zhukov.github.io
Open in
urlscan Pro
2606:50c0:8000::153
Malicious Activity!
Public Scan
Submitted URL: https://telegram.1-0-5.ch/
Effective URL: https://zhukov.github.io/webogram/
Submission: On August 20 via automatic, source openphish — Scanned from CH
Effective URL: https://zhukov.github.io/webogram/
Submission: On August 20 via automatic, source openphish — Scanned from CH
Summary
This website contacted 3 IPs
in 3 countries
across 3 domains to perform 19 HTTP transactions.
The main IP is 2606:50c0:8000::153, located in
United States and
belongs to FASTLY, US.
The main domain is zhukov.github.io.
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on March 15th 2024. Valid for: a year.
This is the only time zhukov.github.io was scanned on urlscan.io!
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on March 15th 2024. Valid for: a year.
This is the only time zhukov.github.io was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Telegram (Instant Messenger)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 1 | 116.202.46.42 116.202.46.42 | 24940 (HETZNER-AS) (HETZNER-AS) | |
| 11 | 2606:50c0:800... 2606:50c0:8000::153 | 54113 (FASTLY) (FASTLY) | |
| 7 | 2001:67c:4e8:... 2001:67c:4e8:f004::9 | 62041 (TELEGRAM) (TELEGRAM) | |
| 19 | 3 |
1
116.202.46.42
(Nuremberg, Germany)
ASN24940 (HETZNER-AS, DE)
PTR: lx67.hoststar.hosting
ASN24940 (HETZNER-AS, DE)
PTR: lx67.hoststar.hosting
| telegram.1-0-5.ch |
7
2001:67c:4e8:f004::9
(Amsterdam, Netherlands)
ASN62041 (TELEGRAM, VG)
ASN62041 (TELEGRAM, VG)
| venus.web.telegram.org | |
| vesta.web.telegram.org |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 11 |
github.io
zhukov.github.io |
762 KB |
| 7 |
telegram.org
venus.web.telegram.org — Cisco Umbrella Rank: 41555 vesta.web.telegram.org — Cisco Umbrella Rank: 257153 |
4 KB |
| 1 |
1-0-5.ch
1 redirects
telegram.1-0-5.ch |
289 B |
| 19 | 3 |
| Domain | Requested by | |
|---|---|---|
| 11 | zhukov.github.io |
zhukov.github.io
|
| 5 | venus.web.telegram.org |
zhukov.github.io
|
| 2 | vesta.web.telegram.org |
zhukov.github.io
|
| 1 | telegram.1-0-5.ch | 1 redirects |
| 19 | 4 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| desktop.telegram.org |
| telegram.org |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| *.github.io DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2024-03-15 - 2025-03-14 |
a year | crt.sh |
| *.web.telegram.org Go Daddy Secure Certificate Authority - G2 |
2023-08-30 - 2024-09-30 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://zhukov.github.io/webogram/
Frame ID: 6AF7BA76BB95417352B29841B2291847
Requests: 23 HTTP requests in this frame
Screenshot
Page Title
Telegram WebPage URL History Show full URLs
-
https://telegram.1-0-5.ch/
HTTP 301
http://zhukov.github.io/webogram/ HTTP 307
https://zhukov.github.io/webogram/ Page URL
Detected technologies
GitHub Pages
(CDN)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- ^https?://[^/]+\.github\.io
Page Statistics
3 Outgoing links
These are links going to different origins than the main page.
URL: https://desktop.telegram.org/
Title: desktop.telegram.org
Title: desktop.telegram.org
Search URL Search Domain Scan URL
URL: https://telegram.org/
Search URL Search Domain Scan URL
URL: https://telegram.org/apps
Title: mobile apps
Title: mobile apps
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://telegram.1-0-5.ch/
HTTP 301
http://zhukov.github.io/webogram/ HTTP 307
https://zhukov.github.io/webogram/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
19 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
/
zhukov.github.io/webogram/ Redirect Chain
|
2 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
app.css
zhukov.github.io/webogram/css/ |
188 KB 37 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
app.js
zhukov.github.io/webogram/js/ |
3 MB 692 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
desktop.css
zhukov.github.io/webogram/css/ |
48 KB 9 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
en-us.json
zhukov.github.io/webogram/js/locales/ |
48 KB 12 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
favicon.ico
zhukov.github.io/webogram/ |
959 B 1 KB |
Other
image/vnd.microsoft.icon |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
58 B 0 |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
682 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
340 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
751 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
General.png
zhukov.github.io/webogram/img/icons/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
Telegram.svg
zhukov.github.io/webogram/img/ |
5 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
favicon.ico
zhukov.github.io/webogram/ |
959 B 0 |
Other
image/vnd.microsoft.icon |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
crypto_worker.js
zhukov.github.io/webogram/js/lib/ |
1 KB 790 B |
Other
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H2 |
apiw1
venus.web.telegram.org/ |
84 B 344 B |
XHR
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
favicon.ico
zhukov.github.io/webogram/ |
959 B 0 |
Other
image/vnd.microsoft.icon |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H2 |
apiw1
venus.web.telegram.org/ |
652 B 912 B |
XHR
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H2 |
apiw1
venus.web.telegram.org/ |
72 B 331 B |
XHR
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H2 |
apiw1
venus.web.telegram.org/ |
168 B 428 B |
XHR
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H2 |
apiw1
venus.web.telegram.org/ |
168 B 428 B |
XHR
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H2 |
apiw1
vesta.web.telegram.org/ |
84 B 343 B |
XHR
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H2 |
apiw1
vesta.web.telegram.org/ |
652 B 912 B |
XHR
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
POST |
apiw1
vesta.web.telegram.org/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- vesta.web.telegram.org
- URL
- https://vesta.web.telegram.org/apiw1
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Telegram (Instant Messenger)349 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| BigInteger function| nbi function| am1 function| am2 function| am3 function| int2char function| intAt function| bnpCopyTo function| bnpFromInt function| nbv function| bnpFromString function| bnpClamp function| bnToString function| bnNegate function| bnAbs function| bnCompareTo function| nbits function| bnBitLength function| bnpDLShiftTo function| bnpDRShiftTo function| bnpLShiftTo function| bnpRShiftTo function| bnpSubTo function| bnpMultiplyTo function| bnpSquareTo function| bnpDivRemTo function| bnMod function| Classic function| cConvert function| cRevert function| cReduce function| cMulTo function| cSqrTo function| bnpInvDigit function| Montgomery function| montConvert function| montRevert function| montReduce function| montSqrTo function| montMulTo function| bnpIsEven function| bnpExp function| bnModPowInt function| bnClone function| bnIntValue function| bnByteValue function| bnShortValue function| bnpChunkSize function| bnSigNum function| bnpToRadix function| bnpFromRadix function| bnpFromNumber function| bnToByteArray function| bnEquals function| bnMin function| bnMax function| bnpBitwiseTo function| op_and function| bnAnd function| op_or function| bnOr function| op_xor function| bnXor function| op_andnot function| bnAndNot function| bnNot function| bnShiftLeft function| bnShiftRight function| lbit function| bnGetLowestSetBit function| cbit function| bnBitCount function| bnTestBit function| bnpChangeBit function| bnSetBit function| bnClearBit function| bnFlipBit function| bnpAddTo function| bnAdd function| bnSubtract function| bnMultiply function| bnSquare function| bnDivide function| bnRemainder function| bnDivideAndRemainder function| bnpDMultiply function| bnpDAddOffset function| NullExp function| nNop function| nMulTo function| nSqrTo function| bnPow function| bnpMultiplyLowerTo function| bnpMultiplyUpperTo function| Barrett function| barrettConvert function| barrettRevert function| barrettReduce function| barrettSqrTo function| barrettMulTo function| bnModPow function| bnGCD function| bnpModInt function| bnModInverse function| bnIsProbablePrime function| bnpMillerRabin function| rng_seed_int function| rng_seed_time function| rng_get_byte function| rng_get_bytes function| SecureRandom function| Arcfour function| ARC4init function| ARC4next function| prng_newstate function| findPrimes function| millerRabinInt function| millerRabin function| bitSize function| expand function| randTruePrime function| randProbPrime function| randProbPrimeRounds function| mod function| addInt function| mult function| powMod function| sub function| add function| inverseMod function| multMod function| randTruePrime_ function| randBigInt function| randBigInt_ function| GCD function| GCD_ function| inverseMod_ function| inverseModInt function| inverseModInt_ function| eGCD_ function| negative function| greaterShift function| greater function| divide_ function| carry_ function| modInt function| int2bigInt function| str2bigInt function| equalsInt function| equals function| isZero function| bigInt2str function| dup function| copy_ function| copyInt_ function| addInt_ function| rightShift_ function| halve_ function| leftShift_ function| multInt_ function| divInt_ function| linComb_ function| linCombShift_ function| addShift_ function| subShift_ function| sub_ function| add_ function| mult_ function| mod_ function| multMod_ function| squareMod_ function| trim function| powMod_ function| mont_ function| dT function| checkClick function| isInDOM function| checkDragEvent function| cancelEvent function| hasOnclick function| getScrollWidth function| onCtrlEnter function| setFieldSelection function| getFieldSelection function| getRichValue function| getRichValueWithCaret function| getRichElementValue function| setRichFocus function| getSelectedText function| scrollToNode function| onContentLoaded function| tsNow function| safeReplaceObject function| listMergeSorted function| listUniqSorted function| templateUrl function| encodeEntities function| calcImageInBox function| versionCompare function| bigint function| bigStringInt function| dHexDump function| bytesToHex function| bytesFromHex function| bytesToBase64 function| uint6ToBase64 function| base64ToBlob function| dataUrlToBlob function| blobConstruct function| blobSafeMimeType function| bytesCmp function| bytesXor function| bytesToWords function| bytesFromWords function| bytesFromBigInt function| bytesFromLeemonBigInt function| bytesToArrayBuffer function| convertToArrayBuffer function| convertToUint8Array function| convertToByteArray function| bytesFromArrayBuffer function| bufferConcat function| longToInts function| longToBytes function| longFromInts function| intToUint function| uintToInt function| sha1HashSync function| sha1BytesSync function| sha256HashSync function| rsaEncrypt function| addPadding function| aesEncryptSync function| aesDecryptSync function| gzipUncompress function| nextRandomInt function| pqPrimeFactorization function| pqPrimeBigInteger function| gcdLong function| pqPrimeLong function| pqPrimeLeemon function| bytesModPow function| TLSerialization function| TLDeserialization function| EmojiTooltip function| EmojiPanel function| MessageComposer function| Scroller number| dbits number| canary boolean| j_lm number| BI_FP string| BI_RM object| BI_RC number| rr number| vv object| lowprimes number| lplim object| rng_state object| rng_pool object| global object| t object| ua number| rng_psize object| CryptoJS function| OGVDemuxerOgg function| OGVDecoderAudioOpus function| OGVDecoderAudioVorbis number| _logTimer object| extraModules function| setZeroTimeout function| $ function| jQuery object| Config object| ConfigStorage function| safeConfirm object| angular function| Rusha object| Zlib object| goog number| bpe number| mask number| radix string| digitsStr object| buff object| one object| ss object| s0 object| s1 object| s2 object| s3 object| s4 object| s5 object| s6 object| s7 object| T object| sa object| mr_x1 object| mr_r object| mr_a object| eg_v object| eg_u object| eg_A object| eg_B object| eg_C object| eg_D object| md_q1 object| md_q2 object| md_q3 object| md_r object| md_r1 object| md_r2 object| md_tt object| primes object| pows object| s_i object| s_i2 object| s_R object| s_rm object| s_q object| s_n1 object| s_a object| s_r2 object| s_n object| s_b object| s_d object| s_x1 object| s_x2 object| s_aa object| rpprb function| WebPDecoder function| OGVTimeRanges function| OGVMediaError string| prop object| OGVCompat object| OGVLoader function| OGVMediaType function| OGVPlayer string| OGVVersion object| ogvjs function| Recorder function| onAnimationFrameCallback object| SearchIndexManager object| EmojiHelper object| jQuery1111018714117791906815 function| requestFileSystem object| rushaInstance object| cachedFs number| k0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
telegram.1-0-5.ch
venus.web.telegram.org
vesta.web.telegram.org
zhukov.github.io
vesta.web.telegram.org
116.202.46.42
2001:67c:4e8:f004::9
2606:50c0:8000::153
01b872616c537f2bb7d56057c8487ca3e61bbf95976047d2416415de2eb6ff00
14420542b7ae65db84e6fce7834c97470d98d5fedb6acd2404e6dc07781bd76b
1787211bb6c15bc910e4aa84f5840a92bf1d52d9fed9975d604e91a2164d894e
23708afecf0b51c01dd06fd86f7536246857705927f1049b5e70d010682ba5cc
3b846ab06dc999e79f90874a1397c3bc2b40c7a65489015e149d88ab16a4b4a1
462c72824442b77689e0650dfe56a218cbea68b48669d68f3f7b3247af187d09
4c2c1ecda421d589e2e016298ef887da21516f115976dc1c81ae683ea67b083c
617f22f8c6cc829644c0a45c1c83cae9dcf76812165c6f9e4fee75e45663086c
7583205460e8aa46ec80d7ef8340f10db692ec7ca8b7df2decb95a558246c4c9
76fa1f418571c7be7b2a4b490239b9b0885c75f83cd656746c70997a94ebe6ab
ab24b8258e6d00603702753a091af931e3995de0059ab0aadc1bf8700a8cb37e
bd24e2e781d27a24a5b689e340f6acfd17069cf48814d563160c8c9265382d77
c3b87aac725098eb864ceca786dfdb8e4ec68b2a9d52c18163af24523390c637
c47434acd9cc3f90b5bce8c782561ce10c52903c7fac19e141030c57d9c6dcf3
de4c9d4b70bd3057b0b5a9392746eab9374dfdc5992d3f72eb819cb0ee44a577
f3408991e570821c11e13240c7a7382d5a3ff7d41b16625131173650868d519b
fd4187fa4010f3daef2226882a74e8767c65ba9e531a6b1eee5f53d520535417
fe146019189901e1e9b9a1d1ce67ed7435ddf121c04461169c6fd4b3e8ed1f6c
fef5a41be1b827a1729f19bcd123a57ee3f2cb8dc9074fffa4ab5b807f503514
ffd7d461702bdd282794ad00a0ed3d7892fcc78e5797709bcaff6cc6373c7095