WEBSITE ANALYSIS REPORT

http://nmkjdwq4.icu

14 Feb 2026 · 14:52:22.000 UTCpublic

Report tags: suspicious telegram_bot
Submit tags

Request review

Suspicious activity

5 detections · review the detection signals

Review evidence →

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

14:51:51.341 GET No response document 0 B 697 ms —

14:51:52.576 GET 307 document 0 B 739 ms 1 alerts

14:51:53.071 GET No response document 0 B 521 ms 1 alerts

14:51:54.706 GET 200 document 5.0 KB 1316 ms 1 alerts

14:51:55.672 GET 200 stylesheet 965.9 KB 1264 ms 1 alerts

14:51:55.674 GET 200 script 3.7 KB 276 ms 1 alerts

14:51:55.675 GET 200 script 3.7 KB 272 ms 1 alerts

14:51:55.677 GET 200 script 27.5 KB 272 ms 1 alerts

14:51:55.679 GET 200 script 7.3 KB 516 ms 1 alerts

14:51:55.681 GET 200 script 2.2 KB 514 ms 1 alerts

14:51:55.683 GET 200 script 1.89 MB 1757 ms 1 alerts

14:51:55.685 GET 200 script 2.42 MB 1766 ms 2 alerts

14:51:57.116 GET 200 stylesheet 10.7 KB 326 ms 1 alerts

Transaction #05

Request / response

URL

GET HTTPS

https://nmkjdwq4.icu:8760/static/local/css/common/layer.css

IP / ASN

20.2.48.248

AS8075 · MICROSOFT-CORP-MSN-AS-BLOCK

Requested by: https://nmkjdwq4.icu:8760/

Resource information

File type: Unicode text, UTF-8 text
MIME type: text/css
First seen (UTC): 10 May 2025 · 06:10:05.197 UTC
Last seen (UTC): 18 Oct 2026 · 23:05:35.029 UTC
Times seen: 1389

Size: 10.7 KB (10987 bytes)
MD5: ee8e01647741a0d1f6f38e8f1abe42c1
SHA1: 4fb677f6a2dc5b9730ded8e0466b07abb1d7a662
SHA256: 2f2747d3a57929054009c2da572c6b74069bc31ff7035cbcbecd984ac3d577ac

Certificate information

Issuer: ZeroSSL · ZeroSSL RSA Domain Secure Site CA
Subject: 20.255.190.155
Protocol / cipher: TLSv1.3 · TLS_AES_256_GCM_SHA384
SHA1 fingerprint: 0C:8E:1D:02:CB:E4:5E:D7:0B:AF:BC:CF:39:FB:68:F2:4E:A5:1F:D9
Valid from: Thu, 13 Nov 2025 00:00:00 GMT
Valid until: Wed, 11 Feb 2026 23:59:59 GMT

Technology fingerprints

Nginx (Web servers, Reverse proxies)
OpenResty (Web servers)

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
Hagezi Threat Feed Sinkholed	medium	Malicious

HTTP headers

Request headers

GET /static/local/css/common/layer.css HTTP/1.1
Host: nmkjdwq4.icu:8760
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nmkjdwq4.icu:8760/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/2 200 OK
server: openresty
date: Sat, 14 Feb 2026 14:51:57 GMT
content-type: text/css
pragma: public
last-modified: Fri, 06 Feb 2026 02:12:24 GMT
vary: Accept-Encoding
etag: W/"69854e08-2aeb"
content-encoding: gzip
cache-control: max-age=315360000, stale-while-revalidate=315360000, stale-if-error=315360000, public, immutable, public, max-age=259200, immutable, stale-while-revalidate=86400, stale-if-error=172800
tstatus: MISS
X-Firefox-Spdy: h2

14:51:58.051 GET 200 img 83 B 271 ms 1 alerts

14:51:58.054 GET 200 img 164 B 271 ms 1 alerts

14:51:58.057 GET 200 img 83 B 272 ms 1 alerts

14:51:58.058 GET 200 img 164 B 278 ms 1 alerts

14:51:58.061 GET 200 img 67 B 285 ms 1 alerts

14:51:58.062 POST 200 fetch 40.5 KB 315 ms 1 alerts

14:51:58.086 POST 200 fetch 106 B 269 ms —

14:51:58.096 POST 200 fetch 222 B 504 ms 1 alerts

14:51:58.114 POST 200 fetch 1.5 KB 514 ms 1 alerts

14:51:58.122 GET 200 img 19.8 KB 459 ms 1 alerts

14:51:58.135 GET 200 img 2.5 KB 448 ms 1 alerts

14:51:58.139 GET 200 img 3.2 KB 448 ms 1 alerts

14:51:58.171 GET 200 font 54.2 KB 436 ms 1 alerts

14:51:58.657 GET 200 img 10.6 KB 275 ms 1 alerts

14:51:58.695 GET 200 img 13.2 KB 283 ms 1 alerts

14:51:58.698 GET 200 img 11.5 KB 283 ms 1 alerts

14:51:58.699 GET 200 img 17.6 KB 283 ms 1 alerts

14:51:58.701 GET 200 img 10.0 KB 283 ms 1 alerts

14:51:59.094 GET 200 img 5.0 KB 293 ms 1 alerts

14:51:59.586 POST 200 fetch 102 B 330 ms 1 alerts

14:51:59.589 GET 200 img 14.0 KB 326 ms 1 alerts

14:51:59.591 GET 200 img 10.1 KB 324 ms 1 alerts

14:51:59.598 GET 200 img 691 B 2908 ms 1 alerts

14:51:59.656 POST 200 fetch 690 B 288 ms 1 alerts

14:51:59.927 POST 200 fetch 222 B 271 ms 1 alerts

http://nmkjdwq4.icu

Domain graph

Hostnames

Connections