{"report_id":"fab8d9d4-5cc3-493f-9515-a337ee4190fc","version":0,"status":"done","tags":["suspicious","telegram_bot"],"date":"2026-06-16T07:45:36Z","url":{"schema":"https","addr":"coinspotdesktopapp.com","fqdn":"coinspotdesktopapp.com","domain":"coinspotdesktopapp.com","tld":"com"},"ip":{"addr":"91.92.241.250","port":0,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"final":{"url":{"schema":"https","addr":"coinspotdesktopapp.com/","fqdn":"coinspotdesktopapp.com","domain":"coinspotdesktopapp.com","tld":"com"},"title":"CoinSpot Desktop App — Download CoinSpot for Windows","dom":{"size":45613,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (391)","md5":"5225ab913e20ceee2ab17376dcd29205","sha1":"f9999723b94c94d067a701b71addbc77fb99d3ab","sha256":"b54b27a91ca780f4ae391a8faa02c90e71794f0d77a6d6a8b042ec0d4422948f","sha512":"0256b10ce84ac42a64a268be18afed72b829ba7a865a95809962e57415a3a59fb839c2cfd4c39fd37af2e4c38aa6c7db61e9db577199b4394d77b28a3470df72","ssdeep":"768:uOOTU5U4RTh2C9F6X76auioLWappmpybos5xK:uOOTWU+hML6JxLWappmmoMc","tlshash":"4323a557b1a32037751751aa7bf7534a7675d003c94aca253bec038c8fc2ad99a1378e","dom_hash":"domhash1ed3da07ad0f2003820a78fc8f68e758","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"coinspotdesktopapp.com","fqdn":"coinspotdesktopapp.com","domain":"coinspotdesktopapp.com","tld":"com"},"ip":{"addr":"91.92.241.250","port":0,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-07-21T07:45:36Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-06-16","alert":"Detects file containing Telegram Bot API","trigger":"coinspotdesktopapp.com/","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-16","alert":"Sinkholed","trigger":"coinspotdesktopapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-16","alert":"Sinkholed","trigger":"coinspotdesktopapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"summary":[{"fqdn":"coinspotdesktopapp.com","ip":{"addr":"91.92.241.250","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"domain_registered":"2026-05-29","domain_rank":0,"first_seen":"2026-06-16T07:45:36.247929Z","last_seen":"2026-06-16T07:45:36.247929Z","alert_count":4,"request_count":1,"received_data":45903,"sent_data":491,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.31.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":[{"url":{"schema":"https","addr":"coinspotdesktopapp.com/","fqdn":"coinspotdesktopapp.com","domain":"coinspotdesktopapp.com","tld":"com"},"ip":{"addr":"91.92.241.250","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"md5":"3069547d52e2b237f1dcf5f285e5a596","sha1":"ef463e2552c905af4b98b18dede6e53abb86569b","sha256":"31de6ed58eb7a5c2aebd0d8d250ab87a16032bfeb1b0c65c15254db3e05befe5","sha512":"0890637e24d5a6c5ab71aeb52a6cbc35bc315e7f7ada0d071cd89ea879984a97da14bf9617284f84d5d62b6907ecf2654812bc1e7821823c2b88900f79ad68a5","size":2963,"token":"8274219888:AAHv3JGiUDweqYmFZc3kj4rfoQf-Mw2WAi8","is_revoked":false,"bot":{"token":"8274219888:AAHv3JGiUDweqYmFZc3kj4rfoQf-Mw2WAi8","user_id":"8274219888","username":"hitpanel_bot","first_name":"hitpanelbot","last_name":"","chat":{"chat_id":"6650556502","title":"","type":"private","bot_is":"member","total_users":2,"active_members":null,"admins":null},"pending_messages":0}}],"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"coinspotdesktopapp.com/","fqdn":"coinspotdesktopapp.com","domain":"coinspotdesktopapp.com","tld":"com"},"ip":{"addr":"91.92.241.250","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"introduction_type":"scriptElement","is_inline":true,"md5":"3069547d52e2b237f1dcf5f285e5a596","sha1":"ef463e2552c905af4b98b18dede6e53abb86569b","sha256":"31de6ed58eb7a5c2aebd0d8d250ab87a16032bfeb1b0c65c15254db3e05befe5","sha512":"0890637e24d5a6c5ab71aeb52a6cbc35bc315e7f7ada0d071cd89ea879984a97da14bf9617284f84d5d62b6907ecf2654812bc1e7821823c2b88900f79ad68a5","ssdeep":"","tlshash":"6a5130afb893247a3a37716b93afa34cb06360576c46dd12350cd6400fd1a7912a2efd","size":2963,"data":"","first_seen":"2026-06-16T07:45:41.709918Z","last_seen":"2026-06-16T07:45:41.709918Z","times_seen":1,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-06-16","alert":"Detects file containing Telegram Bot API","trigger":"coinspotdesktopapp.com/","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"coinspotdesktopapp.com/","fqdn":"coinspotdesktopapp.com","domain":"coinspotdesktopapp.com","tld":"com"},"ip":{"addr":"91.92.241.250","port":443,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-06-16T07:45:13.313Z","timestamp":1781595913313,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"coinspotdesktopapp.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 04 Jun 2026 19:03:45 GMT","end":"Wed, 02 Sep 2026 19:03:44 GMT"},"fingerprint":{"sha1":"D3:4A:7E:CE:ED:16:B7:8D:44:C0:EC:16:75:B3:CE:60:C4:3D:27:79","sha256":"F0:E6:39:CC:1F:EC:AF:91:17:C1:94:81:C6:98:B2:D6:A6:5C:24:E8:84:70:CE:BF:76:39:D6:11:5E:69:B8:35"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: coinspotdesktopapp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nalt-svc: h3=\":443\"; ma=2592000\r\ncontent-encoding: zstd\r\ncontent-type: text/html\r\ndate: Tue, 16 Jun 2026 07:45:13 GMT\r\netag: \"6a27a72c-b244\"\r\nlast-modified: Tue, 09 Jun 2026 05:39:56 GMT\r\nserver: nginx/1.31.1\r\nvary: Accept-Encoding\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx:1.31.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":45636,"size_decoded":12833,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (391)","md5":"4ea61cae0e78f742ae1eda73dbb52c18","sha1":"25459f4280f86812b81c9e56ae0dab2068a366cc","sha256":"793522f7827f342af687fb767bc95da17975c9ee0772fc8ee5240c909e688753","sha512":"e5cf9d9960f76fbba2a2f440ca3807ee94ee9cd72cf1fbc46b62067cd3aae00a54766baad54f5fedfc1735943db1c62cce6e8ea83354e917d7c9140001fa5205","ssdeep":"768:kLZsR5U4RTh2C9F6X76luioLWzppmpybns5xS:kLZs3U+hML6sxLWzppmmnMc","tlshash":"4023a557b1a32037751751aa7bf7534a7675d003c94aca253bec038c8fc2ad99a13b8e","first_seen":"2026-06-16T07:45:41.704841Z","last_seen":"2026-06-16T07:45:41.704841Z","times_seen":1,"resource_available":true,"data":null}},"time_used":264,"timings":{"blocked":-1,"dns":36,"connect":61,"send":0,"wait":64,"receive":0,"ssl":103},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-06-16","alert":"Detects file containing Telegram Bot API","trigger":"coinspotdesktopapp.com/","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-16","alert":"Sinkholed","trigger":"coinspotdesktopapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-16","alert":"Sinkholed","trigger":"coinspotdesktopapp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]}}]}