{"report_id":"fece6550-0a02-4d65-86a9-8595d01c9646","version":0,"status":"done","tags":["phishing","suspicious","telegram_bot"],"date":"2026-07-29T13:00:41Z","url":{"schema":"http","addr":"pw.pypexqb.net/EngTgred.html","fqdn":"pw.pypexqb.net","domain":"pypexqb.net","tld":"net"},"ip":{"addr":"45.130.167.92","port":0,"asn":36007,"as":"KAMATERA","country":"Japan","country_code":"JP"},"final":{"url":{"schema":"https","addr":"pw.pypexqb.net/EngTgred.html","fqdn":"pw.pypexqb.net","domain":"pypexqb.net","tld":"net"},"title":"Email Update","dom":{"size":6387,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"5c1b3da1c24c7a515d4913c97101da5e","sha1":"2258733de5873d341a5a5ff0479716c1e39c326f","sha256":"0dce4a30256218bd0e948902b40110d9a5356102bb1806348b2a0b9771f887e5","sha512":"8ad066d66b555aa4bc9592f56dc0f9e65e634710d30e0bb44446f58929468f697f2a23f59092f3289daeb5e7c9d4590fc97c712d43ddd01cd80f630d2061cc22","ssdeep":"192:Br5/+rNFMEFpF/9OAjqxt4FiLi3iebUnUn2iQuriyu4/:Br2FMEFpF+74FiLi3i0UnpiQ6iyb","tlshash":"08d1544b15670850a6a3e1fc37e7a7053560c013ae4ac8647f5ca79d8f4ae96d8b33cd","dom_hash":"domhashfbad14c8bbe4416ad4933980c48ba9a8","first_seen":"2026-07-29T13:00:39.882089Z","last_seen":"2026-08-04T16:40:13.73442Z","times_seen":3,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"pw.pypexqb.net/EngTgred.html","fqdn":"pw.pypexqb.net","domain":"pypexqb.net","tld":"net"},"ip":{"addr":"45.130.167.92","port":0,"asn":36007,"as":"KAMATERA","country":"Japan","country_code":"JP"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-02T13:00:41Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":3,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-07-29","alert":"Detects file containing Telegram Bot API","trigger":"pw.pypexqb.net/EngTgred.html","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic phishing","verdict":"phishing","severity":"medium","comment":"","tags":["phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"summary":[{"fqdn":"pw.pypexqb.net","ip":{"addr":"45.130.167.92","port":443,"asn":36007,"as":"KAMATERA","country":"Japan","country_code":"JP"},"domain_registered":"2026-07-11","domain_rank":0,"first_seen":"2026-07-29T12:54:32.662617Z","last_seen":"2026-07-29T12:54:32.662617Z","alert_count":3,"request_count":2,"received_data":7196,"sent_data":1013,"comment":"","tags":null,"fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":[{"url":{"schema":"https","addr":"pw.pypexqb.net/EngTgred.html","fqdn":"pw.pypexqb.net","domain":"pypexqb.net","tld":"net"},"ip":{"addr":"45.130.167.92","port":443,"asn":36007,"as":"KAMATERA","country":"Japan","country_code":"JP"},"md5":"a08df5e4d351a3e371e9c3b09686e7be","sha1":"68c37fa2ca9b6b4c6d364919fb2cf99271aceaf5","sha256":"21b50024b1afcb957a321bc9f9b8cde78ce8d5be42ffb3ceca659dc3894e3868","sha512":"958a1de68bee53a1e6e409ad60f10980c431fc8ad7ff28cec22f6ca65018abf835d0dcecf905fc8549cb49c793c2a27212343615cbe4a79c9ff23645940ab05c","size":3040,"token":"8600508694:AAERk6OfmYaXaesXI1sf93zFllNFa8BoN8M","is_revoked":false,"bot":{"token":"8600508694:AAERk6OfmYaXaesXI1sf93zFllNFa8BoN8M","user_id":"8600508694","username":"ISHOSTTINBot","first_name":"ISHOSTTINbot","last_name":"","chat":{"chat_id":"1425685154","title":"","type":"private","bot_is":"member","total_users":2,"active_members":null,"admins":null},"pending_messages":1}}],"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic phishing","verdict":"phishing","severity":"medium","comment":"","tags":["phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"pw.pypexqb.net/EngTgred.html","fqdn":"pw.pypexqb.net","domain":"pypexqb.net","tld":"net"},"ip":{"addr":"45.130.167.92","port":443,"asn":36007,"as":"KAMATERA","country":"Japan","country_code":"JP"},"introduction_type":"scriptElement","is_inline":true,"md5":"a08df5e4d351a3e371e9c3b09686e7be","sha1":"68c37fa2ca9b6b4c6d364919fb2cf99271aceaf5","sha256":"21b50024b1afcb957a321bc9f9b8cde78ce8d5be42ffb3ceca659dc3894e3868","sha512":"958a1de68bee53a1e6e409ad60f10980c431fc8ad7ff28cec22f6ca65018abf835d0dcecf905fc8549cb49c793c2a27212343615cbe4a79c9ff23645940ab05c","ssdeep":"","tlshash":"0c51119b111718a007b7a2ed324ba314316191273d85d460be1cd66a4f5aea6fcb73ce","size":3040,"data":"","first_seen":"2026-07-29T13:00:39.889055Z","last_seen":"2026-08-04T16:40:13.744713Z","times_seen":3,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-07-29","alert":"Detects file containing Telegram Bot API","trigger":"pw.pypexqb.net/EngTgred.html","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"pw.pypexqb.net/EngTgred.html","fqdn":"pw.pypexqb.net","domain":"pypexqb.net","tld":"net"},"ip":{"addr":"45.130.167.92","port":443,"asn":36007,"as":"KAMATERA","country":"Japan","country_code":"JP"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-29T13:00:14.571Z","timestamp":1785330014571,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"pw.pypexqb.net","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 17:54:18 GMT","end":"Tue, 20 Oct 2026 17:54:17 GMT"},"fingerprint":{"sha1":"82:EB:77:14:4E:38:73:DB:8D:23:53:8D:E4:68:3E:8A:0A:3B:33:21","sha256":"13:0A:A7:76:B7:80:55:7D:03:83:F5:28:05:04:03:2E:94:7F:23:3C:45:87:24:45:47:4E:49:4A:07:89:F5:12"}}},"request":{"raw":"GET /EngTgred.html HTTP/1.1\r\nHost: pw.pypexqb.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 29 Jul 2026 13:00:10 GMT\r\nServer: Apache\r\nLast-Modified: Wed, 29 Jul 2026 09:23:39 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 6398\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: text/html\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":6398,"size_decoded":6641,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"01ba28af943e1d491b0b6c20385dcf64","sha1":"ae49fdce58a71c17fb1c288867f208e5e98bf009","sha256":"6c6e885cf8393d64ffe379e3bdf123fb0bb0c0eaffa64a694d93a682cfcd4539","sha512":"7f4d7634514a7c8fadcdbfd503ff76acfc64b1c1b58b6bd7cfbf1b5b2b42efd34f8c6ec60cd099e139c8db11afca02e412e350008d1250928bb0d08478b4f019","ssdeep":"192:L5/+rNFMEFpF/9OAjq/tSFiLi3iebUnUn2iQuriyu4Vz:L2FMEFpF+FSFiLi3i0UnpiQ6iyp","tlshash":"dcd1445b15670850a6a3e1fc3be7a7053160c013ae4ac8647f5ca39d8f4ae96d9b33cd","first_seen":"2026-07-29T13:00:39.884993Z","last_seen":"2026-08-04T16:40:13.7387Z","times_seen":3,"resource_available":false,"data":null}},"time_used":826,"timings":{"blocked":-1,"dns":3,"connect":273,"send":0,"wait":273,"receive":0,"ssl":277},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-07-29","alert":"Detects file containing Telegram Bot API","trigger":"pw.pypexqb.net/EngTgred.html","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic phishing","verdict":"phishing","severity":"medium","comment":"","tags":["phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]}},{"url":{"schema":"https","addr":"pw.pypexqb.net/favicon.ico","fqdn":"pw.pypexqb.net","domain":"pypexqb.net","tld":"net"},"ip":{"addr":"45.130.167.92","port":443,"asn":36007,"as":"KAMATERA","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pw.pypexqb.net/EngTgred.html","date":"2026-07-29T13:00:15.619Z","timestamp":1785330015619,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"pw.pypexqb.net","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 22 Jul 2026 17:54:18 GMT","end":"Tue, 20 Oct 2026 17:54:17 GMT"},"fingerprint":{"sha1":"82:EB:77:14:4E:38:73:DB:8D:23:53:8D:E4:68:3E:8A:0A:3B:33:21","sha256":"13:0A:A7:76:B7:80:55:7D:03:83:F5:28:05:04:03:2E:94:7F:23:3C:45:87:24:45:47:4E:49:4A:07:89:F5:12"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: pw.pypexqb.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://pw.pypexqb.net/EngTgred.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nDate: Wed, 29 Jul 2026 13:00:11 GMT\r\nServer: Apache\r\nContent-Length: 355\r\nKeep-Alive: timeout=5, max=99\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":355,"size_decoded":555,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"4525b2d648f7c457a689fd96421783a5","sha1":"11bfe30ce44585a15a38e86bc094224ddfe2c08e","sha256":"cc0b4e42510d49c6decd464123ecf3b14ae9b47f9b4ed2ee64893e2d6520a264","sha512":"94e3e8246cf38ff7740e51aa115c8c455b14f78e672c2686b782c0ce30b6fa2dbd91a78b29b3964d9c0414aabd4b9391fd5db326665e25b4b8e73dae60ffe979","ssdeep":"","tlshash":"71e0c04f4057b3474011a2907dc01291e505236b38a152f93ac09467500897dc4aa2dd","first_seen":"2025-12-09T03:51:58.5943Z","last_seen":"2026-08-15T06:36:30.924678Z","times_seen":57700,"resource_available":true,"data":null}},"time_used":274,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":274,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}