427fcb213c2c84512bbefbcbf0bfbd6eedf6","sha512":"01265341f7486d92250b9d4da49b65d3b79bc062cb72e23fd66249797454958668bb321851a6574b0c7c3cc3d4579f09f8145cb314123a10ec7e6f6ca0824b6a","ssdeep":"384:8I2YsAa0BR+RHp5AYZaAToW3Vw4Hm6KN4s2vK3kIJk:86sA9IHnAYZ/ToW3Vw4Hm6KN4s2wkIJk","tlshash":"5372cf62f340aa251317dfde323e74f5c62e75d4b5041c8be118aeb86ec9325da80e78","first_seen":"2026-09-04T07:11:34.829417Z","last_seen":"2026-09-05T02:18:59.548673Z","times_seen":2,"resource_available":true,"data":null}},"time_used":111,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":111,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"telegram-premiuma.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"telegram-premiuma.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/assets/fonts/d1564982.woff2","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812?swfix=1","date":"2026-09-05T02:18:19.097Z","timestamp":1788574699097,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegram-premiuma.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 20 Aug 2026 13:03:55 GMT","end":"Wed, 18 Nov 2026 13:03:54 GMT"},"fingerprint":{"sha1":"B2:17:4B:E9:D3:06:9F:8E:37:18:3D:02:E4:A3:BC:87:68:22:07:A5","sha256":"D2:AD:1D:5B:0A:8B:60:55:6F:18:10:D4:BA:B8:C0:3E:8F:6A:55:62:4A:F9:CE:6E:47:D8:F5:F5:9B:CD:28:A1"}}},"request":{"raw":"GET /bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/assets/fonts/d1564982.woff2 HTTP/1.1\r\nHost: telegram-premiuma.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/if2otukoi3s9.css\r\nCookie: PHPSESSID=973d74b6e7628daa52211632267b00ba\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\ncache-control: private, max-age=3600, must-revalidate\r\ncontent-type: font/woff2\r\ndate: Sat, 05 Sep 2026 02:18:19 GMT\r\ncontent-length: 6864\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":6864,"size_decoded":7061,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 6864, version 1.0","md5":"2efb23d70eb9a590216a126ce28120b0","sha1":"27786db7735f04a4d59ad023fd327d2dea51ae68","sha256":"af2fdef955568dc79de38bfb097d53586855945811b638d6c41513bd62e25cc4","sha512":"3e7e08d638dfc4ff416b697684369e067e1e2acb127c637bec664915cc35ccc9d5124c321a34efe0d6a5c3185a9ba7b87ce1012005c1d11421faa889ebf960e8","ssdeep":"192:pByZoVsKss/uL0j5SV1uOVEBMGU/KDKzDy9X:jqoVsKs4OV1u/BMGxKXi","tlshash":"1ee19fd508741543f563b238abd648e244d3c4b7a9648f7daf23beda8f534cc655a304","first_seen":"2023-04-05T09:25:54Z","last_seen":"2026-09-05T02:18:59.550018Z","times_seen":938,"resource_available":false,"data":null}},"time_used":107,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":107,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"telegram-premiuma.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"telegram-premiuma.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/assets/fonts/203e2ad5.woff2","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812?swfix=1","date":"2026-09-05T02:18:19.099Z","timestamp":1788574699099,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegram-premiuma.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 20 Aug 2026 13:03:55 GMT","end":"Wed, 18 Nov 2026 13:03:54 GMT"},"fingerprint":{"sha1":"B2:17:4B:E9:D3:06:9F:8E:37:18:3D:02:E4:A3:BC:87:68:22:07:A5","sha256":"D2:AD:1D:5B:0A:8B:60:55:6F:18:10:D4:BA:B8:C0:3E:8F:6A:55:62:4A:F9:CE:6E:47:D8:F5:F5:9B:CD:28:A1"}}},"request":{"raw":"GET /bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/assets/fonts/203e2ad5.woff2 HTTP/1.1\r\nHost: telegram-premiuma.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/if2otukoi3s9.css\r\nCookie: PHPSESSID=973d74b6e7628daa52211632267b00ba\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\ncache-control: private, max-age=3600, must-revalidate\r\ncontent-type: font/woff2\r\ndate: Sat, 05 Sep 2026 02:18:19 GMT\r\ncontent-length: 7924\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":7924,"size_decoded":8121,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 7924, version 1.0","md5":"5d39c40b5f1d878434af6212575d928a","sha1":"3485c7ae4231075e5b7424e73c8626fdca02e0ad","sha256":"ac4f45c63e7192b1c9fb64be19be7a03084e16dc33b4dcfedabb44cb390c25a2","sha512":"73581028d18043e12b9cfddcb0aa71ae9d1c2d3a15bea5f1b42ef3e5e4fddf25cb79b40f3e2bf8df6890898be5107ce248ff19975a95708722a549d6989ef1c7","ssdeep":"192:IRFKfEAqGPtHBNsEE8e9LwqjpYOeXDsIu4zxLWvwo1:uakn8nSpYhH6vww","tlshash":"a8f1c012dc3103f1d4e8b071e4ae0573dac7a39b289d933eafc29e6951359f1a1b1162","first_seen":"2023-05-11T08:48:15Z","last_seen":"2026-09-05T02:18:59.55578Z","times_seen":985,"resource_available":false,"data":null}},"time_used":136,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":136,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"telegram-premiuma.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"telegram-premiuma.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/kompuwfks7is.js","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812","date":"2026-09-05T02:18:15.216Z","timestamp":1788574695216,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegram-premiuma.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 20 Aug 2026 13:03:55 GMT","end":"Wed, 18 Nov 2026 13:03:54 GMT"},"fingerprint":{"sha1":"B2:17:4B:E9:D3:06:9F:8E:37:18:3D:02:E4:A3:BC:87:68:22:07:A5","sha256":"D2:AD:1D:5B:0A:8B:60:55:6F:18:10:D4:BA:B8:C0:3E:8F:6A:55:62:4A:F9:CE:6E:47:D8:F5:F5:9B:CD:28:A1"}}},"request":{"raw":"GET /bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/kompuwfks7is.js HTTP/1.1\r\nHost: telegram-premiuma.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=973d74b6e7628daa52211632267b00ba\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: private, max-age=3600, must-revalidate\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Sat, 05 Sep 2026 02:18:15 GMT\r\nvary: Accept-Encoding\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":314613,"size_decoded":102946,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"c934251956216941804125247192d498","sha1":"3c789a45ebae0616fcce06d946fac1dbbd5146bc","sha256":"879569b9bf908093c90d6c2df326f1e436b347049563dc6086de548243d3ec7c","sha512":"061b86911b744a908dd5193809bc939fe404ad206e5f9e6790b87f9c2c482177a81d3dc72e8236af4e449fa1784b7ca2bdceb58cdb8bb40f7c155d2eaec58de0","ssdeep":"6144:KD8OOvuYRbSmlPi0kg4sNCrHsraGDDPS1K3Cez6a:2QuYRbSmlwCiHnG4ezN","tlshash":"45647141a3c04845676bcfbb372bb6e1f4095daeba41085bf104bfb4ed99122de90e71","first_seen":"2026-09-04T07:11:34.763669Z","last_seen":"2026-09-05T02:18:59.557492Z","times_seen":2,"resource_available":false,"data":null}},"time_used":123,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":123,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-09-05","alert":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","trigger":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/kompuwfks7is.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"@imp0rtp3 (modified by Florian Roth)","date":"2020-09-06","description":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","reference":"https://imp0rtp3.wordpress.com/2021/08/12/tetris","rule":"apt_CN_Tetris_JS_advanced_1"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"telegram-premiuma.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"telegram-premiuma.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-05T02:18:14.094Z","timestamp":1788574694094,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegram-premiuma.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 20 Aug 2026 13:03:55 GMT","end":"Wed, 18 Nov 2026 13:03:54 GMT"},"fingerprint":{"sha1":"B2:17:4B:E9:D3:06:9F:8E:37:18:3D:02:E4:A3:BC:87:68:22:07:A5","sha256":"D2:AD:1D:5B:0A:8B:60:55:6F:18:10:D4:BA:B8:C0:3E:8F:6A:55:62:4A:F9:CE:6E:47:D8:F5:F5:9B:CD:28:A1"}}},"request":{"raw":"GET /976cb069dbe6ab0729efa766e63c0812 HTTP/1.1\r\nHost: telegram-premiuma.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: no-store, no-cache, must-revalidate\r\ncontent-encoding: gzip\r\ncontent-type: text/html; charset=UTF-8\r\ndate: Sat, 05 Sep 2026 02:18:14 GMT\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\npragma: no-cache\r\nset-cookie: PHPSESSID=973d74b6e7628daa52211632267b00ba; path=/; secure; HttpOnly; SameSite=None\r\nvary: Accept-Encoding\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"PHPSESSID","value":"973d74b6e7628daa52211632267b00ba","quoted":false,"path":"/","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"PHPSESSID=973d74b6e7628daa52211632267b00ba; path=/; secure; HttpOnly; SameSite=None"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":22790,"size_decoded":9100,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (4507)","md5":"574c138b656d484e4aa17209f5d550b0","sha1":"4b773a46d738c26595ffae424391bea6874753e0","sha256":"9c5b9b499217eb8132be4ecc2bdd22e9e1ffe2d425afb90b12f64f92f645f9ba","sha512":"68f219a5143f7c24547baf7fc19c6fb626d005999b75c6e32296a9ab5e488bcd3747a6ed51583aacae1c05131580406a6e77cd825f477b9374cf6d1d559131f3","ssdeep":"384:9sKB41wsUedJaBzp3b9+f3U3u//EGZn5iiL5S2:iKBQw6Ja9lGk3g/Ek5rdS2","tlshash":"d2a2097145f400aa6103f249ee196f0e2f5694ffaf5a032072bc2ea5bff38d4c91a914","first_seen":"2026-09-05T02:18:59.559322Z","last_seen":"2026-09-05T02:18:59.559322Z","times_seen":1,"resource_available":false,"data":null}},"time_used":247,"timings":{"blocked":-1,"dns":13,"connect":41,"send":0,"wait":126,"receive":0,"ssl":66},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"telegram-premiuma.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"telegram-premiuma.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/747biwsusmw5.js","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812","date":"2026-09-05T02:18:15.261Z","timestamp":1788574695261,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegram-premiuma.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 20 Aug 2026 13:03:55 GMT","end":"Wed, 18 Nov 2026 13:03:54 GMT"},"fingerprint":{"sha1":"B2:17:4B:E9:D3:06:9F:8E:37:18:3D:02:E4:A3:BC:87:68:22:07:A5","sha256":"D2:AD:1D:5B:0A:8B:60:55:6F:18:10:D4:BA:B8:C0:3E:8F:6A:55:62:4A:F9:CE:6E:47:D8:F5:F5:9B:CD:28:A1"}}},"request":{"raw":"GET /bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/747biwsusmw5.js HTTP/1.1\r\nHost: telegram-premiuma.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812\r\nCookie: PHPSESSID=973d74b6e7628daa52211632267b00ba\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: private, max-age=3600, must-revalidate\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Sat, 05 Sep 2026 02:18:15 GMT\r\nvary: Accept-Encoding\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":1702297,"size_decoded":541423,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (64158), with no line terminators","md5":"e40373012675a754a9ef24a783a2ed4a","sha1":"59df12d9ae9fb9a41cb612ddc0d36fb8e30f4be3","sha256":"13c09250e3c5778f1c01606708ba0a5770ecb6600907c809d8546d05877da5d5","sha512":"97e7f9f72ee93292f84968d728d9f3ff63cc984a71644398baee3400297942160358d97c3a93fd76b765a31cd74e9e816f5edc7c66a8745999a81fdd341c977e","ssdeep":"24576:7qy0JGJ2jgzwHlCjGVzPCdliM2GLuRinTlNXORXgOQJaGri7:7qJg8HlCjGVzPCdliM2GL5NeRXgOQJaz","tlshash":"f3251e2297c52c203217ef77b626b6d1f61118593b4c185bd4083fb8ee89236b9f5db2","first_seen":"2026-09-04T07:11:34.787578Z","last_seen":"2026-09-05T02:18:59.538538Z","times_seen":2,"resource_available":false,"data":null}},"time_used":111,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":111,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"telegram-premiuma.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"telegram-premiuma.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/kompuwfks7is.js","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812?swfix=1","date":"2026-09-05T02:18:16.436Z","timestamp":1788574696436,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegram-premiuma.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 20 Aug 2026 13:03:55 GMT","end":"Wed, 18 Nov 2026 13:03:54 GMT"},"fingerprint":{"sha1":"B2:17:4B:E9:D3:06:9F:8E:37:18:3D:02:E4:A3:BC:87:68:22:07:A5","sha256":"D2:AD:1D:5B:0A:8B:60:55:6F:18:10:D4:BA:B8:C0:3E:8F:6A:55:62:4A:F9:CE:6E:47:D8:F5:F5:9B:CD:28:A1"}}},"request":{"raw":"GET /bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/kompuwfks7is.js HTTP/1.1\r\nHost: telegram-premiuma.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812?swfix=1\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=973d74b6e7628daa52211632267b00ba\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: private, max-age=3600, must-revalidate\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Sat, 05 Sep 2026 02:18:16 GMT\r\nvary: Accept-Encoding\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":314613,"size_decoded":102946,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"c934251956216941804125247192d498","sha1":"3c789a45ebae0616fcce06d946fac1dbbd5146bc","sha256":"879569b9bf908093c90d6c2df326f1e436b347049563dc6086de548243d3ec7c","sha512":"061b86911b744a908dd5193809bc939fe404ad206e5f9e6790b87f9c2c482177a81d3dc72e8236af4e449fa1784b7ca2bdceb58cdb8bb40f7c155d2eaec58de0","ssdeep":"6144:KD8OOvuYRbSmlPi0kg4sNCrHsraGDDPS1K3Cez6a:2QuYRbSmlwCiHnG4ezN","tlshash":"45647141a3c04845676bcfbb372bb6e1f4095daeba41085bf104bfb4ed99122de90e71","first_seen":"2026-09-04T07:11:34.763669Z","last_seen":"2026-09-05T02:18:59.557492Z","times_seen":2,"resource_available":false,"data":null}},"time_used":121,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":121,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-09-05","alert":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","trigger":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/kompuwfks7is.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"@imp0rtp3 (modified by Florian Roth)","date":"2020-09-06","description":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","reference":"https://imp0rtp3.wordpress.com/2021/08/12/tetris","rule":"apt_CN_Tetris_JS_advanced_1"}},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"telegram-premiuma.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"telegram-premiuma.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram-premiuma.com/bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/xgyhts3s0118.js","fqdn":"telegram-premiuma.com","domain":"telegram-premiuma.com","tld":"com"},"ip":{"addr":"144.31.53.157","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812?swfix=1","date":"2026-09-05T02:18:17.237Z","timestamp":1788574697237,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegram-premiuma.com","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 20 Aug 2026 13:03:55 GMT","end":"Wed, 18 Nov 2026 13:03:54 GMT"},"fingerprint":{"sha1":"B2:17:4B:E9:D3:06:9F:8E:37:18:3D:02:E4:A3:BC:87:68:22:07:A5","sha256":"D2:AD:1D:5B:0A:8B:60:55:6F:18:10:D4:BA:B8:C0:3E:8F:6A:55:62:4A:F9:CE:6E:47:D8:F5:F5:9B:CD:28:A1"}}},"request":{"raw":"GET /bdd0fb44597a99577acdff567f900db4899a8a2dc035627552f10c061b7d7be0/Ihd3lYV/xgyhts3s0118.js HTTP/1.1\r\nHost: telegram-premiuma.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://telegram-premiuma.com/976cb069dbe6ab0729efa766e63c0812?swfix=1\r\nCookie: PHPSESSID=973d74b6e7628daa52211632267b00ba\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: private, max-age=3600, must-revalidate\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\ndate: Sat, 05 Sep 2026 02:18:17 GMT\r\nvary: Accept-Encoding\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":26267,"size_decoded":9885,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (26267), with no line terminators","md5":"57aee72c35b72ff479df47293c9e72b8","sha1":"6f2c2d50eed20dd025ec409f7f405c7f3295825d","sha256":"3ba9659bb13af0bd9ef80aa0dde6b13f1c7d2cd9e19fbd16f29fea978211cefd","sha512":"88f169fcd8c598e4faa1a663d6527ba6ed3d31b5daa5b2031a99911b7f597f07836aeaa71061f69e77b02a9dfd52060d88b1900b08b6124edc153ae0a05fa47e","ssdeep":"768:/dJC913uEGN7utz57CYRJR0ErBXZjBipgkQmUSgegjYWIs4BkRHqNKg:r5mJCIRhreW6s4qHM","tlshash":"ccc28440f3804496a7078fb7b71ab9d4d51aa85d7341498be6187f78fd8a622caf1f30","first_seen":"2026-09-05T02:18:59.560583Z","last_seen":"2026-09-05T02:18:59.560583Z","times_seen":1,"resource_available":true,"data":null}},"time_used":112,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":112,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"telegram-premiuma.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"telegram-premiuma.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}}]}