Report - ivoireagro.net/myMINFIN/

Report Overview

Visitedpublic

2025-07-18 06:41:08

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
ivoireagro.net	unknown	2025-03-09	2025-07-18	2025-07-18	954 B	7.5 kB	172.67.207.78

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

Scan Date	Severity	Indicator	Alert
2025-07-18	medium	ivoireagro.net/myMINFIN/	Detects file containing Telegram Bot API
2025-07-18	medium	javascript.script.md5:eea41c5d40ec5bb6c0c4ec97dc905ed0	Detects file containing Telegram Bot API

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2025-07-18	medium	ivoireagro.net	Sinkholed

ThreatFox

No alerts detected

Telegram Bot detected (1)

URL

ivoireagro.net/myMINFIN/

IP / ASN

172.67.207.78

#13335 CLOUDFLARENET

Token

7618164306:AAFqEPAqyG8O9_xNKfhi9TnynslZyZjgaB4

Bot Overview

User ID7618164306

UsernamenoGamesBE_bot

First NamenoGAMES👐🏼

Last NameN/A

Chat Info

Chat ID7774435190

Chat Typeprivate

TitleN/A

User Count2

Admins0

Pending Msgs0

JavaScript (1)

URL

From

Size

First Seen

Last Seen

ivoireagro.net/myMINFIN/

ScriptElement

2.1 kB

2025-07-18

URL

ivoireagro.net/myMINFIN/

IP / ASN

172.67.207.78

#13335 CLOUDFLARENET

Introduced by ScriptElement

Embedded true

Resource Info

First Seen 2025-07-18

Last Seen 2025-07-18

Times Seen 1

Size 2.1 kB (2141 bytes)

MD5 eea41c5d40ec5bb6c0c4ec97dc905ed0

SHA1 5a183100b667472a539ee3008ecade92d9b9e5fc

SHA256 3a08ba8ec3deb0d49d3e1c972795653f58e828b1c8fa25d82bde3f86684a7cd0

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	Detects file containing Telegram Bot API

Format Code

HTTP Transactions (2)

URL IP Response Size

GET ivoireagro.net/myMINFIN/

172.67.207.78

200 OK

5.7 kB

URL

ivoireagro.net/myMINFIN/

IP / ASN

172.67.207.78

#13335 CLOUDFLARENET

Requested byN/A

Resource Info

File typeHTML document, Unicode text, UTF-8 text, with CRLF line terminators

First Seen2025-07-18

Last Seen2025-07-18

Times Seen1

Size5.7 kB (5700 bytes)

MD559d774d2e6acaaa5562fb899d295f3e4

SHA103c61f2294b279d8ce172b00a574e791759f0432

SHA2564861c48583f180748435300fff77ceb7177e84a89d0253fa164a7b5ff8306fe4

Certificate Info

IssuerGoogle Trust Services

Subjectivoireagro.net

Fingerprint1E:32:E5:E3:F6:28:46:F9:F2:CC:D5:95:2F:ED:56:7B:FF:EE:40:58

ValidityTue, 15 Jul 2025 17:38:32 GMT - Mon, 13 Oct 2025 18:34:03 GMT

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	Detects file containing Telegram Bot API
Quad9 DNS	malicious	Sinkholed
urlquery	suspicious	Suspicious - Suspicious Javascript code

HTTP Headers

GET /myMINFIN/ HTTP/1.1
Host: ivoireagro.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 18 Jul 2025 06:40:32 GMT
content-type: text/html
server: cloudflare
last-modified: Wed, 16 Jul 2025 21:43:53 GMT
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
vary: Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=qDU3Pe5BP9ZQrd07pGhV%2FJeNKFDdK3hYfqIuQx3xDxSHfG%2FawAeF8x2h64VWTerc6TRsEBb3VNx84RnTpz2UJzHWcJAqvOoi8FTiiQ%3D%3D"}]}
cf-cache-status: DYNAMIC
content-encoding: br
cf-ray: 960ffcfc89fdb4f9-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

GET ivoireagro.net/favicon.ico

172.67.207.78

404 Not Found

277 B

URL

ivoireagro.net/favicon.ico

IP / ASN

172.67.207.78

#13335 CLOUDFLARENET

Requested byhttps://ivoireagro.net/myMINFIN/

Resource Info

File typeHTML document, ASCII text

First Seen2025-07-18

Last Seen2025-07-18

Times Seen1

Size277 B (277 bytes)

MD5f4a3caded7c03ff7e7487b1ebbcca64f

SHA1d319e95e2505f4d183f51ef4687eb335ead92b6a

SHA256dd6118c8896e63a382e451b96c108c467140f94d91050796aab610449477dad4

Certificate Info

IssuerGoogle Trust Services

Subjectivoireagro.net

Fingerprint1E:32:E5:E3:F6:28:46:F9:F2:CC:D5:95:2F:ED:56:7B:FF:EE:40:58

ValidityTue, 15 Jul 2025 17:38:32 GMT - Mon, 13 Oct 2025 18:34:03 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: ivoireagro.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ivoireagro.net/myMINFIN/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 404 Not Found
date: Fri, 18 Jul 2025 06:40:33 GMT
content-type: text/html; charset=iso-8859-1
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FwXOPCyXwzlqEhQBJH5g8Gf5vf1xuKvt0IgmIJX5TL9sjVc%2FDZ7MOZNO7CDszR%2F9n8meXfU8m7TZSnmWhXX9%2B08ukgtrBAiTtt9NzrNi01gRhqHjT34oVzfoR1DWNstxKw%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=14400
cf-cache-status: EXPIRED
content-encoding: br
cf-ray: 960ffd012cf556a8-OSL
server: cloudflare
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2886&min_rtt=623&rtt_var=1642&sent=144&recv=202&lost=0&retrans=0&sent_bytes=12318&recv_bytes=11296&delivery_rate=594417&ss_exit_cwnd=14916&ss_exit_reason=2&cwnd=14000&unsent_bytes=0&cid=cfe8195747827287&ts=771&inflight_dur=57&x=40"