{"report_id":"c1012bb9-5792-464b-930e-20629a35be50","version":6,"status":"done","tags":["suspicious","telegram_bot"],"date":"2026-03-10T08:26:14Z","url":{"schema":"https","addr":"151-242-2-118.cprapid.com/dico.htm","fqdn":"151-242-2-118.cprapid.com","domain":"151-242-2-118.cprapid.com","tld":"cprapid.com"},"ip":{"addr":"151.242.2.118","port":0,"asn":205647,"as":"Pardis Fanvari Partak Ltd","country":"Iran","country_code":"IR"},"final":{"url":{"schema":"https","addr":"151-242-2-118.cprapid.com/dico.htm","fqdn":"151-242-2-118.cprapid.com","domain":"151-242-2-118.cprapid.com","tld":"cprapid.com"},"title":"Secure Account Login","dom":{"size":32526,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (20296)","md5":"9978cb349ac8e007419691f3aa66c691","sha1":"bc331d564245636e36f027ffbe3218cbe1ccc2ae","sha256":"de389ad61069df2cfd027693a54ed5803accf8b9197bc51f08c0a3c9760d7a4a","sha512":"6fc8424a2ccf619b8142f1b4878f109abb42cb676a96e22e70d2ba664273a187aa5d7ee85cdb717604a2b48cb8cc3b4a9cb516b44eefd06929dc3a2a6e8da02f","ssdeep":"768:F75H0aLPneLST2nhLSTFFCnvnwLSTFFCnIczqen8CDOpYvpF0MC8fHv60g:E/CDOcFXCcHy0g","tlshash":"05e20fad23778cadcf138163e5a8b74dd0a0aed7f52db04136ac41852fd0e96e2d1749","dom_hash":"domhashffc833716046a84172e41d08c9d7eb91","first_seen":"2026-03-10T08:26:23.410194Z","last_seen":"2026-03-10T08:26:23.410194Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"151-242-2-118.cprapid.com/dico.htm","fqdn":"151-242-2-118.cprapid.com","domain":"151-242-2-118.cprapid.com","tld":"cprapid.com"},"ip":{"addr":"151.242.2.118","port":0,"asn":205647,"as":"Pardis Fanvari Partak Ltd","country":"Iran","country_code":"IR"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-04-14T08:26:14Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":2,"urlquery":2,"analyzer":5}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-10T08:25:52Z","timestamp":1773131152,"ip_dst":{"addr":"195.80.159.133","port":443,"asn":29152,"as":"Decknet SARL","country":"France","country_code":"FR"},"ip_src":{"addr":"Client IP","port":50822,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET POLICY Observed IP Lookup Domain (l2 .io in TLS SNI)","source":"{\"timestamp\":\"2026-03-10T08:25:52.479189+0000\",\"flow_id\":1326147750098708,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.47\",\"src_port\":50822,\"dest_ip\":\"195.80.159.133\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2024833,\"rev\":4,\"signature\":\"ET POLICY Observed IP Lookup Domain (l2 .io in TLS SNI)\",\"category\":\"Device Retrieving External IP Address Detected\",\"severity\":2,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2017_10_10\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Moderate\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2020_08_20\"]}},\"tls\":{\"sni\":\"l2.io\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"f4febc55ea12b31ae17cfb7e614afda8\",\"string\":\"771,4865,43-51\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":789,\"bytes_toclient\":3457,\"start\":\"2026-03-10T08:25:52.423700+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-03-10T08:25:52Z","timestamp":1773131152,"ip_dst":{"addr":"195.80.159.133","port":443,"asn":29152,"as":"Decknet SARL","country":"France","country_code":"FR"},"ip_src":{"addr":"Client IP","port":50822,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed External IP Lookup Domain (l2 .io) in TLS SNI","source":"{\"timestamp\":\"2026-03-10T08:25:52.479189+0000\",\"flow_id\":1326147750098708,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.47\",\"src_port\":50822,\"dest_ip\":\"195.80.159.133\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2063071,\"rev\":1,\"signature\":\"ET INFO Observed External IP Lookup Domain (l2 .io) in TLS SNI\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Any\"],\"attack_target\":[\"Client_and_Server\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_06_18\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2025_06_18\"]}},\"tls\":{\"sni\":\"l2.io\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"f4febc55ea12b31ae17cfb7e614afda8\",\"string\":\"771,4865,43-51\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":789,\"bytes_toclient\":3457,\"start\":\"2026-03-10T08:25:52.423700+0000\"}}"}],"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-03-10","alert":"Detects file containing Telegram Bot API","trigger":"151-242-2-118.cprapid.com/dico.htm","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-03-10","alert":"Detects file containing Telegram Bot API","trigger":"javascript.write.md5:9487da2e60eb4a487f0319828f6fd740","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-10","alert":"Sinkholed","trigger":"151-242-2-118.cprapid.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-10","alert":"Sinkholed","trigger":"151-242-2-118.cprapid.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-10","alert":"Sinkholed","trigger":"151-242-2-118.cprapid.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"summary":[{"fqdn":"portal.discover.com","ip":{"addr":"23.12.158.124","port":443,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"domain_registered":"1993-11-15","domain_rank":171316,"first_seen":"2017-02-01T15:42:46Z","last_seen":"2025-12-31T09:59:35.656847Z","alert_count":0,"request_count":1,"received_data":4248,"sent_data":484,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"i.postimg.cc","ip":{"addr":"46.105.222.161","port":443,"asn":16276,"as":"OVH SAS","country":"United Kingdom","country_code":"GB"},"domain_registered":"2016-06-11","domain_rank":103883,"first_seen":"2018-04-11T10:01:12Z","last_seen":"2026-03-04T21:46:11.555876Z","alert_count":0,"request_count":2,"received_data":612015,"sent_data":898,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"l2.io","ip":{"addr":"195.80.159.133","port":443,"asn":29152,"as":"Decknet SARL","country":"France","country_code":"FR"},"domain_registered":"2012-05-12","domain_rank":151857,"first_seen":"2015-06-25T01:31:26Z","last_seen":"2026-03-06T23:01:21.876275Z","alert_count":0,"request_count":1,"received_data":191,"sent_data":420,"comment":"","tags":null,"fingerprints":[{"name":"Apache HTTP Server:2.4.65","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"Debian","description":"Debian is a Linux software which is a free open-source software.","website":"https://debian.org","common_platform_enumeration":"cpe:2.3:o:debian:debian_linux:*:*:*:*:*:*:*:*","icon":"Debian.png","categories":["Operating systems"]}]},{"fqdn":"151-242-2-118.cprapid.com","ip":{"addr":"151.242.2.118","port":443,"asn":205647,"as":"Pardis Fanvari Partak Ltd","country":"Iran","country_code":"IR"},"domain_registered":"2019-05-16","domain_rank":0,"first_seen":"2026-03-09T13:30:05.412871Z","last_seen":"2026-03-09T13:30:05.412871Z","alert_count":8,"request_count":2,"received_data":31421,"sent_data":969,"comment":"","tags":null,"fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":[{"url":{"schema":"https","addr":"151-242-2-118.cprapid.com/dico.htm","fqdn":"151-242-2-118.cprapid.com","domain":"151-242-2-118.cprapid.com","tld":"cprapid.com"},"ip":{"addr":"151.242.2.118","port":443,"asn":205647,"as":"Pardis Fanvari Partak Ltd","country":"Iran","country_code":"IR"},"md5":"6083864b9b69582714002a68975ad13b","sha1":"b0d9ab40e6c7b07de79f617416ee3809c4df1565","sha256":"5b8a153d717f522fc733244eda1f2cb7c7e9c91e20804708c065bd93a40af1d8","sha512":"510d940217af1b5a20c38a26b98b4bcc9543f5f866d4b1b89c1580eba512f277066a5d87864969d0d8b8cee4e2f1b84788bf60d1b862c848d831d1df84f47bc5","size":1052,"token":"8035586150:AAGnp60ii2b5MdpFhMVJ-2YFM3OFu5xIvp8","is_revoked":false,"bot":{"token":"8035586150:AAGnp60ii2b5MdpFhMVJ-2YFM3OFu5xIvp8","user_id":"8035586150","username":"Smart_121223Bot","first_name":"Smart_121223","last_name":"","chat":{"chat_id":"8495247027","title":"","type":"private","bot_is":"member","total_users":2,"active_members":null,"admins":null},"pending_messages":0}},{"url":{"schema":"https","addr":"151-242-2-118.cprapid.com/dico.htm","fqdn":"151-242-2-118.cprapid.com","domain":"151-242-2-118.cprapid.com","tld":"cprapid.com"},"ip":{"addr":"151.242.2.118","port":443,"asn":205647,"as":"Pardis Fanvari Partak Ltd","country":"Iran","country_code":"IR"},"md5":"42599938914cae2e01989ce037a57b67","sha1":"8f5686048621859d87834422325a3fbb33c48979","sha256":"6b7881d99b46bdd029808d3d6ef9cfac2c4cef91167c9592e3a34d265f5a4b6e","sha512":"19fe3156bdb5cd413c1b17bc891e39f2371e91954cb352b2f04e20717f4f5226e50a70c70132d9229a4dc5b9c96447417b70cd2b771b43c87f498cf0fc692c4c","size":1339,"token":"8035586150:AAGnp60ii2b5MdpFhMVJ-2YFM3OFu5xIvp8","is_revoked":false,"bot":{"token":"8035586150:AAGnp60ii2b5MdpFhMVJ-2YFM3OFu5xIvp8","user_id":"8035586150","username":"Smart_121223Bot","first_name":"Smart_121223","last_name":"","chat":{"chat_id":"8495247027","title":"","type":"private","bot_is":"member","total_users":2,"active_members":null,"admins":null},"pending_messages":0}},{"url":{"schema":"https","addr":"151-242-2-118.cprapid.com/dico.htm","fqdn":"151-242-2-118.cprapid.com","domain":"151-242-2-118.cprapid.com","tld":"cprapid.com"},"ip":{"addr":"151.242.2.118","port":443,"asn":205647,"as":"Pardis Fanvari Partak Ltd","country":"Iran","country_code":"IR"},"md5":"69505156c9036927cbe10544e35bf428","sha1":"5c600ad9d125becbe2212867920eeda6f3830509","sha256":"c8a315001047032c30177583c9fe79cacfcdee74d393788f255f7ec1145b321a","sha512":"fe2f2b83bd1efbe1ab739f64851b485648402c2339b8d1f2442ee44dea4d5be46bc1d0f1c0babb9f1f72802a1736604a0a0cb55da62cae1ecb8cb48944972d93","size":2354,"token":"8035586150:AAGnp60ii2b5MdpFhMVJ-2YFM3OFu5xIvp8","is_revoked":false,"bot":{"token":"8035586150:AAGnp60ii2b5MdpFhMVJ-2YFM3OFu5xIvp8","user_id":"8035586150","username":"Smart_121223Bot","first_name":"Smart_121223","last_name":"","chat":{"chat_id":"8495247027","title":"","type":"private","bot_is":"member","total_users":2,"active_members":null,"admins":null},"pending_messages":0}},{"url":{"schema":"https","addr":"151-242-2-118.cprapid.com/dico.htm","fqdn":"151-242-2-118.cprapid.com","domain":"151-242-2-118.cprapid.com","tld":"cprapid.com"},"ip":{"addr":"151.242.2.118","port":443,"asn":205647,"as":"Pardis Fanvari Partak Ltd","country":"Iran","country_code":"IR"},"md5":"3b4ea5f42ea84c2309ff310cededfc28","sha1":"9b89410793b3fe1cf207ef1466e51298333ef716","sha256":"088d65331a3351925880099309f957875423b99270da66743209fd97b9f17499","sha512":"98c87be8435befc157e17e192801742d8c52bca0c023be74835838f8c0f7a62c173c9b86f4f68323bd901c8ee563986107bb1ed39ffd2308ff01169506295488","size":1860,"token":"8035586150:AAGnp60ii2b5MdpFhMVJ-2YFM3OFu5xIvp8","is_revoked":false,"bot":{"token":"8035586150:AAGnp60ii2b5MdpFhMVJ-2YFM3OFu5xIvp8","user_id":"8035586150","username":"Smart_121223Bot","first_name":"Smart_121223","last_name":"","chat":{"chat_id":"8495247027","title":"","type":"private","bot_is":"member","total_users":2,"active_members":null,"admins":null},"pending_messages":0}},{"md5":"9487da2e60eb4a487f0319828f6fd740","sha1":"039a1aa71b0fb49b1209cb81c5900772b5c5ac94","sha256":"14128dd64a0ac0e4c88739b07c9baf855cbcd74228f5004f9a0dfd74af297649","sha512":"8fd6e26bb77835ed79fe31d60abeb70ffbd7a32af766619bcfb4e07ee7df4a9ac62e9cb6dafab5afea20d33920652ae7803e20d0c18e45e474f077e75fa72ecd","size":12180,"token":"8035586150:AAGnp60ii2b5MdpFhMVJ-2YFM3OFu5xIvp8","is_revoked":false,"bot":{"token":"8035586150:AAGnp60ii2b5MdpFhMVJ-2YFM3OFu5xIvp8","user_id":"8035586150","username":"Smart_121223Bot","first_name":"Smart_121223","last_name":"","chat":{"chat_id":"8495247027","title":"","type":"private","bot_is":"member","total_users":2,"active_members":null,"admins":null},"pending_messages":0}}],"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"151-242-2-118.cprapid.com/dico.htm","fqdn":"151-242-2-118.cprapid.com","domain":"151-242-2-118.cprapid.com","tld":"cprapid.com"},"ip":{"addr":"151.242.2.118","port":443,"asn":205647,"as":"Pardis Fanvari Partak Ltd","country":"Iran","country_code":"IR"},"introduction_type":"scriptElement","is_inline":false,"md5":"ec03b235b6184b54256b633ea037c44f","sha1":"162e83397e6505dda4ac6c1826ad9c3852a799f9","sha256":"7c05d7e6ed9157ef7c06200ae680ad336c6364ee0dd11002a9f7752524ce6726","sha512":"f8c56dabe86de1b275fd6a69f9365059db7732aac1bd39d447e0988a49691fd283820fb2b389ceff6f5a397c77c6bac65fdb626fdc83c36e35ed9cf572c69a93","ssdeep":"","tlshash":"cee0c29bf39b122002efa17e48b5cf8a3030800bcd0119097e3c04f06f36ee1ea5a789","size":355,"data":"","first_seen":"2026-01-12T00:33:13.703646Z","last_seen":"2026-04-24T15:14:43.521133Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"151-242-2-118.cprapid.com/dico.htm","fqdn":"151-242-2-118.cprapid.com","domain":"151-242-2-118.cprapid.com","tld":"cprapid.com"},"ip":{"addr":"151.242.2.118","port":443,"asn":205647,"as":"Pardis Fanvari Partak Ltd","country":"Iran","country_code":"IR"},"introduction_type":"scriptElement","is_inline":false,"md5":"82eff2c2d81811cfb30fc0f1982fc006","sha1":"762bbfb620c223a5b4bcd18fc91051f5a3bd0e1d","sha256":"793aab333bcbe6c507c2f35ac70dce93dea08402254dac67cbe9e1ff3628eabf","sha512":"5f64dfb74336d45562814cd81f3394800b018b5ec3d6bc0d2bd53df108fe2310c1d928811b25e5060dc29af02315988692e308a42d8230283eb7ae654a4a3689","ssdeep":"","tlshash":"41700008e80002002800b03000ec00ac0a022022c00082c2a8f0e000208008002080c0","size":22,"data":"","first_seen":"2023-04-12T19:11:47Z","last_seen":"2026-04-24T15:14:43.519868Z","times_seen":61,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"151-242-2-118.cprapid.com/dico.htm","fqdn":"151-242-2-118.cprapid.com","domain":"151-242-2-118.cprapid.com","tld":"cprapid.com"},"ip":{"addr":"151.242.2.118","port":443,"asn":205647,"as":"Pardis Fanvari Partak Ltd","country":"Iran","country_code":"IR"},"introduction_type":"scriptElement","is_inline":false,"md5":"6083864b9b69582714002a68975ad13b","sha1":"b0d9ab40e6c7b07de79f617416ee3809c4df1565","sha256":"5b8a153d717f522fc733244eda1f2cb7c7e9c91e20804708c065bd93a40af1d8","sha512":"510d940217af1b5a20c38a26b98b4bcc9543f5f866d4b1b89c1580eba512f277066a5d87864969d0d8b8cee4e2f1b84788bf60d1b862c848d831d1df84f47bc5","ssdeep":"","tlshash":"22113293e6b2cc7043b344f64ab497c814b4a06ef806d042b57c89d01e51fa1367134e","size":1052,"data":"","first_seen":"2026-03-10T08:26:23.43282Z","last_seen":"2026-03-10T08:26:23.43282Z","times_seen":1,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-03-10","alert":"Detects file containing Telegram Bot API","trigger":"151-242-2-118.cprapid.com/dico.htm","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}},{"url":{"schema":"https","addr":"151-242-2-118.cprapid.com/dico.htm","fqdn":"151-242-2-118.cprapid.com","domain":"151-242-2-118.cprapid.com","tld":"cprapid.com"},"ip":{"addr":"151.242.2.118","port":443,"asn":205647,"as":"Pardis Fanvari Partak Ltd","country":"Iran","country_code":"IR"},"introduction_type":"scriptElement","is_inline":false,"md5":"42599938914cae2e01989ce037a57b67","sha1":"8f5686048621859d87834422325a3fbb33c48979","sha256":"6b7881d99b46bdd029808d3d6ef9cfac2c4cef91167c9592e3a34d265f5a4b6e","sha512":"19fe3156bdb5cd413c1b17bc891e39f2371e91954cb352b2f04e20717f4f5226e50a70c70132d9229a4dc5b9c96447417b70cd2b771b43c87f498cf0fc692c4c","ssdeep":"","tlshash":"0821f0a2d572dcb0037648fa5bf0978464a1a0aef907d042757cca852f71fb27a6168e","size":1339,"data":"","first_seen":"2026-03-10T08:26:23.440266Z","last_seen":"2026-03-10T08:26:23.440266Z","times_seen":1,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-03-10","alert":"Detects file containing Telegram Bot API","trigger":"151-242-2-118.cprapid.com/dico.htm","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}},{"url":{"schema":"https","addr":"151-242-2-118.cprapid.com/dico.htm","fqdn":"151-242-2-118.cprapid.com","domain":"151-242-2-118.cprapid.com","tld":"cprapid.com"},"ip":{"addr":"151.242.2.118","port":443,"asn":205647,"as":"Pardis Fanvari Partak Ltd","country":"Iran","country_code":"IR"},"introduction_type":"scriptElement","is_inline":false,"md5":"69505156c9036927cbe10544e35bf428","sha1":"5c600ad9d125becbe2212867920eeda6f3830509","sha256":"c8a315001047032c30177583c9fe79cacfcdee74d393788f255f7ec1145b321a","sha512":"fe2f2b83bd1efbe1ab739f64851b485648402c2339b8d1f2442ee44dea4d5be46bc1d0f1c0babb9f1f72802a1736604a0a0cb55da62cae1ecb8cb48944972d93","ssdeep":"","tlshash":"c441dd96d862ccb003320df76fb493c459a092dee90bd047706ca5867f72f6136a4ace","size":2354,"data":"","first_seen":"2026-03-10T08:26:23.442254Z","last_seen":"2026-03-10T08:26:23.442254Z","times_seen":1,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-03-10","alert":"Detects file containing Telegram Bot API","trigger":"151-242-2-118.cprapid.com/dico.htm","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}},{"url":{"schema":"https","addr":"151-242-2-118.cprapid.com/dico.htm","fqdn":"151-242-2-118.cprapid.com","domain":"151-242-2-118.cprapid.com","tld":"cprapid.com"},"ip":{"addr":"151.242.2.118","port":443,"asn":205647,"as":"Pardis Fanvari Partak Ltd","country":"Iran","country_code":"IR"},"introduction_type":"scriptElement","is_inline":false,"md5":"21fad436570911a4fb3569aaedd0af66","sha1":"0ae02ecdbd324166223bb34298911e5c370f08f1","sha256":"66499cf832420f4152b26804da48866163e1aaf1466b4479417703a98993a5dd","sha512":"8337d9b163da5ef70da3705700b60ba1ce5b8b03d8c5860d4398f7b577e962eff2e129a1d57b5e86762fdb4302dc8c2fa5cfaefa055f152e915c4c76476d4d2a","ssdeep":"","tlshash":"3aa0223bf3c032320cba02b2a020838c2e003030c80228c3382c80208000fc28e22000","size":79,"data":"","first_seen":"2023-04-12T19:11:47Z","last_seen":"2026-04-24T15:14:43.51871Z","times_seen":61,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"151-242-2-118.cprapid.com/dico.htm","fqdn":"151-242-2-118.cprapid.com","domain":"151-242-2-118.cprapid.com","tld":"cprapid.com"},"ip":{"addr":"151.242.2.118","port":443,"asn":205647,"as":"Pardis Fanvari Partak Ltd","country":"Iran","country_code":"IR"},"introduction_type":"scriptElement","is_inline":false,"md5":"3b4ea5f42ea84c2309ff310cededfc28","sha1":"9b89410793b3fe1cf207ef1466e51298333ef716","sha256":"088d65331a3351925880099309f957875423b99270da66743209fd97b9f17499","sha512":"98c87be8435befc157e17e192801742d8c52bca0c023be74835838f8c0f7a62c173c9b86f4f68323bd901c8ee563986107bb1ed39ffd2308ff01169506295488","ssdeep":"","tlshash":"0531ee92d972dcb1037609fb6bb483c419a4a1dee90bd047716c9a846f72f6136a09ce","size":1860,"data":"","first_seen":"2026-03-10T08:26:23.44496Z","last_seen":"2026-03-10T08:26:23.44496Z","times_seen":1,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-03-10","alert":"Detects file containing Telegram Bot API","trigger":"151-242-2-118.cprapid.com/dico.htm","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}},{"url":{"schema":"https","addr":"151-242-2-118.cprapid.com/dico.htm","fqdn":"151-242-2-118.cprapid.com","domain":"151-242-2-118.cprapid.com","tld":"cprapid.com"},"ip":{"addr":"151.242.2.118","port":443,"asn":205647,"as":"Pardis Fanvari Partak Ltd","country":"Iran","country_code":"IR"},"introduction_type":"scriptElement","is_inline":true,"md5":"d4f7ba107d707df4a67f405e37d4bf35","sha1":"fe73a86023819b586e40a7867f1cbe3f6dc309fd","sha256":"853f47b68006fcac1c9210808cf8c6c302df24051bbed765eb56e750f9e95712","sha512":"3923954529e9fdc1fefe82636287cd42d37179e8be89762eac94f60c6fe71a5c74aa71a45b2769ba7b73f7b8175c47c523e79f644be5176f667ab67224b8b1e0","ssdeep":"384:t72MosaXwNHrGoU0RVSAJJ8LLXfXiLP8uAKWuiLST28ug3FhiLSTFFCnv8ugHs0y:t75H0aLPneLST2nhLSTFFCnvnwLSTFF9","tlshash":"b29234ad333b8cadcf139217e088b79ed0a0afd7f56cb05406ac41452fe0d5ae2d5a59","size":20351,"data":"","first_seen":"2026-03-10T08:26:23.447163Z","last_seen":"2026-03-10T08:26:23.447163Z","times_seen":1,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-03-10","alert":"Detects file containing Telegram Bot API","trigger":"151-242-2-118.cprapid.com/dico.htm","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}},{"url":{"schema":"https","addr":"l2.io/ip.js?var=userip","fqdn":"l2.io","domain":"l2.io","tld":"io"},"ip":{"addr":"195.80.159.133","port":443,"asn":29152,"as":"Decknet SARL","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"f9dc91b3feea65bd389a2f5b57306c32","sha1":"147d1c9ae79ae948a34c5f1254bdcbf7af9caf8e","sha256":"d88923af30873abcf4cde709062c3d2e9ded181f9e2552c7fbcc983b3796ff77","sha512":"0d94659d1c306a8741ceebb75e7e02e44177b20583634f062b15bdb8fd43971806aa16fe402f2332e8deaa51df5d553bf5ee30aed4662f629c83840efe8f0a66","ssdeep":"","tlshash":"4a7000a2200002200888820ec2aa03022f80000aca8b288288c80b0208203b003a0030","size":24,"data":"","first_seen":"2023-03-07T01:02:55Z","last_seen":"2026-06-06T23:56:13.256471Z","times_seen":3126,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":[{"md5":"9487da2e60eb4a487f0319828f6fd740","sha1":"039a1aa71b0fb49b1209cb81c5900772b5c5ac94","sha256":"14128dd64a0ac0e4c88739b07c9baf855cbcd74228f5004f9a0dfd74af297649","sha512":"8fd6e26bb77835ed79fe31d60abeb70ffbd7a32af766619bcfb4e07ee7df4a9ac62e9cb6dafab5afea20d33920652ae7803e20d0c18e45e474f077e75fa72ecd","ssdeep":"192:kITHIdsmiHiairiKrYhzAmfv9lC0ioiblydiHi0lDOi2ixlQw/iFiz:UHiHiairiSYRe0ioi0diHi8Oi2iv/iFq","tlshash":"3e42b69309a28cb1032244e5bff0d74869f4d0a7aa0bc04675bca5d56f91fe176b27cd","size":12180,"data":"","first_seen":"2026-03-10T08:26:23.449434Z","last_seen":"2026-03-10T08:26:23.449434Z","times_seen":1,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-03-10","alert":"Detects file containing Telegram Bot API","trigger":"javascript.write.md5:9487da2e60eb4a487f0319828f6fd740","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}}],"console":null},"http":[{"url":{"schema":"https","addr":"151-242-2-118.cprapid.com/font-awesome.min.css","fqdn":"151-242-2-118.cprapid.com","domain":"151-242-2-118.cprapid.com","tld":"cprapid.com"},"ip":{"addr":"151.242.2.118","port":443,"asn":205647,"as":"Pardis Fanvari Partak Ltd","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://151-242-2-118.cprapid.com/dico.htm","date":"2026-03-10T08:25:52.419Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"151-242-2-118.cprapid.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 27 Feb 2026 12:50:14 GMT","end":"Thu, 28 May 2026 12:50:13 GMT"},"fingerprint":{"sha1":"38:5C:9E:2A:97:30:FB:F0:EF:E2:B9:1A:85:32:29:DC:D7:DA:06:F5","sha256":"68:AF:86:CC:34:15:09:F8:D1:D3:95:B0:24:6B:93:32:B5:96:D6:C8:A3:8B:94:55:0A:00:1F:DB:38:31:12:64"}}},"request":{"raw":"GET /font-awesome.min.css HTTP/1.1\r\nHost: 151-242-2-118.cprapid.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://151-242-2-118.cprapid.com/dico.htm\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nDate: Tue, 10 Mar 2026 08:25:52 GMT\r\nServer: Apache\r\nAccept-Ranges: bytes\r\nCache-Control: no-cache, no-store, must-revalidate\r\nPragma: no-cache\r\nExpires: 0\r\nKeep-Alive: timeout=5, max=99\r\nConnection: Keep-Alive\r\nTransfer-Encoding: chunked\r\nContent-Type: text/html\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":10431,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (4070)","md5":"1e80ce900939596aa33230bb8f87240e","sha1":"57e1865722ec008df593eaaba6c9a59d0a6ac135","sha256":"3238f4454bc07bde950c840b9283de981ab3856d00f2e172ee1ba0568c803820","sha512":"b84237696bcb35eebbfddd5862dcc38ad55b5a2df5ece4bc8cc50e7f3c2f0cd712d3e6eddc916f4f57a00577bb91edfb68c24fdf618d309cec41632da2324ffc","ssdeep":"192:rlYHC0HNXGZkHQU7ydPJq5S2KqQVX/uTK3w3DK+tMy47R/Ga0kVhFuPwf8Pn93JM:FVGaRF8I8Y24x3","tlshash":"7422a69b1ae3000b740761ba67ba6201ab68b153d11fcd643f4df3e8cf865819d93b5d","first_seen":"2026-03-10T08:26:23.413901Z","last_seen":"2026-03-10T08:26:23.413901Z","times_seen":1,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-10","alert":"Sinkholed","trigger":"151-242-2-118.cprapid.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-10","alert":"Sinkholed","trigger":"151-242-2-118.cprapid.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-10","alert":"Sinkholed","trigger":"151-242-2-118.cprapid.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"portal.discover.com/bankac/static/images/registration/success.jpg","fqdn":"portal.discover.com","domain":"discover.com","tld":"com"},"ip":{"addr":"23.12.158.124","port":443,"asn":20940,"as":"Akamai International B.V.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://151-242-2-118.cprapid.com/dico.htm","date":"2026-03-10T08:25:52.426Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.discovercard.com","organization":"DFS Services LLC"},"issuer":{"commonName":"DigiCert EV RSA CA G2","organization":"DigiCert Inc"},"validity":{"start":"Thu, 20 Mar 2025 00:00:00 GMT","end":"Mon, 20 Apr 2026 23:59:59 GMT"},"fingerprint":{"sha1":"33:A9:AE:AE:0A:F6:38:36:2A:1A:74:4B:68:BF:1D:66:FF:1B:C3:E9","sha256":"68:F4:1D:EE:9A:B7:FF:8D:A9:79:88:61:5F:D2:7F:F8:7F:C4:7B:3A:61:79:4D:4C:64:CD:51:03:BD:24:11:33"}}},"request":{"raw":"GET /bankac/static/images/registration/success.jpg HTTP/1.1\r\nHost: portal.discover.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://151-242-2-118.cprapid.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nContent-Security-Policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'\r\nX-Frame-Options: SAMEORIGIN, SAMEORIGIN\r\nX-XSS-Protection: 1; mode=block\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains;preload\r\nLast-Modified: Thu, 19 Sep 2019 06:21:15 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 3467\r\nCache-Control: no-cache, no-store, public, must-revalidate\r\nPragma: no-cache\r\nExpires: 0\r\nX-Content-Type-Options: nosniff, nosniff\r\nContent-Type: image/jpeg\r\nDate: Tue, 10 Mar 2026 08:25:52 GMT\r\nConnection: keep-alive\r\nSet-Cookie: DCID=www12; path=/; secure\r\nServer-Timing: cdn-cache; desc=HIT, edge; dur=266, origin; dur=0, ak_p; desc=\"1773131152487_399883207_1923889661_26554_124683_11_85_-\";dur=1\r\nAkamai-GRN: 0.c7bbd517.1773131152.72ac39fd\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3467,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=1], baseline, precision 8, 30x30, components 3","md5":"c20c95555a6c6731766685a33e1ddbac","sha1":"599e347b0a8d9c20841b26b2e382a92d5aab2bcc","sha256":"1f457d388426b8f8a756e7d7d6bbbcc8fe9363e439f16df83567657377f1eaf7","sha512":"a3d6d6c19693a1cc6cf5dff9f0c107d4f6bc6e6c5c511addce372c8c4cf643deca36603920e0604358a63ee8bfb51c14c74cb6a6436eb68975599513a566c0e4","ssdeep":"","tlshash":"e16119e58629a691f2b12af05963728be248f8302bc4d615a62243eed900fc0ba5871d","first_seen":"2026-03-10T08:26:23.416979Z","last_seen":"2026-03-10T08:26:23.416979Z","times_seen":1,"resource_available":false,"data":null}},"time_used":679,"timings":{"blocked":135,"dns":43,"connect":13,"send":0,"wait":404,"receive":1,"ssl":80},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"i.postimg.cc/rwh7Bg2x/secl.png","fqdn":"i.postimg.cc","domain":"postimg.cc","tld":"cc"},"ip":{"addr":"46.105.222.161","port":443,"asn":16276,"as":"OVH SAS","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://151-242-2-118.cprapid.com/dico.htm","date":"2026-03-10T08:25:52.424Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postimg.cc","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Fri, 13 Feb 2026 07:05:38 GMT","end":"Thu, 14 May 2026 07:05:37 GMT"},"fingerprint":{"sha1":"0C:60:FC:7F:49:9C:E4:F1:E8:28:6F:D1:45:F4:24:E1:7A:D7:FE:79","sha256":"9C:DF:9E:CA:39:40:61:D1:0E:A6:F4:42:3F:FB:A1:4B:BF:82:59:98:C4:CA:4D:56:1F:BD:99:B9:9F:EA:19:D0"}}},"request":{"raw":"GET /rwh7Bg2x/secl.png HTTP/1.1\r\nHost: i.postimg.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://151-242-2-118.cprapid.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 10 Mar 2026 08:25:52 GMT\r\ncontent-type: image/png\r\ncontent-length: 4637\r\nlast-modified: Tue, 02 Dec 2025 14:39:51 GMT\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000, public\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, OPTIONS\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4637,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 377 x 41, 8-bit/color RGBA, non-interlaced","md5":"babe7190efd56c6f316848a414391a6a","sha1":"2e7468b3ee9d271f2d8f24cea3e6fe4e56c00e3c","sha256":"8700cd94ef2b6a3f976d2ecd5f085ce1379bd61b9f5620491fdad5e0d69fdd74","sha512":"033f3e69bd35a4fd5bd9ec3a2b0f2a9d6a0ae8634192b48018292dd2e97199d0853a79a2be4fbee8408b85e437e07e21068bafcda58fce1dd2f123749f47089b","ssdeep":"96:iTGVvoRmSOCT7cgvD03uEE6R1Qr9s38T0DdemEzaThgD8:iMGmSieEhNemEzaKD8","tlshash":"94a17d4cafac2de2e81132587cd12e457358aeb33509198eddd1ecbae47cda422b4c50","first_seen":"2026-03-10T08:26:23.41962Z","last_seen":"2026-03-10T08:26:23.41962Z","times_seen":1,"resource_available":false,"data":null}},"time_used":249,"timings":{"blocked":220,"dns":0,"connect":0,"send":0,"wait":28,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"l2.io/ip.js?var=userip","fqdn":"l2.io","domain":"l2.io","tld":"io"},"ip":{"addr":"195.80.159.133","port":443,"asn":29152,"as":"Decknet SARL","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://151-242-2-118.cprapid.com/dico.htm","date":"2026-03-10T08:25:52.427Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"l2.io","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 26 Feb 2026 21:14:26 GMT","end":"Wed, 27 May 2026 21:14:25 GMT"},"fingerprint":{"sha1":"77:DC:F6:F6:12:F2:A5:DB:23:F4:8E:E1:82:C1:64:93:26:F5:6D:CD","sha256":"13:97:8D:41:74:2F:D4:41:C1:04:8F:6A:F9:FA:17:DF:1F:BC:A2:28:55:23:F3:7E:03:66:9B:44:44:EC:7E:89"}}},"request":{"raw":"GET /ip.js?var=userip HTTP/1.1\r\nHost: l2.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://151-242-2-118.cprapid.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 10 Mar 2026 08:25:52 GMT\r\nServer: Apache/2.4.65 (Debian)\r\nContent-Length: 24\r\nConnection: close\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server:2.4.65","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"Debian","description":"Debian is a Linux software which is a free open-source software.","website":"https://debian.org","common_platform_enumeration":"cpe:2.3:o:debian:debian_linux:*:*:*:*:*:*:*:*","icon":"Debian.png","categories":["Operating systems"]}],"data":{"size":24,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"f9dc91b3feea65bd389a2f5b57306c32","sha1":"147d1c9ae79ae948a34c5f1254bdcbf7af9caf8e","sha256":"d88923af30873abcf4cde709062c3d2e9ded181f9e2552c7fbcc983b3796ff77","sha512":"0d94659d1c306a8741ceebb75e7e02e44177b20583634f062b15bdb8fd43971806aa16fe402f2332e8deaa51df5d553bf5ee30aed4662f629c83840efe8f0a66","ssdeep":"","tlshash":"4a7000a2200002200888820ec2aa03022f80000aca8b288288c80b0208203b003a0030","first_seen":"2023-03-07T01:02:55Z","last_seen":"2026-06-06T23:56:13.256471Z","times_seen":3126,"resource_available":true,"data":null}},"time_used":147,"timings":{"blocked":59,"dns":1,"connect":24,"send":0,"wait":25,"receive":0,"ssl":35},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"i.postimg.cc/523f6wdC/dige.png","fqdn":"i.postimg.cc","domain":"postimg.cc","tld":"cc"},"ip":{"addr":"46.105.222.161","port":443,"asn":16276,"as":"OVH SAS","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://151-242-2-118.cprapid.com/dico.htm","date":"2026-03-10T08:25:52.450Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postimg.cc","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Fri, 13 Feb 2026 07:05:38 GMT","end":"Thu, 14 May 2026 07:05:37 GMT"},"fingerprint":{"sha1":"0C:60:FC:7F:49:9C:E4:F1:E8:28:6F:D1:45:F4:24:E1:7A:D7:FE:79","sha256":"9C:DF:9E:CA:39:40:61:D1:0E:A6:F4:42:3F:FB:A1:4B:BF:82:59:98:C4:CA:4D:56:1F:BD:99:B9:9F:EA:19:D0"}}},"request":{"raw":"GET /523f6wdC/dige.png HTTP/1.1\r\nHost: i.postimg.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://151-242-2-118.cprapid.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 10 Mar 2026 08:25:52 GMT\r\ncontent-type: image/png\r\ncontent-length: 606652\r\nlast-modified: Tue, 02 Dec 2025 14:38:12 GMT\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000, public\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, OPTIONS\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":606652,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1280 x 593, 8-bit/color RGBA, non-interlaced","md5":"8683ffb86a46f69c3035333a8dcfee1f","sha1":"7a5b864a40de6d783a50a2b56cfa415f549970d4","sha256":"6c1417ea1f4af7e910a17eec7f41054f276670b2b96ac5491c7ac356debfd1ed","sha512":"cc8a66bdfcffef53e19c77decd3b737309ec6dc1bc8d686b5e6750bc169f48c4fea509c59d4cd945bcfcfd25a5394f120788cad4ddda440a19a81feae2e21ea2","ssdeep":"12288:pEWBIAepf2Z7KzgW9+NcfugxN4vfXdnEEjNFhgAmao3rZfYHOI6:pEWBIzNB0c/DEfXdEkNF+AEbaOJ","tlshash":"78d4233fa6e2c630798f0627cea5a7602ce2dd0573d0405a113fedba096bf149ad079d","first_seen":"2026-03-10T08:26:23.424408Z","last_seen":"2026-03-10T08:26:23.424408Z","times_seen":1,"resource_available":false,"data":null}},"time_used":453,"timings":{"blocked":194,"dns":0,"connect":28,"send":0,"wait":28,"receive":163,"ssl":37},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"151-242-2-118.cprapid.com/dico.htm","fqdn":"151-242-2-118.cprapid.com","domain":"151-242-2-118.cprapid.com","tld":"cprapid.com"},"ip":{"addr":"151.242.2.118","port":443,"asn":205647,"as":"Pardis Fanvari Partak Ltd","country":"Iran","country_code":"IR"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-10T08:25:52.105Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"151-242-2-118.cprapid.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 27 Feb 2026 12:50:14 GMT","end":"Thu, 28 May 2026 12:50:13 GMT"},"fingerprint":{"sha1":"38:5C:9E:2A:97:30:FB:F0:EF:E2:B9:1A:85:32:29:DC:D7:DA:06:F5","sha256":"68:AF:86:CC:34:15:09:F8:D1:D3:95:B0:24:6B:93:32:B5:96:D6:C8:A3:8B:94:55:0A:00:1F:DB:38:31:12:64"}}},"request":{"raw":"GET /dico.htm HTTP/1.1\r\nHost: 151-242-2-118.cprapid.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 10 Mar 2026 08:25:52 GMT\r\nServer: Apache\r\nLast-Modified: Sun, 08 Mar 2026 22:56:14 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 20373\r\nCache-Control: no-cache, no-store, must-revalidate\r\nPragma: no-cache\r\nExpires: 0\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: text/html\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":20373,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (20296), with CRLF line terminators","md5":"e5f2622aa67fe5fe6cdf09cac5c6c432","sha1":"258a93a52d694a30168d8a5bc3fc88c1b131d034","sha256":"16f36496eb6485795927c5953cee1a69390ca1fc7cab71265178d281902d8a70","sha512":"403198812acfbfc9766e5ed28b094168edd16432d20ccbb38d38c3008422947f8e7bc666f36d301d6e85cf4e75046413b41ddb6252cfd65f2e141937fbe77427","ssdeep":"384:E72MosaXwNHrGoU0RVSAJJ8LLXfXiLP8uAKWuiLST28ug3FhiLSTFFCnv8ugHs0i:E75H0aLPneLST2nhLSTFFCnvnwLSTFFx","tlshash":"5b9234ad333b8cadcf139227e088b79ed0a0afd7f56cb05406ac41452fe0d5ae2d5a55","first_seen":"2026-03-10T08:26:23.42679Z","last_seen":"2026-03-10T08:26:23.42679Z","times_seen":1,"resource_available":false,"data":null}},"time_used":216,"timings":{"blocked":89,"dns":45,"connect":16,"send":0,"wait":18,"receive":17,"ssl":27},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-03-10","alert":"Detects file containing Telegram Bot API","trigger":"151-242-2-118.cprapid.com/dico.htm","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-03-10","alert":"Sinkholed","trigger":"151-242-2-118.cprapid.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-10","alert":"Sinkholed","trigger":"151-242-2-118.cprapid.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-10","alert":"Sinkholed","trigger":"151-242-2-118.cprapid.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]}}]}