hdjiwoonsbvhsj.site Open in urlscan Pro
94.159.111.75 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://hdjiwoonsbvhsj.site/
Submission: On November 25 via api (November 25th 2024, 1:44:35 am UTC) from BE — Scanned from CA

Summary HTTP 27 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 27 HTTP transactions. The main IP is 94.159.111.75, located in Russian Federation and belongs to H2NEXUS-AS H2NEXUS LTD, GB. The main domain is hdjiwoonsbvhsj.site.
TLS certificate: Issued by R11 on November 17th 2024. Valid for: 3 months.

This is the only time hdjiwoonsbvhsj.site was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Telegram (Instant Messenger)

Domain & IP information

	IP Address	AS Autonomous System
18	94.159.111.75 94.159.111.75	215730 (H2NEXUS-A...) (H2NEXUS-AS H2NEXUS LTD)
2	2a04:4e42:200... 2a04:4e42:200::485	54113 (FASTLY) (FASTLY)
27	3

18 94.159.111.75 (Russian Federation)

ASN215730 (H2NEXUS-AS H2NEXUS LTD, GB)
PTR: 71920.h2.nexus

hdjiwoonsbvhsj.site	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a04:4e42:200::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
18	hdjiwoonsbvhsj.site hdjiwoonsbvhsj.site	1 MB
2	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 318	18 KB
27	2

	Domain	Requested by
18	hdjiwoonsbvhsj.site	hdjiwoonsbvhsj.site cdn.jsdelivr.net
2	cdn.jsdelivr.net	hdjiwoonsbvhsj.site
27	2

This site contains no links.

Subject Issuer	Validity	Valid
hdjiwoonsbvhsj.site R11	`2024-11-17` - `2025-02-15`	3 months	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2024 Q3	`2024-07-30` - `2025-08-31`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://hdjiwoonsbvhsj.site/
Frame ID: 53A747F0A460D580E1DCEDA01CF8C520
Requests: 26 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Web

Page URL History Show full URLs

https://hdjiwoonsbvhsj.site/ Page URL
https://hdjiwoonsbvhsj.site/ Page URL

Detected technologies

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

27
Requests

74 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

1427 kB
Transfer

1590 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://hdjiwoonsbvhsj.site/ Page URL
https://hdjiwoonsbvhsj.site/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

27 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK /
hdjiwoonsbvhsj.site/ 13 KB
6 KB 628ms
136ms Document
text/html 94.159.111.75
H2NEXUS-AS H2NEXU...

General

Check archive.org

Show headers Download Go to

Full URL: https://hdjiwoonsbvhsj.site/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 94.159.111.75 , Russian Federation, ASN215730 (H2NEXUS-AS H2NEXUS LTD, GB),
Reverse DNS: 71920.h2.nexus
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Mon, 25 Nov 2024 01:44:29 GMT
Server: nginx/1.18.0 (Ubuntu)
Transfer-Encoding: chunked

GET
H2 200 axios.min.js
cdn.jsdelivr.net/npm/axios/dist/ 53 KB
18 KB 136ms
35ms Script
application/javascript 2a04:4e42:200::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js

Requested by

Host: hdjiwoonsbvhsj.site
URL: https://hdjiwoonsbvhsj.site/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:200::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hdjiwoonsbvhsj.site/

Response headers

access-control-expose-headers: *
content-encoding: br
etag: W/"d383-UevtiR1Ub6VyiQ12MPIw3BrQgvI"
age: 27831
x-content-type-options: nosniff
x-jsd-version-type: version
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache: HIT, HIT
date: Mon, 25 Nov 2024 01:44:29 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-fra-etou8220107-FRA, cache-yul1970035-YUL
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18407
x-jsd-version: 1.7.7

GET index-CLQ0rzaR.js
hdjiwoonsbvhsj.site/auth/ 0
0

GET 0ucgvpqie6b5.css
hdjiwoonsbvhsj.site/auth/ 0
0

GET
H/1.1 200
OK Primary Request / Show response
hdjiwoonsbvhsj.site/ 13 KB
6 KB 415ms
136ms Document
text/html 94.159.111.75
H2NEXUS-AS H2NEXU...

General

Check archive.org

Show headers Download Go to

Full URL: https://hdjiwoonsbvhsj.site/
Requested by: Host: hdjiwoonsbvhsj.site
URL: https://hdjiwoonsbvhsj.site/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 94.159.111.75 , Russian Federation, ASN215730 (H2NEXUS-AS H2NEXUS LTD, GB),
Reverse DNS: 71920.h2.nexus
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 4aff0c27054d26f89482610c503183e8e50ed1aabd3ddf84db6f98e57176f3d5

Request headers

Referer: https://hdjiwoonsbvhsj.site/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Mon, 25 Nov 2024 01:44:29 GMT
Server: nginx/1.18.0 (Ubuntu)
Transfer-Encoding: chunked

GET
H2 200 axios.min.js Show response
cdn.jsdelivr.net/npm/axios/dist/ 53 KB
0 0ms
0ms Script
application/javascript 2a04:4e42:200::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js

Requested by

Host: hdjiwoonsbvhsj.site
URL: https://hdjiwoonsbvhsj.site/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:200::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

f5b2b26071bb59f466683356df11b5392614cf6966586917990c65d48af0dcb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hdjiwoonsbvhsj.site/

Response headers

access-control-expose-headers: *
content-encoding: br
etag: W/"d383-UevtiR1Ub6VyiQ12MPIw3BrQgvI"
age: 27831
x-content-type-options: nosniff
x-jsd-version-type: version
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache: HIT, HIT
date: Mon, 25 Nov 2024 01:44:29 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-fra-etou8220107-FRA, cache-yul1970035-YUL
vary: Accept-Encoding
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18407
x-jsd-version: 1.7.7

GET
H/1.1 200
OK index-CLQ0rzaR.js Show response
hdjiwoonsbvhsj.site/auth/ 349 KB
286 KB 436ms
149ms Script
application/javascript 94.159.111.75
H2NEXUS-AS H2NEXU...

General

Check archive.org

Show headers Download Go to

Full URL: https://hdjiwoonsbvhsj.site/auth/index-CLQ0rzaR.js
Requested by: Host: hdjiwoonsbvhsj.site
URL: https://hdjiwoonsbvhsj.site/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 94.159.111.75 , Russian Federation, ASN215730 (H2NEXUS-AS H2NEXUS LTD, GB),
Reverse DNS: 71920.h2.nexus
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 6b90a4b85c6e251c970642409c34ec2f24f407a10eca21b25e12cd42a6260350

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hdjiwoonsbvhsj.site
Referer: https://hdjiwoonsbvhsj.site/

Response headers

Accept-Ranges: bytes
Content-Length: 357652
Date: Mon, 25 Nov 2024 01:44:30 GMT
ETag: "67324055-57514"
Last-Modified: Mon, 11 Nov 2024 17:35:17 GMT
Content-Type: application/javascript
Server: nginx/1.18.0 (Ubuntu)

GET
H/1.1 200
OK 0ucgvpqie6b5.css
hdjiwoonsbvhsj.site/auth/ 477 KB
477 KB 193ms
192ms Stylesheet
text/css 94.159.111.75
H2NEXUS-AS H2NEXU...

General

Check archive.org

Show headers Download Go to

Full URL: https://hdjiwoonsbvhsj.site/auth/0ucgvpqie6b5.css
Requested by: Host: hdjiwoonsbvhsj.site
URL: https://hdjiwoonsbvhsj.site/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 94.159.111.75 , Russian Federation, ASN215730 (H2NEXUS-AS H2NEXUS LTD, GB),
Reverse DNS: 71920.h2.nexus
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 55073646800c2dafa80abb6f0fd1dc1cd230b64dafd19496dc12242834294a8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hdjiwoonsbvhsj.site
Referer: https://hdjiwoonsbvhsj.site/

Response headers

ETag: "673210c9-77466"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 488550
Date: Mon, 25 Nov 2024 01:44:29 GMT
Content-Type: text/css
Last-Modified: Mon, 11 Nov 2024 14:12:25 GMT
Server: nginx/1.18.0 (Ubuntu)

GET
H/1.1 200
OK send.php Show response
hdjiwoonsbvhsj.site/server/ 6 B
302 B 759ms
470ms XHR
application/json 94.159.111.75
H2NEXUS-AS H2NEXU...

General

Check archive.org

Show headers Download Go to

Full URL: https://hdjiwoonsbvhsj.site/server/send.php?check&service=Telegram
Requested by: Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 94.159.111.75 , Russian Federation, ASN215730 (H2NEXUS-AS H2NEXUS LTD, GB),
Reverse DNS: 71920.h2.nexus
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: abdfbffecbe18ed94df9829819e596ee285b52a94aa108514452a9121721c789

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept: application/json, text/plain, */*
Referer: https://hdjiwoonsbvhsj.site/

Response headers

Transfer-Encoding: chunked
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
Date: Mon, 25 Nov 2024 01:44:30 GMT
Content-Type: application/json
Server: nginx/1.18.0 (Ubuntu)
Connection: keep-alive

GET mtproto.worker-DpY9_Bdy.js
hdjiwoonsbvhsj.site/auth/ 0
0

GET crypto.worker-CfCshcpI.js
hdjiwoonsbvhsj.site/auth/ 0
0

GET
DATA 200
OK truncated
/ 369 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6f2cf0c99091af44641cb27eee6a0f32a56aa85f446f60a9482864f2ade413d4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
H/1.1 200
OK crypto.worker-CfCshcpI.js Show response
hdjiwoonsbvhsj.site/auth/ 165 KB
165 KB 162ms
162ms Fetch
application/javascript 94.159.111.75
H2NEXUS-AS H2NEXU...

General

Check archive.org

Show headers Download Go to

Full URL: https://hdjiwoonsbvhsj.site/auth/crypto.worker-CfCshcpI.js
Requested by: Host: hdjiwoonsbvhsj.site
URL: https://hdjiwoonsbvhsj.site/auth/index-CLQ0rzaR.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 94.159.111.75 , Russian Federation, ASN215730 (H2NEXUS-AS H2NEXUS LTD, GB),
Reverse DNS: 71920.h2.nexus
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 59b2a9eb3339de9845364a9f5565f1ac2d6426af7537fc7a58ddfd4a2340b97a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hdjiwoonsbvhsj.site/

Response headers

ETag: "673210cb-29255"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 168533
Date: Mon, 25 Nov 2024 01:44:31 GMT
Content-Type: application/javascript
Last-Modified: Mon, 11 Nov 2024 14:12:27 GMT
Server: nginx/1.18.0 (Ubuntu)

GET
DATA 200
OK truncated
/ 59 B
59 B Image
image/jxl

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/jxl

GET
DATA 200
OK truncated
/ 311 B
0 Image
image/avif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 04dfc8e1a6e59e36a3a3a5c15443a97a92a6d2a7da9d276b050d58be3c7952a7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/avif

GET
H/1.1 200
OK favicon.ico
hdjiwoonsbvhsj.site/auth/assets/img/ 15 KB
15 KB 169ms
168ms Other
image/x-icon 94.159.111.75
H2NEXUS-AS H2NEXU...

General

Check archive.org

Show headers Download Go to

Full URL: https://hdjiwoonsbvhsj.site/auth/assets/img/favicon.ico?v=jw3mK7G9Ry
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 94.159.111.75 , Russian Federation, ASN215730 (H2NEXUS-AS H2NEXUS LTD, GB),
Reverse DNS: 71920.h2.nexus
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 7e2388ec283fe17472ef02829a93da550af8f3ad4a975f50a0110bff61afe523

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hdjiwoonsbvhsj.site/

Response headers

ETag: "6731ef76-3aee"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 15086
Date: Mon, 25 Nov 2024 01:44:31 GMT
Content-Type: image/x-icon
Last-Modified: Mon, 11 Nov 2024 11:50:14 GMT
Server: nginx/1.18.0 (Ubuntu)

GET
H/1.1 200
OK 1e2zxrwqko73.js Show response
hdjiwoonsbvhsj.site/auth/ 205 KB
205 KB 378ms
206ms Script
application/javascript 94.159.111.75
H2NEXUS-AS H2NEXU...

General

Check archive.org

Show headers Download Go to

Full URL: https://hdjiwoonsbvhsj.site/auth/1e2zxrwqko73.js
Requested by: Host: hdjiwoonsbvhsj.site
URL: https://hdjiwoonsbvhsj.site/auth/index-CLQ0rzaR.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 94.159.111.75 , Russian Federation, ASN215730 (H2NEXUS-AS H2NEXUS LTD, GB),
Reverse DNS: 71920.h2.nexus
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 453b67012d7e4d07f6f6716cd4d617f7104bd1c6e3e2f6fedd74e34895e2eeaa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hdjiwoonsbvhsj.site
Referer: https://hdjiwoonsbvhsj.site/auth/index-CLQ0rzaR.js

Response headers

ETag: "673210cb-334db"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 210139
Date: Mon, 25 Nov 2024 01:44:31 GMT
Content-Type: application/javascript
Last-Modified: Mon, 11 Nov 2024 14:12:27 GMT
Server: nginx/1.18.0 (Ubuntu)

GET
H/1.1 200
OK dme3z2oeb1ps.js Show response
hdjiwoonsbvhsj.site/auth/ 4 KB
4 KB 321ms
146ms Script
application/javascript 94.159.111.75
H2NEXUS-AS H2NEXU...

General

Check archive.org

Show headers Download Go to

Full URL: https://hdjiwoonsbvhsj.site/auth/dme3z2oeb1ps.js
Requested by: Host: hdjiwoonsbvhsj.site
URL: https://hdjiwoonsbvhsj.site/auth/index-CLQ0rzaR.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 94.159.111.75 , Russian Federation, ASN215730 (H2NEXUS-AS H2NEXUS LTD, GB),
Reverse DNS: 71920.h2.nexus
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 864b831bce12cd808834bfd5e6ccf2f1198f6d954ce6917e2a5b4e95f80a8576

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hdjiwoonsbvhsj.site
Referer: https://hdjiwoonsbvhsj.site/auth/index-CLQ0rzaR.js

Response headers

ETag: "673210cb-e19"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3609
Date: Mon, 25 Nov 2024 01:44:31 GMT
Content-Type: application/javascript
Last-Modified: Mon, 11 Nov 2024 14:12:27 GMT
Server: nginx/1.18.0 (Ubuntu)

GET
H/1.1 200
OK og7xpzqmw7um.js Show response
hdjiwoonsbvhsj.site/auth/ 36 KB
36 KB 597ms
310ms Script
application/javascript 94.159.111.75
H2NEXUS-AS H2NEXU...

General

Check archive.org

Show headers Download Go to

Full URL: https://hdjiwoonsbvhsj.site/auth/og7xpzqmw7um.js
Requested by: Host: hdjiwoonsbvhsj.site
URL: https://hdjiwoonsbvhsj.site/auth/index-CLQ0rzaR.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 94.159.111.75 , Russian Federation, ASN215730 (H2NEXUS-AS H2NEXUS LTD, GB),
Reverse DNS: 71920.h2.nexus
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 4d805d30f9431557194d4e74cff59e2bba533e7b640a753b233c695e513a932d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hdjiwoonsbvhsj.site
Referer: https://hdjiwoonsbvhsj.site/auth/index-CLQ0rzaR.js

Response headers

ETag: "673210cd-904d"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 36941
Date: Mon, 25 Nov 2024 01:44:31 GMT
Content-Type: application/javascript
Last-Modified: Mon, 11 Nov 2024 14:12:29 GMT
Server: nginx/1.18.0 (Ubuntu)

GET b2e03de6-ff74-4aa2-9708-13d9a55e01aa
https://hdjiwoonsbvhsj.site/ 0
0

GET 08b0bbda-fd32-4728-9e76-1470debf03f1
https://hdjiwoonsbvhsj.site/ 0
0

GET e9203148-dc80-4442-87d7-f1f3abb4f3a3
https://hdjiwoonsbvhsj.site/ 0
0

GET
H/1.1 200
OK no4v2n7rutpv.js Show response
hdjiwoonsbvhsj.site/auth/ 12 KB
12 KB 153ms
151ms Script
application/javascript 94.159.111.75
H2NEXUS-AS H2NEXU...

General

Check archive.org

Show headers Download Go to

Full URL: https://hdjiwoonsbvhsj.site/auth/no4v2n7rutpv.js
Requested by: Host: hdjiwoonsbvhsj.site
URL: https://hdjiwoonsbvhsj.site/auth/index-CLQ0rzaR.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 94.159.111.75 , Russian Federation, ASN215730 (H2NEXUS-AS H2NEXUS LTD, GB),
Reverse DNS: 71920.h2.nexus
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 79a0096b9ff340d10ebaef504a0c91066170d9066b3d7436556878d10c6979fc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hdjiwoonsbvhsj.site
Referer

Response headers

ETag: "673210cd-2f04"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 12036
Date: Mon, 25 Nov 2024 01:44:32 GMT
Content-Type: application/javascript
Last-Modified: Mon, 11 Nov 2024 14:12:29 GMT
Server: nginx/1.18.0 (Ubuntu)

GET
H/1.1 200
OK sjq9ujb51usb.js Show response
hdjiwoonsbvhsj.site/auth/ 24 KB
24 KB 145ms
144ms Script
application/javascript 94.159.111.75
H2NEXUS-AS H2NEXU...

General

Check archive.org

Show headers Download Go to

Full URL: https://hdjiwoonsbvhsj.site/auth/sjq9ujb51usb.js
Requested by: Host: hdjiwoonsbvhsj.site
URL: https://hdjiwoonsbvhsj.site/auth/index-CLQ0rzaR.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 94.159.111.75 , Russian Federation, ASN215730 (H2NEXUS-AS H2NEXUS LTD, GB),
Reverse DNS: 71920.h2.nexus
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 52ecc22685362b333f1325fceecf4bfde2c9290d7c38b2da1628b89becb310e0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hdjiwoonsbvhsj.site
Referer

Response headers

ETag: "673210ce-5e91"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 24209
Date: Mon, 25 Nov 2024 01:44:32 GMT
Content-Type: application/javascript
Last-Modified: Mon, 11 Nov 2024 14:12:30 GMT
Server: nginx/1.18.0 (Ubuntu)

GET
H/1.1 200
OK 41w6p6ticd3f.js Show response
hdjiwoonsbvhsj.site/auth/ 20 KB
20 KB 188ms
187ms Script
application/javascript 94.159.111.75
H2NEXUS-AS H2NEXU...

General

Check archive.org

Show headers Download Go to

Full URL: https://hdjiwoonsbvhsj.site/auth/41w6p6ticd3f.js
Requested by: Host: hdjiwoonsbvhsj.site
URL: https://hdjiwoonsbvhsj.site/auth/index-CLQ0rzaR.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 94.159.111.75 , Russian Federation, ASN215730 (H2NEXUS-AS H2NEXUS LTD, GB),
Reverse DNS: 71920.h2.nexus
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 03f2ad8b4d863ede4ed8ea91c52c1f2faa546c06d2217c3c8e0f3ebce4e0ff34

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hdjiwoonsbvhsj.site
Referer

Response headers

ETag: "673210ca-4f1a"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 20250
Date: Mon, 25 Nov 2024 01:44:32 GMT
Content-Type: application/javascript
Last-Modified: Mon, 11 Nov 2024 14:12:26 GMT
Server: nginx/1.18.0 (Ubuntu)

GET
H/1.1 200
OK otnbzocb0vxu.js Show response
hdjiwoonsbvhsj.site/auth/ 2 KB
3 KB 143ms
143ms Script
application/javascript 94.159.111.75
H2NEXUS-AS H2NEXU...

General

Check archive.org

Show headers Download Go to

Full URL: https://hdjiwoonsbvhsj.site/auth/otnbzocb0vxu.js
Requested by: Host: hdjiwoonsbvhsj.site
URL: https://hdjiwoonsbvhsj.site/auth/index-CLQ0rzaR.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 94.159.111.75 , Russian Federation, ASN215730 (H2NEXUS-AS H2NEXUS LTD, GB),
Reverse DNS: 71920.h2.nexus
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 93094b43a65879e395c515ade0776e1f72f48cb9b8f707925d3979a9ffab365d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hdjiwoonsbvhsj.site
Referer

Response headers

ETag: "673210cd-9be"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2494
Date: Mon, 25 Nov 2024 01:44:32 GMT
Content-Type: application/javascript
Last-Modified: Mon, 11 Nov 2024 14:12:29 GMT
Server: nginx/1.18.0 (Ubuntu)

GET
H/1.1 200
OK z4k49pitkmwt.js Show response
hdjiwoonsbvhsj.site/auth/ 2 KB
2 KB 142ms
142ms Script
application/javascript 94.159.111.75
H2NEXUS-AS H2NEXU...

General

Check archive.org

Show headers Download Go to

Full URL: https://hdjiwoonsbvhsj.site/auth/z4k49pitkmwt.js
Requested by: Host: hdjiwoonsbvhsj.site
URL: https://hdjiwoonsbvhsj.site/auth/index-CLQ0rzaR.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 94.159.111.75 , Russian Federation, ASN215730 (H2NEXUS-AS H2NEXUS LTD, GB),
Reverse DNS: 71920.h2.nexus
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 7c30f097c12fa452e481a5e095f63e4d7b1a8bc9940a6b879fd905b5d08d8e70

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hdjiwoonsbvhsj.site
Referer

Response headers

ETag: "673210ce-748"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1864
Date: Mon, 25 Nov 2024 01:44:32 GMT
Content-Type: application/javascript
Last-Modified: Mon, 11 Nov 2024 14:12:30 GMT
Server: nginx/1.18.0 (Ubuntu)

GET
H/1.1 200
OK b7od778a8ynt.js Show response
hdjiwoonsbvhsj.site/auth/ 145 KB
145 KB 185ms
185ms Script
application/javascript 94.159.111.75
H2NEXUS-AS H2NEXU...

General

Check archive.org

Show headers Download Go to

Full URL: https://hdjiwoonsbvhsj.site/auth/b7od778a8ynt.js
Requested by: Host: hdjiwoonsbvhsj.site
URL: https://hdjiwoonsbvhsj.site/auth/index-CLQ0rzaR.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 94.159.111.75 , Russian Federation, ASN215730 (H2NEXUS-AS H2NEXUS LTD, GB),
Reverse DNS: 71920.h2.nexus
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: ff5d5d7fe2ee3f3a9b140a28821608729f695a6da0c6ce6989e51647e6802868

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hdjiwoonsbvhsj.site
Referer

Response headers

ETag: "673210cb-2429b"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 148123
Date: Mon, 25 Nov 2024 01:44:32 GMT
Content-Type: application/javascript
Last-Modified: Mon, 11 Nov 2024 14:12:27 GMT
Server: nginx/1.18.0 (Ubuntu)

GET
H/1.1 200
OK dumu5ptj42hb.js Show response
hdjiwoonsbvhsj.site/auth/ 1 KB
2 KB 143ms
143ms Script
application/javascript 94.159.111.75
H2NEXUS-AS H2NEXU...

General

Check archive.org

Show headers Download Go to

Full URL: https://hdjiwoonsbvhsj.site/auth/dumu5ptj42hb.js
Requested by: Host: hdjiwoonsbvhsj.site
URL: https://hdjiwoonsbvhsj.site/auth/index-CLQ0rzaR.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 94.159.111.75 , Russian Federation, ASN215730 (H2NEXUS-AS H2NEXUS LTD, GB),
Reverse DNS: 71920.h2.nexus
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: a82b13d0ddef486d392796d8d96b7f8acaab9a0ba7a36ed534c71b7fa3ae3ca5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hdjiwoonsbvhsj.site
Referer

Response headers

ETag: "673210cb-5c9"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1481
Date: Mon, 25 Nov 2024 01:44:32 GMT
Content-Type: application/javascript
Last-Modified: Mon, 11 Nov 2024 14:12:27 GMT
Server: nginx/1.18.0 (Ubuntu)

GET
H/1.1 200
OK logo_padded.svg Show response
hdjiwoonsbvhsj.site/auth/assets/img/ 1 KB
1 KB 148ms
148ms Fetch
image/svg+xml 94.159.111.75
H2NEXUS-AS H2NEXU...

General

Check archive.org

Show headers Download Go to

Full URL: https://hdjiwoonsbvhsj.site/auth/assets/img/logo_padded.svg
Requested by: Host: hdjiwoonsbvhsj.site
URL: https://hdjiwoonsbvhsj.site/auth/no4v2n7rutpv.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 94.159.111.75 , Russian Federation, ASN215730 (H2NEXUS-AS H2NEXUS LTD, GB),
Reverse DNS: 71920.h2.nexus
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: eeb79b0ae5da35d3433de6edeec3a0e3cce9c24f517dbad26ed97e852666c8f4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hdjiwoonsbvhsj.site/

Response headers

ETag: "6731ef78-42d"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1069
Date: Mon, 25 Nov 2024 01:44:35 GMT
Content-Type: image/svg+xml
Last-Modified: Mon, 11 Nov 2024 11:50:16 GMT
Server: nginx/1.18.0 (Ubuntu)

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: eeb79b0ae5da35d3433de6edeec3a0e3cce9c24f517dbad26ed97e852666c8f4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml;charset=utf-8

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: hdjiwoonsbvhsj.site
URL: https://hdjiwoonsbvhsj.site/auth/index-CLQ0rzaR.js

Domain: hdjiwoonsbvhsj.site
URL: https://hdjiwoonsbvhsj.site/auth/0ucgvpqie6b5.css

Domain: hdjiwoonsbvhsj.site
URL: https://hdjiwoonsbvhsj.site/auth/mtproto.worker-DpY9_Bdy.js

Domain: hdjiwoonsbvhsj.site
URL: https://hdjiwoonsbvhsj.site/auth/crypto.worker-CfCshcpI.js

Domain: hdjiwoonsbvhsj.site
URL: blob:https://hdjiwoonsbvhsj.site/b2e03de6-ff74-4aa2-9708-13d9a55e01aa

Domain: hdjiwoonsbvhsj.site
URL: blob:https://hdjiwoonsbvhsj.site/08b0bbda-fd32-4728-9e76-1470debf03f1

Domain: hdjiwoonsbvhsj.site
URL: blob:https://hdjiwoonsbvhsj.site/e9203148-dc80-4442-87d7-f1f3abb4f3a3

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Telegram (Instant Messenger)

33 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	warning	URL: https://hdjiwoonsbvhsj.site/ Message: [GroupMarkerNotSet(crbug.com/242999)!:A02042160C1B0000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
hdjiwoonsbvhsj.site
hdjiwoonsbvhsj.site
2a04:4e42:200::485
94.159.111.75
03f2ad8b4d863ede4ed8ea91c52c1f2faa546c06d2217c3c8e0f3ebce4e0ff34
04dfc8e1a6e59e36a3a3a5c15443a97a92a6d2a7da9d276b050d58be3c7952a7
453b67012d7e4d07f6f6716cd4d617f7104bd1c6e3e2f6fedd74e34895e2eeaa
4aff0c27054d26f89482610c503183e8e50ed1aabd3ddf84db6f98e57176f3d5
4d805d30f9431557194d4e74cff59e2bba533e7b640a753b233c695e513a932d
52ecc22685362b333f1325fceecf4bfde2c9290d7c38b2da1628b89becb310e0
55073646800c2dafa80abb6f0fd1dc1cd230b64dafd19496dc12242834294a8a
59b2a9eb3339de9845364a9f5565f1ac2d6426af7537fc7a58ddfd4a2340b97a
6b90a4b85c6e251c970642409c34ec2f24f407a10eca21b25e12cd42a6260350
6f2cf0c99091af44641cb27eee6a0f32a56aa85f446f60a9482864f2ade413d4
79a0096b9ff340d10ebaef504a0c91066170d9066b3d7436556878d10c6979fc
7c30f097c12fa452e481a5e095f63e4d7b1a8bc9940a6b879fd905b5d08d8e70
7e2388ec283fe17472ef02829a93da550af8f3ad4a975f50a0110bff61afe523
864b831bce12cd808834bfd5e6ccf2f1198f6d954ce6917e2a5b4e95f80a8576
93094b43a65879e395c515ade0776e1f72f48cb9b8f707925d3979a9ffab365d
a82b13d0ddef486d392796d8d96b7f8acaab9a0ba7a36ed534c71b7fa3ae3ca5
abdfbffecbe18ed94df9829819e596ee285b52a94aa108514452a9121721c789
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eeb79b0ae5da35d3433de6edeec3a0e3cce9c24f517dbad26ed97e852666c8f4
f5b2b26071bb59f466683356df11b5392614cf6966586917990c65d48af0dcb9
ff5d5d7fe2ee3f3a9b140a28821608729f695a6da0c6ce6989e51647e6802868

hdjiwoonsbvhsj.site Open in urlscan Pro 94.159.111.75 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

27 Requests

74 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

1427 kBTransfer

1590 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

27 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

33 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

hdjiwoonsbvhsj.site Open in urlscan Pro
94.159.111.75 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

27
Requests

74 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

1427 kB
Transfer

1590 kB
Size

0
Cookies

27 HTTP transactions
4 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!