telegram-react-cv1.pages.dev
Open in
urlscan Pro
2606:4700:310c::ac42:2edf
Malicious Activity!
Public Scan
Submission: On December 07 via api from BY — Scanned from US
Summary
TLS certificate: Issued by WE1 on October 11th 2024. Valid for: 3 months.
This is the only time telegram-react-cv1.pages.dev was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Telegram (Instant Messenger)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
11 | 2606:4700:310... 2606:4700:310c::ac42:2edf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
16 | 2 |
ASN13335 (CLOUDFLARENET, US)
telegram-react-cv1.pages.dev |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
pages.dev
telegram-react-cv1.pages.dev |
495 KB |
16 | 1 |
Domain | Requested by | |
---|---|---|
11 | telegram-react-cv1.pages.dev |
telegram-react-cv1.pages.dev
|
16 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
telegram-react-cv1.pages.dev WE1 |
2024-10-11 - 2025-01-09 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://telegram-react-cv1.pages.dev/
Frame ID: 9BE3DFADD02B87A5EDC76F8215DB3A5E
Requests: 12 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
16 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
telegram-react-cv1.pages.dev/ |
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.162c7196.chunk.css
telegram-react-cv1.pages.dev/static/css/ |
36 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tgsticker.js
telegram-react-cv1.pages.dev/ |
22 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
3.f1a0539f.chunk.js
telegram-react-cv1.pages.dev/static/js/ |
983 KB 285 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.a94d64da.chunk.js
telegram-react-cv1.pages.dev/static/js/ |
583 KB 135 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
rlottie-wasm.worker.js
telegram-react-cv1.pages.dev/rlottie/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
rlottie-wasm.worker.js
telegram-react-cv1.pages.dev/rlottie/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
rlottie-wasm.worker.js
telegram-react-cv1.pages.dev/rlottie/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
rlottie-wasm.worker.js
telegram-react-cv1.pages.dev/rlottie/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
58 B 0 |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
6c401ab23349ce7bcf14.worker.js
telegram-react-cv1.pages.dev/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
telegram-react-cv1.pages.dev/ |
959 B 2 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
TwoFactorSetupMonkeyClose.json
telegram-react-cv1.pages.dev/data/ |
322 KB 17 KB |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
TwoFactorSetupMonkeyIdle.json
telegram-react-cv1.pages.dev/data/ |
71 KB 6 KB |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
TwoFactorSetupMonkeyPeek.json
telegram-react-cv1.pages.dev/data/ |
156 KB 16 KB |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
TwoFactorSetupMonkeyTracking.json
telegram-react-cv1.pages.dev/data/ |
79 KB 13 KB |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
countries.txt
telegram-react-cv1.pages.dev/data/ |
10 KB 5 KB |
Fetch
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- telegram-react-cv1.pages.dev
- URL
- https://telegram-react-cv1.pages.dev/rlottie/rlottie-wasm.worker.js
- Domain
- telegram-react-cv1.pages.dev
- URL
- https://telegram-react-cv1.pages.dev/rlottie/rlottie-wasm.worker.js
- Domain
- telegram-react-cv1.pages.dev
- URL
- https://telegram-react-cv1.pages.dev/rlottie/rlottie-wasm.worker.js
- Domain
- telegram-react-cv1.pages.dev
- URL
- https://telegram-react-cv1.pages.dev/rlottie/rlottie-wasm.worker.js
- Domain
- telegram-react-cv1.pages.dev
- URL
- https://telegram-react-cv1.pages.dev/6c401ab23349ce7bcf14.worker.js
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Telegram (Instant Messenger)28 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| RLottie object| webpackJsonptelegram_react object| regeneratorRuntime object| controller number| 2f1acc6c3a606b082e5eef5e54414ffb object| option object| user object| webpManager object| file object| message object| chat object| supergroup object| notifications object| requests object| app object| basicgroup object| call object| poll object| animation object| instantView function| iFrameResize object| player object| sticker function| getViews object| localization object| authorization object| filter boolean| hasFocus0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
telegram-react-cv1.pages.dev
telegram-react-cv1.pages.dev
2606:4700:310c::ac42:2edf
1719036af0c57d6762a1b9f31e6ce076c751fe52cf5a3f0e29109627760f7b0c
2fff068ed123576d3d0306da8673f60cf8a5b180e12efe2dec9d47922de2871e
462c72824442b77689e0650dfe56a218cbea68b48669d68f3f7b3247af187d09
60e13fd89bbc5ef8b41b1f0aad794e896ec23125584c86be59258e69717f475a
9dc236cf7b47ab89f0bcc1a645972e2fcc44b9e865397316872e8e956b3b353a
c1dfc5b97ec127c5db93ce2006f71cf2e46bc14c4d25be3888db3f105a3b3bbe
cafea184f44ab7c806bfea6881c5ed628c99141e83e84dd43331d06d6186950c
ccaaf8850d446732a1944948e5c138e33f3ab5c80f6237502fa5834760059532
f7df0dc2d7f3e731c56c7233b7a91baa34b3e9e85cc1eafdaff0e35133be5789
fd1bd44c1dd25f1a2ec35f5dbf34b8ec701c50a259bc9e5f4e827c20ba6910d2
fe4e6a66e3b83cfc4aee9a81f4429de20ff5f8d6a63bd4c3ffa7dc270e801c4e
fef5a41be1b827a1729f19bcd123a57ee3f2cb8dc9074fffa4ab5b807f503514