WEBSITE ANALYSIS REPORT

http://r.gettrustpayment.live

04 Apr 2026 · 18:16:50.000 UTCpublic

Report tags: suspicious
Submit tags

Request review

Suspicious activity

5 detections · review the detection signals

Review evidence →

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

18:16:27.899 GET 200 document 117.8 KB 430 ms —

18:16:28.375 GET 200 stylesheet 32.6 KB 46 ms —

18:16:28.377 GET 200 script 742.4 KB 200 ms —

18:16:28.378 GET 200 script 1.39 MB 220 ms —

18:16:28.379 GET 200 script 30.4 KB 162 ms —

18:16:28.380 GET 200 script 78.1 KB 158 ms —

18:16:28.381 GET 200 script 71.1 KB 125 ms —

18:16:28.382 GET 200 script 15.5 KB 188 ms —

18:16:28.384 GET 200 script 315.5 KB 366 ms —

18:16:28.385 GET 200 script 13.2 KB 198 ms —

18:16:28.386 GET 200 script 1.96 MB 556 ms —

18:16:28.388 GET 200 img 108.5 KB 723 ms —

18:16:28.390 GET 200 img 715.4 KB 792 ms —

18:16:28.391 GET 200 img 27.5 KB 581 ms —

18:16:28.392 GET 200 img 532.1 KB 819 ms —

18:16:28.392 GET 200 script 57.6 KB 90 ms 2 alerts

Transaction #23

Request / response

URL

GET HTTPS

https://r.gettrustpayment.live/scripts/main.js

IP / ASN

185.246.190.216

Unknown

Requested by: https://r.gettrustpayment.live/

Resource information

File type: JavaScript source, Unicode text, UTF-8 text, with very long lines (6612)
MIME type: application/javascript; charset=UTF-8
First seen (UTC): 04 Apr 2026 · 18:14:10.982 UTC
Last seen (UTC): 04 Apr 2026 · 18:18:47.579 UTC
Times seen: 11

Size: 57.6 KB (58994 bytes)
MD5: be74d30d53f8d4b554b04d368560d5c5
SHA1: 635bd00872b531516f858786948a84020c969ba9
SHA256: 366796a91dea65f808b6b920109d5974a253f9d2f74e72f735bfcfbaf06c5c5d

Certificate information

Issuer: Let's Encrypt · E8
Subject: gettrustpayment.live
Protocol / cipher: TLSv1.3 · TLS_AES_128_GCM_SHA256
SHA1 fingerprint: F1:81:6D:67:DA:FF:82:EB:FB:76:1D:63:10:4D:05:EA:86:9C:91:B5
Valid from: Sat, 04 Apr 2026 17:10:15 GMT
Valid until: Fri, 03 Jul 2026 17:10:14 GMT

Technology fingerprints

Express (Web frameworks, Web servers)
Node.js (Programming languages)
Ubuntu (Operating systems)
Nginx:1.24.0 (Web servers, Reverse proxies)

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
urlquery Suspicious - Suspicious Javascript code	medium	Suspicious
YARAhub by abuse.ch Detects file containing Telegram Bot API	medium	malware

HTTP headers

Request headers

GET /scripts/main.js HTTP/1.1
Host: r.gettrustpayment.live
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://r.gettrustpayment.live/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/1.1 200 OK
Server: nginx/1.24.0 (Ubuntu)
Date: Sat, 04 Apr 2026 18:16:28 GMT
Content-Type: application/javascript; charset=UTF-8
Content-Length: 58994
Connection: keep-alive
X-Powered-By: Express
Accept-Ranges: bytes
Cache-Control: public, max-age=0
Last-Modified: Sat, 04 Apr 2026 17:33:28 GMT
ETag: W/"e672-19d598e8f16"

18:16:28.414 GET 200 stylesheet 16.4 KB 392 ms —

18:16:28.416 GET 200 stylesheet 7.4 KB 412 ms —

18:16:29.269 GET 200 script 71.1 KB 17 ms —

18:16:29.340 GET 200 font 42.1 KB 283 ms —

18:16:29.341 GET 200 font 42.1 KB 353 ms —

18:16:29.391 OPTIONS 204 fetch 0 B 417 ms —

18:16:29.636 POST 200 fetch 40 B 29 ms —

18:16:29.649 GET 200 img 854 B 47 ms —

http://r.gettrustpayment.live

Domain graph

Hostnames

Connections