urlscan.io logo urlscan.io
SecurityTrails logo

telegarmt.rr.nu Open in urlscan Pro
43.134.78.84  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://telegarmt.rr.nu/en/
Submission: On November 05 via automatic, source openphish — Scanned from SG
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 3 countries across 4 domains to perform 28 HTTP transactions. The main IP is 43.134.78.84, located in Singapore, Singapore and belongs to TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN. The main domain is telegarmt.rr.nu.
TLS certificate: Issued by R11 on September 11th 2024. Valid for: 3 months.
This is the only time telegarmt.rr.nu was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Telegram (Instant Messenger)

Domain & IP information

IP Address AS Autonomous System
9 43.134.78.84 132203 (TENCENT-N...)
2 13.107.246.59 8075 (MICROSOFT...)
1 79.127.235.11 60068 (CDN77 _)
1 2 52.231.230.148 8075 (MICROSOFT...)
1 1 13.107.21.237 8068 (MICROSOFT...)
1 51.8.71.184 8075 (MICROSOFT...)
28 6
9    43.134.78.84 (Singapore, Singapore)

ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN)
telegarmt.rr.nu
2    13.107.246.59 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
www.clarity.ms
1    79.127.235.11 (Singapore, Singapore)

ASN60068 (CDN77 _, GB)
PTR: 424630499.sgp.cdn77.com
img.icons8.com
2    52.231.230.148 (Busan, Korea, Republic Of)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
c.clarity.ms
1    13.107.21.237 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
c.bing.com
1    51.8.71.184 (Washington, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
a.clarity.ms
Apex Domain
Subdomains		 Transfer
9 rr.nu
telegarmt.rr.nu
223 KB
5 clarity.ms
www.clarity.ms — Cisco Umbrella Rank: 634
c.clarity.ms — Cisco Umbrella Rank: 1236
a.clarity.ms — Cisco Umbrella Rank: 16947
30 KB
1 bing.com
c.bing.com — Cisco Umbrella Rank: 190
772 B
1 icons8.com
img.icons8.com — Cisco Umbrella Rank: 31783
2 KB
28 4
Domain Requested by
9 telegarmt.rr.nu telegarmt.rr.nu
2 c.clarity.ms 1 redirects
2 www.clarity.ms telegarmt.rr.nu
www.clarity.ms
1 a.clarity.ms www.clarity.ms
1 c.bing.com 1 redirects
1 img.icons8.com telegarmt.rr.nu
28 6

This site contains no links.

Subject Issuer Validity Valid
telegarmo.rr.nu
R11		 2024-09-11 -
2024-12-10		 3 months crt.sh
www.clarity.ms
DigiCert TLS RSA SHA256 2020 CA1		 2024-09-04 -
2025-09-04		 a year crt.sh
1004834818.rsc.cdn77.org
E6		 2024-09-02 -
2024-12-01		 3 months crt.sh
a.clarity.ms
Microsoft Azure RSA TLS Issuing CA 08		 2024-06-23 -
2025-06-18		 a year crt.sh

This page contains 2 frames:

Primary Page: https://telegarmt.rr.nu/en/
Frame ID: D1E2929741F07022783200D945E17818
Requests: 25 HTTP requests in this frame

Frame: https://telegarmt.rr.nu/load.html
Frame ID: 68DA02404DCA79297176FC73564D0852
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Telegram Web

Page Statistics

28
Requests

46 %
HTTPS

0 %
IPv6

4
Domains

6
Subdomains

6
IPs

3
Countries

255 kB
Transfer

970 kB
Size

10
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 26
  • https://c.clarity.ms/c.gif HTTP 302
  • https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=FE8623D337574238A71A516C3CCA56BF&RedC=c.clarity.ms&MXFR=203D4B17EB3C65991C365E39EF3C6B19 HTTP 302
  • https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=FE8623D337574238A71A516C3CCA56BF&MUID=3B2C624BEA9F63612E4D7765EBDA6200

28 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
telegarmt.rr.nu/en/ 		13 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://telegarmt.rr.nu/en/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
43.134.78.84 Singapore, Singapore, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN),
Reverse DNS
Software
nginx /
Resource Hash
1eab20824bed8aac3920c551acc9e5029f6138321fa8b8824ebaf2cb8ddf9765
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

content-encoding
gzip
content-type
text/html
date
Tue, 05 Nov 2024 01:18:08 GMT
etag
W/"671e797d-354d"
last-modified
Sun, 27 Oct 2024 17:33:49 GMT
server
nginx
strict-transport-security
max-age=31536000
vary
Accept-Encoding
index-XZA1-3MU.js
telegarmt.rr.nu/en/ 		128 KB
51 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://telegarmt.rr.nu/en/index-XZA1-3MU.js
Requested by
Host: telegarmt.rr.nu
URL: https://telegarmt.rr.nu/en/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
43.134.78.84 Singapore, Singapore, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN),
Reverse DNS
Software
nginx /
Resource Hash
17e0c86d87c90055aa9a393a20a431bb89cb58a3fd0003046bbfd8f7c22e6c3b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://telegarmt.rr.nu
Referer
https://telegarmt.rr.nu/en/

Response headers

strict-transport-security
max-age=31536000
cache-control
max-age=43200
content-encoding
gzip
etag
W/"671e797a-1fedf"
expires
Tue, 05 Nov 2024 13:18:08 GMT
date
Tue, 05 Nov 2024 01:18:08 GMT
content-type
application/javascript
last-modified
Sun, 27 Oct 2024 17:33:46 GMT
server
nginx
vary
Accept-Encoding
index-pzR5gIOz.css
telegarmt.rr.nu/en/ 		440 KB
95 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://telegarmt.rr.nu/en/index-pzR5gIOz.css
Requested by
Host: telegarmt.rr.nu
URL: https://telegarmt.rr.nu/en/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
43.134.78.84 Singapore, Singapore, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN),
Reverse DNS
Software
nginx /
Resource Hash
6e8f2da9c344b748747fe5b0c3c3e6ff3fe08e1829f2a6aee736dd6697d9ea0c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://telegarmt.rr.nu
Referer
https://telegarmt.rr.nu/en/

Response headers

strict-transport-security
max-age=31536000
cache-control
max-age=43200
content-encoding
gzip
etag
W/"671e797d-6de14"
expires
Tue, 05 Nov 2024 13:18:08 GMT
date
Tue, 05 Nov 2024 01:18:08 GMT
content-type
text/css
last-modified
Sun, 27 Oct 2024 17:33:49 GMT
server
nginx
vary
Accept-Encoding
login_k.js
telegarmt.rr.nu/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://telegarmt.rr.nu/login_k.js
Requested by
Host: telegarmt.rr.nu
URL: https://telegarmt.rr.nu/en/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
43.134.78.84 Singapore, Singapore, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN),
Reverse DNS
Software
nginx /
Resource Hash
6e3a461f643f193d1efe96c972fe9e19e4bc62772ff57faa8758374e0406bf75
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://telegarmt.rr.nu/en/

Response headers

strict-transport-security
max-age=31536000
cache-control
max-age=43200
content-encoding
gzip
etag
W/"671e7996-1418"
expires
Tue, 05 Nov 2024 13:18:08 GMT
date
Tue, 05 Nov 2024 01:18:08 GMT
content-type
application/javascript
last-modified
Sun, 27 Oct 2024 17:34:14 GMT
server
nginx
vary
Accept-Encoding
myoahvyz0x
www.clarity.ms/tag/ 		707 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.clarity.ms/tag/myoahvyz0x
Requested by
Host: telegarmt.rr.nu
URL: https://telegarmt.rr.nu/login_k.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
13.107.246.59 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
063ce514e1131db57955965bf24809f82660229de67ff31674941f280c919dd3

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://telegarmt.rr.nu/

Response headers

cache-control
no-cache, no-store
request-context
appId=cid-v1:3f60b293-70d6-4805-b0bb-3484f0a73bf0
expires
-1
accept-ranges
bytes
x-cache
CONFIG_NOCACHE
content-length
707
date
Tue, 05 Nov 2024 01:18:08 GMT
content-type
application/x-javascript
x-azure-ref
20241105T011808Z-18557d4f7b8cdlk7hC1SGEb0x8000000034g000000001du9
mtproto.worker-ADXTIUZK.js
telegarmt.rr.nu/en/ Frame 		0
0
crypto.worker-T8uEdtAd.js
telegarmt.rr.nu/en/ Frame 		0
0
truncated
/ 		369 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6f2cf0c99091af44641cb27eee6a0f32a56aa85f446f60a9482864f2ade413d4

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml
crypto.worker-T8uEdtAd.js
telegarmt.rr.nu/en/ 		67 KB
26 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://telegarmt.rr.nu/en/crypto.worker-T8uEdtAd.js
Requested by
Host: telegarmt.rr.nu
URL: https://telegarmt.rr.nu/en/index-XZA1-3MU.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
43.134.78.84 Singapore, Singapore, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN),
Reverse DNS
Software
nginx /
Resource Hash
19fb2e2b1a73081d0be43d40c28e85d6875138f1f0b89c8a1837c3e806d578b3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://telegarmt.rr.nu/en/

Response headers

strict-transport-security
max-age=31536000
cache-control
max-age=43200
content-encoding
gzip
etag
W/"671e797a-10d02"
expires
Tue, 05 Nov 2024 13:18:08 GMT
date
Tue, 05 Nov 2024 01:18:08 GMT
content-type
application/javascript
last-modified
Sun, 27 Oct 2024 17:33:46 GMT
server
nginx
vary
Accept-Encoding
truncated
/ 		59 B
59 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/jxl
truncated
/ 		311 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
04dfc8e1a6e59e36a3a3a5c15443a97a92a6d2a7da9d276b050d58be3c7952a7

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/avif
load.html
telegarmt.rr.nu/ Frame 68DA 		2 KB
972 B 		Document
General
Check archive.org
Download Go to
Full URL
https://telegarmt.rr.nu/load.html
Requested by
Host: telegarmt.rr.nu
URL: https://telegarmt.rr.nu/login_k.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
43.134.78.84 Singapore, Singapore, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN),
Reverse DNS
Software
nginx /
Resource Hash
716e7f1ae038828bc9e00fa972d6ef2da468bff4b07b2f8ffa796a29536b00b4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://telegarmt.rr.nu/en/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

content-encoding
gzip
content-type
text/html
date
Tue, 05 Nov 2024 01:18:08 GMT
etag
W/"671e7981-6d0"
last-modified
Sun, 27 Oct 2024 17:33:53 GMT
server
nginx
strict-transport-security
max-age=31536000
vary
Accept-Encoding
lang-Y4EV1698.js
telegarmt.rr.nu/en/ 		114 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://telegarmt.rr.nu/en/lang-Y4EV1698.js
Requested by
Host: telegarmt.rr.nu
URL: https://telegarmt.rr.nu/en/index-XZA1-3MU.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
43.134.78.84 Singapore, Singapore, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN),
Reverse DNS
Software
nginx /
Resource Hash
b16cfc78065c0a3848ca1fd44831e2792d5371dd614cbeb4aacfed1440963eae
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://telegarmt.rr.nu
Referer
https://telegarmt.rr.nu/en/index-XZA1-3MU.js

Response headers

strict-transport-security
max-age=31536000
cache-control
max-age=43200
content-encoding
gzip
etag
W/"671e797d-1c9cc"
expires
Tue, 05 Nov 2024 13:18:08 GMT
date
Tue, 05 Nov 2024 01:18:08 GMT
content-type
application/javascript
last-modified
Sun, 27 Oct 2024 17:33:49 GMT
server
nginx
vary
Accept-Encoding
langSign-lcKrqmwM.js
telegarmt.rr.nu/en/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://telegarmt.rr.nu/en/langSign-lcKrqmwM.js
Requested by
Host: telegarmt.rr.nu
URL: https://telegarmt.rr.nu/en/index-XZA1-3MU.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
43.134.78.84 Singapore, Singapore, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN),
Reverse DNS
Software
nginx /
Resource Hash
900f22723c45f67600638812021437a089daa7c2f0a559ebb85a0726183cee79
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://telegarmt.rr.nu
Referer
https://telegarmt.rr.nu/en/index-XZA1-3MU.js

Response headers

strict-transport-security
max-age=31536000
cache-control
max-age=43200
content-encoding
gzip
etag
W/"671e797d-66e"
expires
Tue, 05 Nov 2024 13:18:08 GMT
date
Tue, 05 Nov 2024 01:18:08 GMT
content-type
application/javascript
last-modified
Sun, 27 Oct 2024 17:33:49 GMT
server
nginx
vary
Accept-Encoding
countries-lRU-UavE.js
telegarmt.rr.nu/en/ 		24 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://telegarmt.rr.nu/en/countries-lRU-UavE.js
Requested by
Host: telegarmt.rr.nu
URL: https://telegarmt.rr.nu/en/index-XZA1-3MU.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
43.134.78.84 Singapore, Singapore, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN),
Reverse DNS
Software
nginx /
Resource Hash
8528a55ba5d25bb2b6463f369b7a2046c08ced5f20256978a06119c0d50d08a2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://telegarmt.rr.nu
Referer
https://telegarmt.rr.nu/en/index-XZA1-3MU.js

Response headers

strict-transport-security
max-age=31536000
cache-control
max-age=43200
content-encoding
gzip
etag
W/"671e797d-5e21"
expires
Tue, 05 Nov 2024 13:18:08 GMT
date
Tue, 05 Nov 2024 01:18:08 GMT
content-type
application/javascript
last-modified
Sun, 27 Oct 2024 17:33:49 GMT
server
nginx
vary
Accept-Encoding
/
img.icons8.com/ Frame 68DA 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.icons8.com/?size=100&id=lH4FKvmj0iIQ&format=png
Requested by
Host: telegarmt.rr.nu
URL: https://telegarmt.rr.nu/load.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
79.127.235.11 Singapore, Singapore, ASN60068 (CDN77 _, GB),
Reverse DNS
424630499.sgp.cdn77.com
Software
CDN77-Turbo /
Resource Hash
c6569f9561d2c42ea7de49ef1e2331a658eb9801af9bce7de2101ca858ac1f2d
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://telegarmt.rr.nu/

Response headers

from-mongo-cache
true
icon-format
png
not-found-platform
false
x-77-cache
HIT
icon-id
lH4FKvmj0iIQ
date
Tue, 05 Nov 2024 01:18:08 GMT
content-type
image/png
x-77-nzt-ray
e3584f19a53627935072296731dcfa26
last-modified
Thu, 31 Oct 2024 09:59:26
strict-transport-security
max-age=15724800; includeSubDomains
x-77-nzt
EwgBT3/rCgFBDAFZu6IsAfczLwQADAElE8I0AbfpEgAA
cache-control
public, max-age=302400
accept-ranges
bytes
access-control-allow-origin
*
x-77-pop
singaporeSG
content-length
2067
icon-size
100
x-77-age
274227
from-redis-cache
false
version
0.0.29
server
CDN77-Turbo
pageSignQR-bI2rYqWN.js
telegarmt.rr.nu/en/ 		6 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
https://telegarmt.rr.nu/en/pageSignQR-bI2rYqWN.js
Requested by
Host: telegarmt.rr.nu
URL: https://telegarmt.rr.nu/en/index-XZA1-3MU.js
Protocol
H2
Server
-, , ASN (),
Reverse DNS
Software
nginx /
Resource Hash
325f7766220ab8219abd6d0c7e04d5c6d99a491d0f9be6a15eca08f16b150fa5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://telegarmt.rr.nu
Referer

Response headers

strict-transport-security
max-age=31536000
cache-control
max-age=43200
content-encoding
gzip
etag
W/"671e797a-162f"
expires
Tue, 05 Nov 2024 13:18:08 GMT
date
Tue, 05 Nov 2024 01:18:08 GMT
content-type
application/javascript
last-modified
Sun, 27 Oct 2024 17:33:46 GMT
server
nginx
vary
Accept-Encoding
page-eb81Un_i.js
telegarmt.rr.nu/en/ 		10 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
https://telegarmt.rr.nu/en/page-eb81Un_i.js
Requested by
Host: telegarmt.rr.nu
URL: https://telegarmt.rr.nu/en/index-XZA1-3MU.js
Protocol
H2
Server
-, , ASN (),
Reverse DNS
Software
nginx /
Resource Hash
48cde64efcc80711b88bae30629af7a00b6c2d34ec4425c4b7d7a9b83628db84
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://telegarmt.rr.nu
Referer

Response headers

strict-transport-security
max-age=31536000
cache-control
max-age=43200
content-encoding
gzip
etag
W/"671e797a-2868"
expires
Tue, 05 Nov 2024 13:18:08 GMT
date
Tue, 05 Nov 2024 01:18:08 GMT
content-type
application/javascript
last-modified
Sun, 27 Oct 2024 17:33:46 GMT
server
nginx
vary
Accept-Encoding
button-aS2SE0kp.js
telegarmt.rr.nu/en/ 		9 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
https://telegarmt.rr.nu/en/button-aS2SE0kp.js
Requested by
Host: telegarmt.rr.nu
URL: https://telegarmt.rr.nu/en/index-XZA1-3MU.js
Protocol
H2
Server
-, , ASN (),
Reverse DNS
Software
nginx /
Resource Hash
ad7184835ad021d3015b04b08acc989f05818f9178dbf0226155524e9842871a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://telegarmt.rr.nu
Referer

Response headers

strict-transport-security
max-age=31536000
cache-control
max-age=43200
content-encoding
gzip
etag
W/"671e797a-225e"
expires
Tue, 05 Nov 2024 13:18:08 GMT
date
Tue, 05 Nov 2024 01:18:08 GMT
content-type
application/javascript
last-modified
Sun, 27 Oct 2024 17:33:46 GMT
server
nginx
vary
Accept-Encoding
putPreloader--f-Xu9AG.js
telegarmt.rr.nu/en/ 		699 B
0 		Script
General
Check archive.org
Download Go to
Full URL
https://telegarmt.rr.nu/en/putPreloader--f-Xu9AG.js
Requested by
Host: telegarmt.rr.nu
URL: https://telegarmt.rr.nu/en/index-XZA1-3MU.js
Protocol
H2
Server
-, , ASN (),
Reverse DNS
Software
nginx /
Resource Hash
f12e62f05d48be6be0d36b76dbda5d0f723cd94de6f7851bbc4ed0191994b4dd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://telegarmt.rr.nu
Referer

Response headers

strict-transport-security
max-age=31536000
cache-control
max-age=43200
etag
"671e797d-2bb"
expires
Tue, 05 Nov 2024 13:18:08 GMT
accept-ranges
bytes
content-length
699
date
Tue, 05 Nov 2024 01:18:08 GMT
content-type
application/javascript
last-modified
Sun, 27 Oct 2024 17:33:49 GMT
server
nginx
textToSvgURL-Z4O-nL1S.js
telegarmt.rr.nu/en/ 		357 B
0 		Script
General
Check archive.org
Download Go to
Full URL
https://telegarmt.rr.nu/en/textToSvgURL-Z4O-nL1S.js
Requested by
Host: telegarmt.rr.nu
URL: https://telegarmt.rr.nu/en/index-XZA1-3MU.js
Protocol
H2
Server
-, , ASN (),
Reverse DNS
Software
nginx /
Resource Hash
36cb02e59322028c02c5365bd56cbd129b3eb2fb4aaec625160ca2dc9786a4bd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://telegarmt.rr.nu
Referer

Response headers

strict-transport-security
max-age=31536000
cache-control
max-age=43200
etag
"671e797d-165"
expires
Tue, 05 Nov 2024 13:18:08 GMT
accept-ranges
bytes
content-length
357
date
Tue, 05 Nov 2024 01:18:08 GMT
content-type
application/javascript
last-modified
Sun, 27 Oct 2024 17:33:49 GMT
server
nginx
7ce86b6c-6c01-4365-bf7e-d51ef6b5db64
https://telegarmt.rr.nu/ Frame 		0
0
1402f434-ab7d-4aa8-a379-7c2fa2f95795
https://telegarmt.rr.nu/ Frame 		0
0
35e9f8bb-639a-405d-baeb-ddf81df46d76
https://telegarmt.rr.nu/ Frame 		0
0
qr-code-styling-ogpV7fl-.js
telegarmt.rr.nu/en/ 		65 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
https://telegarmt.rr.nu/en/qr-code-styling-ogpV7fl-.js
Requested by
Host: telegarmt.rr.nu
URL: https://telegarmt.rr.nu/en/index-XZA1-3MU.js
Protocol
H2
Server
-, , ASN (),
Reverse DNS
Software
nginx /
Resource Hash
6c4900d40f3335423817340edddd7655d96e707156923fcf3cbf5a6520008d6e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://telegarmt.rr.nu
Referer

Response headers

strict-transport-security
max-age=31536000
cache-control
max-age=43200
content-encoding
gzip
etag
W/"671e797d-10254"
expires
Tue, 05 Nov 2024 13:18:08 GMT
date
Tue, 05 Nov 2024 01:18:08 GMT
content-type
application/javascript
last-modified
Sun, 27 Oct 2024 17:33:49 GMT
server
nginx
vary
Accept-Encoding
_commonjsHelpers-5-cIlDoe.js
telegarmt.rr.nu/en/ 		290 B
0 		Script
General
Check archive.org
Download Go to
Full URL
https://telegarmt.rr.nu/en/_commonjsHelpers-5-cIlDoe.js
Requested by
Host: telegarmt.rr.nu
URL: https://telegarmt.rr.nu/en/index-XZA1-3MU.js
Protocol
H2
Server
-, , ASN (),
Reverse DNS
Software
nginx /
Resource Hash
a8df41d98a0fa3d1cb8c8661377ac1a572beb9cd0b68e968f92d69f7c8331483
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://telegarmt.rr.nu
Referer

Response headers

strict-transport-security
max-age=31536000
cache-control
max-age=43200
etag
"671e797d-122"
expires
Tue, 05 Nov 2024 13:18:08 GMT
accept-ranges
bytes
content-length
290
date
Tue, 05 Nov 2024 01:18:08 GMT
content-type
application/javascript
last-modified
Sun, 27 Oct 2024 17:33:49 GMT
server
nginx
clarity.js
www.clarity.ms/s/0.7.53/ 		65 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.clarity.ms/s/0.7.53/clarity.js
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/tag/myoahvyz0x
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
13.107.246.59 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
6cbfddb4735bdca8b4d594c0222541a0aa1f53ee6b4359647960ed164f595863

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://telegarmt.rr.nu/

Response headers

x-azure-ref
20241105T011808Z-18557d4f7b8cdlk7hC1SGEb0x8000000034g000000001dv9
cache-control
public, max-age=86400
x-ms-version
2018-03-28
content-encoding
br
etag
W/"0x8DCFCF01CE35FFD"
x-fd-int-roxy-purgeid
51562430
x-ms-request-id
a83e43ec-801e-0067-38d9-2e3e27000000
access-control-allow-origin
*
x-cache
TCP_HIT
date
Tue, 05 Nov 2024 01:18:08 GMT
content-type
application/javascript;charset=utf-8
vary
Accept-Encoding
last-modified
Mon, 04 Nov 2024 16:45:38 GMT
c.gif
c.clarity.ms/
Redirect Chain
  • https://c.clarity.ms/c.gif
  • https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=FE8623D337574238A71A516C3CCA56BF&RedC=c.clarity.ms&MXFR=203D4B17EB3C65991C365E39EF3C6B19
  • https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=FE8623D337574238A71A516C3CCA56BF&MUID=3B2C624BEA9F63612E4D7765EBDA6200
42 B
443 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=FE8623D337574238A71A516C3CCA56BF&MUID=3B2C624BEA9F63612E4D7765EBDA6200
Protocol
H2
Server
52.231.230.148 Busan, Korea, Republic Of, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://telegarmt.rr.nu/

Response headers

cache-control
private, no-cache, proxy-revalidate, no-store
pragma
no-cache
etag
"58964c231919db1:0"
accept-ranges
bytes
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
content-length
42
date
Tue, 05 Nov 2024 01:18:08 GMT
content-type
image/gif
last-modified
Tue, 08 Oct 2024 00:29:29 GMT
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET

Redirect headers

cache-control
private, no-cache, proxy-revalidate, no-store
location
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=FE8623D337574238A71A516C3CCA56BF&MUID=3B2C624BEA9F63612E4D7765EBDA6200
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 23854820D9E747948FF13365925939F4 Ref B: SG1EDGE0113 Ref C: 2024-11-05T01:18:09Z
x-cache
CONFIG_NOCACHE
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
content-length
0
date
Tue, 05 Nov 2024 01:18:08 GMT
x-powered-by
ASP.NET
favicon.ico
telegarmt.rr.nu/en/assets/img/ 		15 KB
0 		Other
General
Check archive.org
Download Go to
Full URL
https://telegarmt.rr.nu/en/assets/img/favicon.ico?v=jw3mK7G9Ry
Protocol
H2
Server
-, , ASN (),
Reverse DNS
Software
nginx /
Resource Hash
7e2388ec283fe17472ef02829a93da550af8f3ad4a975f50a0110bff61afe523
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://telegarmt.rr.nu/en/

Response headers

strict-transport-security
max-age=31536000
etag
"671e797a-3aee"
accept-ranges
bytes
content-length
15086
date
Tue, 05 Nov 2024 01:18:08 GMT
content-type
image/x-icon
last-modified
Sun, 27 Oct 2024 17:33:46 GMT
server
nginx
collect
a.clarity.ms/ 		0
279 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://a.clarity.ms/collect
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.53/clarity.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
51.8.71.184 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept
application/x-clarity-gzip
Referer
https://telegarmt.rr.nu/

Response headers

Request-Context
appId=cid-v1:9c7c879b-c51a-427e-9701-218438da5f81
Access-Control-Allow-Origin
https://telegarmt.rr.nu
Date
Tue, 05 Nov 2024 01:18:09 GMT
Vary
Origin
Server
nginx
Connection
keep-alive
Access-Control-Allow-Credentials
true
logo_padded.svg
telegarmt.rr.nu/en/assets/img/ 		1 KB
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://telegarmt.rr.nu/en/assets/img/logo_padded.svg
Requested by
Host: telegarmt.rr.nu
URL: https://telegarmt.rr.nu/en/pageSignQR-bI2rYqWN.js
Protocol
H2
Server
-, , ASN (),
Reverse DNS
Software
nginx /
Resource Hash
eeb79b0ae5da35d3433de6edeec3a0e3cce9c24f517dbad26ed97e852666c8f4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://telegarmt.rr.nu/en/

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
etag
W/"671e797d-42d"
date
Tue, 05 Nov 2024 01:18:12 GMT
content-type
image/svg+xml
last-modified
Sun, 27 Oct 2024 17:33:49 GMT
server
nginx
vary
Accept-Encoding
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
eeb79b0ae5da35d3433de6edeec3a0e3cce9c24f517dbad26ed97e852666c8f4

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml;charset=utf-8

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
telegarmt.rr.nu
URL
https://telegarmt.rr.nu/en/mtproto.worker-ADXTIUZK.js
Domain
telegarmt.rr.nu
URL
https://telegarmt.rr.nu/en/crypto.worker-T8uEdtAd.js
Domain
telegarmt.rr.nu
URL
blob:https://telegarmt.rr.nu/7ce86b6c-6c01-4365-bf7e-d51ef6b5db64
Domain
telegarmt.rr.nu
URL
blob:https://telegarmt.rr.nu/1402f434-ab7d-4aa8-a379-7c2fa2f95795
Domain
telegarmt.rr.nu
URL
blob:https://telegarmt.rr.nu/35e9f8bb-639a-405d-baeb-ddf81df46d76

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Telegram (Instant Messenger)

36 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| login_status function| getpass function| getphone function| hide_Button function| load function| clarity object| rootScope function| deferredPromise function| AppStorage object| stateStorage function| wrapUrl object| I18n object| webpWorkerController object| appStorage object| singleInstance object| webPushApiManager object| telegramMeWebManager object| opusDecodeController object| cryptoMessagePort object| mtprotoMessagePort object| serviceMessagePort object| apiManagerProxy function| calcImageInBox object| mediaSizes object| customProperties object| windowSize object| liteMode object| themeController object| overlayCounter function| formatDateAccordingToTodayNew function| fillTipDates function| dispatchHeavyAnimationEvent object| pagesManager object| sequentialDom function| putPreloader

10 Cookies

Domain/Path Name / Value
www.clarity.ms/ Name: CLID
Value: 7e458ba608774caab5b2841ca9709b27.20241105.20251105
.rr.nu/ Name: _clck
Value: 5azhyy%7C2%7Cfqm%7C0%7C1770
.bing.com/ Name: MUID
Value: 3B2C624BEA9F63612E4D7765EBDA6200
.c.bing.com/ Name: MR
Value: 0
.c.bing.com/ Name: SRM_B
Value: 3B2C624BEA9F63612E4D7765EBDA6200
.c.clarity.ms/ Name: SM
Value: C
.clarity.ms/ Name: MUID
Value: 3B2C624BEA9F63612E4D7765EBDA6200
.c.clarity.ms/ Name: MR
Value: 0
.c.clarity.ms/ Name: ANONCHK
Value: 0
.rr.nu/ Name: _clsk
Value: tv6wjl%7C1730769489635%7C1%7C1%7Ca.clarity.ms%2Fcollect

1 Console Messages

Source Level URL
Text
rendering warning URL: https://telegarmt.rr.nu/en/
Message:
[GroupMarkerNotSet(crbug.com/242999)!:A0601D002C080000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.clarity.ms
c.bing.com
c.clarity.ms
img.icons8.com
telegarmt.rr.nu
www.clarity.ms
telegarmt.rr.nu
13.107.21.237
13.107.246.59
43.134.78.84
51.8.71.184
52.231.230.148
79.127.235.11
04dfc8e1a6e59e36a3a3a5c15443a97a92a6d2a7da9d276b050d58be3c7952a7
063ce514e1131db57955965bf24809f82660229de67ff31674941f280c919dd3
17e0c86d87c90055aa9a393a20a431bb89cb58a3fd0003046bbfd8f7c22e6c3b
19fb2e2b1a73081d0be43d40c28e85d6875138f1f0b89c8a1837c3e806d578b3
1eab20824bed8aac3920c551acc9e5029f6138321fa8b8824ebaf2cb8ddf9765
325f7766220ab8219abd6d0c7e04d5c6d99a491d0f9be6a15eca08f16b150fa5
36cb02e59322028c02c5365bd56cbd129b3eb2fb4aaec625160ca2dc9786a4bd
48cde64efcc80711b88bae30629af7a00b6c2d34ec4425c4b7d7a9b83628db84
6c4900d40f3335423817340edddd7655d96e707156923fcf3cbf5a6520008d6e
6cbfddb4735bdca8b4d594c0222541a0aa1f53ee6b4359647960ed164f595863
6e3a461f643f193d1efe96c972fe9e19e4bc62772ff57faa8758374e0406bf75
6e8f2da9c344b748747fe5b0c3c3e6ff3fe08e1829f2a6aee736dd6697d9ea0c
6f2cf0c99091af44641cb27eee6a0f32a56aa85f446f60a9482864f2ade413d4
716e7f1ae038828bc9e00fa972d6ef2da468bff4b07b2f8ffa796a29536b00b4
7e2388ec283fe17472ef02829a93da550af8f3ad4a975f50a0110bff61afe523
8528a55ba5d25bb2b6463f369b7a2046c08ced5f20256978a06119c0d50d08a2
900f22723c45f67600638812021437a089daa7c2f0a559ebb85a0726183cee79
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
a8df41d98a0fa3d1cb8c8661377ac1a572beb9cd0b68e968f92d69f7c8331483
ad7184835ad021d3015b04b08acc989f05818f9178dbf0226155524e9842871a
b16cfc78065c0a3848ca1fd44831e2792d5371dd614cbeb4aacfed1440963eae
c6569f9561d2c42ea7de49ef1e2331a658eb9801af9bce7de2101ca858ac1f2d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eeb79b0ae5da35d3433de6edeec3a0e3cce9c24f517dbad26ed97e852666c8f4
f12e62f05d48be6be0d36b76dbda5d0f723cd94de6f7851bbc4ed0191994b4dd