helen.helena-small.sbs
Open in
urlscan Pro
2606:4700:3031::6815:21c9
Malicious Activity!
Public Scan
Submission: On November 13 via manual from CZ — Scanned from US
Summary
TLS certificate: Issued by WE1 on November 13th 2024. Valid for: 3 months.
This is the only time helen.helena-small.sbs was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Telegram (Instant Messenger)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
19 | 2606:4700:303... 2606:4700:3031::6815:21c9 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
24 | 2 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
19 |
helena-small.sbs
helen.helena-small.sbs |
353 KB |
24 | 1 |
Domain | Requested by | |
---|---|---|
19 | helen.helena-small.sbs |
helen.helena-small.sbs
|
24 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
helena-small.sbs WE1 |
2024-11-13 - 2025-02-11 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://helen.helena-small.sbs/really.type.connect/votings
Frame ID: 8B2D1D91ABDE58431F32E4FCD2FB273B
Requests: 23 HTTP requests in this frame
Screenshot
Page Title
WebPage URL History Show full URLs
- https://helen.helena-small.sbs/really.type.connect/votings Page URL
- https://helen.helena-small.sbs/really.type.connect/votings Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://helen.helena-small.sbs/really.type.connect/votings Page URL
- https://helen.helena-small.sbs/really.type.connect/votings Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
24 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
votings
helen.helena-small.sbs/really.type.connect/ |
12 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index-CLQ0rzaR.js
helen.helena-small.sbs/auth/ |
260 KB 83 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
0ucgvpqie6b5.css
helen.helena-small.sbs/auth/ |
477 KB 84 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Primary Request
votings
helen.helena-small.sbs/really.type.connect/ |
12 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index-CLQ0rzaR.js
helen.helena-small.sbs/auth/ |
260 KB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
0ucgvpqie6b5.css
helen.helena-small.sbs/auth/ |
477 KB 0 |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
mtproto.worker-DpY9_Bdy.js
helen.helena-small.sbs/auth/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
crypto.worker-CfCshcpI.js
helen.helena-small.sbs/auth/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
369 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
crypto.worker-CfCshcpI.js
helen.helena-small.sbs/auth/ |
165 KB 44 KB |
Fetch
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
59 B 59 B |
Image
image/jxl |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
311 B 0 |
Image
image/avif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
helen.helena-small.sbs/auth/assets/img/ |
15 KB 4 KB |
Other
image/vnd.microsoft.icon |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
1e2zxrwqko73.js
helen.helena-small.sbs/auth/ |
205 KB 54 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
dme3z2oeb1ps.js
helen.helena-small.sbs/auth/ |
4 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
og7xpzqmw7um.js
helen.helena-small.sbs/auth/ |
36 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
no4v2n7rutpv.js
helen.helena-small.sbs/auth/ |
12 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
sjq9ujb51usb.js
helen.helena-small.sbs/auth/ |
24 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
41w6p6ticd3f.js
helen.helena-small.sbs/auth/ |
20 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
otnbzocb0vxu.js
helen.helena-small.sbs/auth/ |
2 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
z4k49pitkmwt.js
helen.helena-small.sbs/auth/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
a65ba54b-ecd9-46a0-8848-fd715d94cabf
https://helen.helena-small.sbs/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
9246fd6c-6aa6-4669-bc69-2961302483fb
https://helen.helena-small.sbs/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
1f366c6b-11a4-4b09-b45a-5d63e0f5d54c
https://helen.helena-small.sbs/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
b7od778a8ynt.js
helen.helena-small.sbs/auth/ |
145 KB 38 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
dumu5ptj42hb.js
helen.helena-small.sbs/auth/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logo_padded.svg
helen.helena-small.sbs/auth/assets/img/ |
1 KB 1 KB |
Fetch
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- helen.helena-small.sbs
- URL
- https://helen.helena-small.sbs/auth/mtproto.worker-DpY9_Bdy.js
- Domain
- helen.helena-small.sbs
- URL
- https://helen.helena-small.sbs/auth/crypto.worker-CfCshcpI.js
- Domain
- helen.helena-small.sbs
- URL
- blob:https://helen.helena-small.sbs/a65ba54b-ecd9-46a0-8848-fd715d94cabf
- Domain
- helen.helena-small.sbs
- URL
- blob:https://helen.helena-small.sbs/9246fd6c-6aa6-4669-bc69-2961302483fb
- Domain
- helen.helena-small.sbs
- URL
- blob:https://helen.helena-small.sbs/1f366c6b-11a4-4b09-b45a-5d63e0f5d54c
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Telegram (Instant Messenger)30 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| rootScope function| deferredPromise function| AppStorage object| stateStorage function| wrapUrl object| I18n object| webpWorkerController object| appStorage object| appNavigationController object| singleInstance object| webPushApiManager object| telegramMeWebManager object| opusDecodeController object| cryptoMessagePort object| mtprotoMessagePort object| serviceMessagePort object| apiManagerProxy function| calcImageInBox object| mediaSizes object| customProperties object| windowSize object| liteMode object| themeController object| overlayCounter function| formatDateAccordingToTodayNew function| fillTipDates function| dispatchHeavyAnimationEvent object| pagesManager object| sequentialDom function| putPreloader1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
helen.helena-small.sbs/ | Name: PHPSESSID Value: 1ea1102c2bf0c42cecce6ccb43b56b71 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
helen.helena-small.sbs
helen.helena-small.sbs
2606:4700:3031::6815:21c9
03f2ad8b4d863ede4ed8ea91c52c1f2faa546c06d2217c3c8e0f3ebce4e0ff34
04dfc8e1a6e59e36a3a3a5c15443a97a92a6d2a7da9d276b050d58be3c7952a7
30e1ee8db00221264847c851ba662da73e7aaf1c80865c668852711cdc063119
453b67012d7e4d07f6f6716cd4d617f7104bd1c6e3e2f6fedd74e34895e2eeaa
4d805d30f9431557194d4e74cff59e2bba533e7b640a753b233c695e513a932d
52ecc22685362b333f1325fceecf4bfde2c9290d7c38b2da1628b89becb310e0
55073646800c2dafa80abb6f0fd1dc1cd230b64dafd19496dc12242834294a8a
6f2cf0c99091af44641cb27eee6a0f32a56aa85f446f60a9482864f2ade413d4
79a0096b9ff340d10ebaef504a0c91066170d9066b3d7436556878d10c6979fc
7c30f097c12fa452e481a5e095f63e4d7b1a8bc9940a6b879fd905b5d08d8e70
7e2388ec283fe17472ef02829a93da550af8f3ad4a975f50a0110bff61afe523
864b831bce12cd808834bfd5e6ccf2f1198f6d954ce6917e2a5b4e95f80a8576
93094b43a65879e395c515ade0776e1f72f48cb9b8f707925d3979a9ffab365d
97432cfa2bb58b56d9949e2b240dea56f0f65ed96bae37b9c47c2283e5e35dca
a82b13d0ddef486d392796d8d96b7f8acaab9a0ba7a36ed534c71b7fa3ae3ca5
ac9839ffe308b0fc9e9fc60a609876c1c41c121a70e99331f8d83970cb0b06e5
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eeb79b0ae5da35d3433de6edeec3a0e3cce9c24f517dbad26ed97e852666c8f4
ff5d5d7fe2ee3f3a9b140a28821608729f695a6da0c6ce6989e51647e6802868