z23965b.top
Open in
urlscan Pro
2606:4700:3034::6815:41c0
Malicious Activity!
Public Scan
Effective URL: https://z23965b.top/
Submission: On March 29 via automatic, source openphish — Scanned from DE
Summary
TLS certificate: Issued by GTS CA 1P5 on March 11th 2024. Valid for: 3 months.
This is the only time z23965b.top was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Telegram (Instant Messenger)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
12 | 2606:4700:303... 2606:4700:3034::6815:41c0 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
22 | 2 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
z23965b.top
z23965b.top |
326 KB |
22 | 1 |
Domain | Requested by | |
---|---|---|
12 | z23965b.top |
z23965b.top
|
22 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
z23965b.top GTS CA 1P5 |
2024-03-11 - 2024-06-09 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://z23965b.top/
Frame ID: ECBFDFA384D6428A77703F7FDED70B41
Requests: 18 HTTP requests in this frame
Screenshot
Page Title
Telegram WebPage URL History Show full URLs
-
http://z23965b.top/
HTTP 307
https://z23965b.top/ Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://z23965b.top/
HTTP 307
https://z23965b.top/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
22 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
z23965b.top/ Redirect Chain
|
11 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.819061139ccc9269038f.css
z23965b.top/ |
405 KB 72 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style-desktop.7ec8ed3b19fabb19d057.css
z23965b.top/ |
338 B 504 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mtproto.worker.ac5b2b0ca237c0a6bdf9.chunk.js
z23965b.top/ |
742 KB 169 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
85.308e3be95e49c2e36d0d.bundle.js
z23965b.top/ |
8 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
116.bf21f7cbbf3e2038822b.bundle.js
z23965b.top/ |
24 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.9cc02d4d816eaf74c873.bundle.js
z23965b.top/ |
82 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
mtproto.worker.ac5b2b0ca237c0a6bdf9.chunk.js
z23965b.top/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
crypto.worker.aec39cf2478abcc434ba.chunk.js
z23965b.top/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
crypto.worker.aec39cf2478abcc434ba.chunk.js
z23965b.top/ |
24 KB 9 KB |
Fetch
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
z23965b.top/assets/img/ |
15 KB 4 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
104.b23fc99c0ad8aab75e1a.chunk.js
z23965b.top/ |
69 KB 21 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
301.8586974f41f40a1f65a9.chunk.js
z23965b.top/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
8.f400704066ccf1976603.chunk.js
z23965b.top/ |
24 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
41.6ab156a3a39d7a08893f.chunk.js
z23965b.top/ |
35 KB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
480.ae04319350676a95d995.chunk.js
z23965b.top/ |
1 MB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
709.a4e57090af591a963d94.chunk.js
z23965b.top/ |
5 KB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
0619f363-e1f5-4940-a28c-4cbd9debd497
https://z23965b.top/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
b492cc56-f71a-43f8-8dc3-8b83b27b32b3
https://z23965b.top/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
d276dc10-2768-4d37-b63e-0b9788fcd19c
https://z23965b.top/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
npm.qr-code-styling.f8f57a1c721e03c3f699.chunk.js
z23965b.top/ |
64 KB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logo_padded.svg
z23965b.top/assets/img/ |
1 KB 0 |
Fetch
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- z23965b.top
- URL
- https://z23965b.top/mtproto.worker.ac5b2b0ca237c0a6bdf9.chunk.js
- Domain
- z23965b.top
- URL
- https://z23965b.top/crypto.worker.aec39cf2478abcc434ba.chunk.js
- Domain
- z23965b.top
- URL
- blob:https://z23965b.top/0619f363-e1f5-4940-a28c-4cbd9debd497
- Domain
- z23965b.top
- URL
- blob:https://z23965b.top/b492cc56-f71a-43f8-8dc3-8b83b27b32b3
- Domain
- z23965b.top
- URL
- blob:https://z23965b.top/d276dc10-2768-4d37-b63e-0b9788fcd19c
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Telegram (Instant Messenger)57 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onpagereveal object| webpackChunktweb object| rootScope function| AppStorage object| stateStorage function| wrapUrl object| I18n object| webpWorkerController object| appStorage object| singleInstance object| webPushApiManager object| telegramMeWebManager object| opusDecodeController object| cryptoMessagePort object| mtprotoMessagePort object| serviceMessagePort object| apiManagerProxy function| calcImageInBox object| mediaSizes object| customProperties object| themeController function| formatDateAccordingToTodayNew function| fillTipDates function| dispatchHeavyAnimationEvent object| sequentialDom object| appDownloadManager object| appMediaPlaybackController object| appNavigationController object| liteMode object| windowSize function| getVisibleRect function| generatePathData function| p function| putPreloader function| getRichValueWithCaret function| compareNodes function| placeCaretAtEnd function| PopupNewMedia function| SlicedArray function| ScrollSaver object| internalLinkProcessor object| emoticonsDropdown object| appSidebarRight function| getStream function| getStreamCached object| groupCallController object| callsController object| appDialogsManager object| appSidebarLeft object| uiNotificationsManager object| appImManager object| syncedPlayers object| emojiRenderers function| wrapRichText object| animationIntersector object| lottieLoader object| pagesManager0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
z23965b.top
z23965b.top
2606:4700:3034::6815:41c0
01e3e93f0c28761d227195423db2f66c2a7eba747a95b559c7ca0e5ea6d84b57
12236c8acfa460e9988f4f19d93cd8b5db723e9ea06175eecd4401ae86188dd2
138d20dde55ea86511bff53e7b1fe7c2e6b4cf068e2870c11fb574536f1a3938
2304f98cb92141bf7089e22324733eff7cacf90420cd6dc73d2d98d093b75d4a
322deb24d6d5efcf38e98818033dc373a21e67a4535703a0bae2772b13d9f5ce
389d2677f2de7700a040e663b4c887032bba7cd52f473848a1b7f927464a7146
43227dbb16e25835a8df0eee2dff4e54b7a28a0465e38464faf36c73e1b2b8cd
5d850d375c0b28e6eb45ea7199114b604bf928c5664fa8b5357b661cfbe05ce5
71c69c4bc5e13b1fa195bed92fb5818ae00e516674c0e710322cf804197c8e8a
724d607cbb0fe2e93d7d91f0cf67cdc3bb62bd1ba94263ab98e76162d491b9bf
7e2388ec283fe17472ef02829a93da550af8f3ad4a975f50a0110bff61afe523
932e9a817af82373fc18ab3c39ad1bbc706d3b4e5979407c0ad4f5320b099136
b2508b04b3bef5275419629c0e3f1f01df2cf69c6c97c245373f49317a1a3b73
b841d55dd50ebb6a865238eac54c614f84c8e48c1c185cb4b64bd572eb1edbb8
b87b85206b3c9720d2b2ef6656720a8cc70b3fde9666a087ce5daa2b0dba6132
cc937c3ad4bb9c7647e2e2d7bf6ddda6a7afb2c3920a93fe734a8d86a8fa959b
eeb79b0ae5da35d3433de6edeec3a0e3cce9c24f517dbad26ed97e852666c8f4