talergam.mba
Open in
urlscan Pro
2606:4700:3031::6815:f04
Malicious Activity!
Public Scan
Effective URL: https://talergam.mba/
Submission: On December 18 via api from US — Scanned from DE
Summary
TLS certificate: Issued by WE1 on December 13th 2024. Valid for: 3 months.
This is the only time talergam.mba was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Telegram (Instant Messenger)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 12 | 2606:4700:303... 2606:4700:3031::6815:f04 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
12 | 2 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
talergam.mba
1 redirects
talergam.mba |
79 KB |
12 | 1 |
Domain | Requested by | |
---|---|---|
12 | talergam.mba |
1 redirects
talergam.mba
|
12 | 1 |
This site contains links to these domains. Also see Links.
Domain |
---|
core.telegram.org |
Subject Issuer | Validity | Valid | |
---|---|---|---|
talergam.mba WE1 |
2024-12-13 - 2025-03-13 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://talergam.mba/
Frame ID: 981E84A23D0FD523D312290A538067BA
Requests: 9 HTTP requests in this frame
Frame:
https://talergam.mba/cdn-cgi/challenge-platform/h/b/scripts/jsd/787bc399e22f/main.js
Frame ID: 4E41FF4626676A8CD7544AE4397B9297
Requests: 2 HTTP requests in this frame
Screenshot
Page Title
Telegram SupportPage URL History Show full URLs
-
http://talergam.mba/
HTTP 307
https://talergam.mba/ Page URL
Detected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: API
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://talergam.mba/
HTTP 307
https://talergam.mba/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 8- https://talergam.mba/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
- https://talergam.mba/cdn-cgi/challenge-platform/h/b/scripts/jsd/787bc399e22f/main.js
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
Primary Request
/
talergam.mba/ Redirect Chain
|
14 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bootstrap.min.css
talergam.mba/files/ |
42 KB 10 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
index.css
talergam.mba/ |
1 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
telegram.css
talergam.mba/files/ |
113 KB 28 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
i18n.js
talergam.mba/js/ |
3 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
main.js
talergam.mba/files/ |
21 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
tgsticker.js
talergam.mba/files/ |
24 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
tgsticker-worker.js
talergam.mba/js/ Frame |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
t_logo_sprite.svg
talergam.mba/img/ |
23 KB 7 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
main.js
talergam.mba/cdn-cgi/challenge-platform/h/b/scripts/jsd/787bc399e22f/ Frame 4E41 Redirect Chain
|
9 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
8f3f4e0089645d75
talergam.mba/cdn-cgi/challenge-platform/h/b/jsd/r/ Frame 4E41 |
0 1 KB |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
talergam.mba/files/img/ |
15 KB 4 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- talergam.mba
- URL
- https://talergam.mba/js/tgsticker-worker.js
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Telegram (Instant Messenger)48 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 function| updateLanguage number| startTime function| dT object| jsonpCallbacks function| twitterCustomShareInit function| blogRecentNewsInit function| blogSideImageUpdate function| blogSideImageInit function| cancelEvent function| trackDlClick function| backToTopInit function| backToTopGo function| backToTopResize function| backToTopScroll function| removePreloadInit function| getXY function| dropdownClick function| dropdownHide function| dropdownPageClick function| escapeHTML function| videoTogglePlay function| getDevPageNav function| showTitleIfOverflows function| initDevPageNav function| updateDevPageNav function| updateMenuAffix function| initScrollVideos function| checkScrollVideos function| videoPreloadPosterDimensions function| isVisibleEnough function| getFullOffsetY function| redraw function| initRipple function| mainInitRetinaVideos function| mainInitDemoAutoplay function| mainDemoVideoHover function| mainDemoVideoDoHover function| mainInitLogo function| mainInitTgStickers function| setCookie function| getCookie function| mainScrollTo object| RLottie object| QueryableWorkerProxy function| QueryableWorker function| FrameQueue function| triggerEvent1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.talergam.mba/ | Name: cf_clearance Value: dsq0gDY.9hx8OF_gG5RTohAGsi0Iid77v6NMnMXce60-1734526501-1.2.1.1-GoI2B4jt7cjg_0wIrDVF.T10a67QKDVJT_XCxrw2mR7WlQYky_KI3imYst7r0HRHUzjU_muUvdvAcRFRanur9st2oyx8knRd48j70wiZ8opEH.Z_2zNsBFjt.ql20B.50UWTeuxgyc.yxNdJbqxjCDfqlXA43mlnpoN.4fhjncE3H3oQ0GtI4zdiws4OHFFDhOV4uTpIrSZjUnszLzJTG2Jwn8hVs0amasQgnzr4GoZj0sSB1_Ucull.H3L4NPqug.9cibUaw6gBX9AQ4LymZ618nMDPgBGnoklzAC5MPeF1gx8m2ia0VMVJNy91NYJouWP98WqTCH_tnwrzBI_.DY4S8Hf76ANs7Umpv8q_4dTX6pGiR.McOKYV9JIOiokO |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
talergam.mba
talergam.mba
2606:4700:3031::6815:f04
0fed69363a40e503cfcb65023e8bfdb9b98de62b1b7d938fcfb727fd16066580
1c212d7f877e37e31e5f815aff89652da368f22981004a7e9d3cf867e9c96599
4ff54bc38c267dc3a8c95f6ed4590336baaec70433ef15d027ddca608c391e78
51c4d88fd78f3b8efb16f845e75be7f1bb288fdf2fd39d033868a0346db7fadb
5fa6d7b6512f5bf9c386c77576caa60413ead3f81a5faba63a7a015c1daa7679
804b251a2cf825541b09dc04735b1499415b12e272b0527de1fbe09080585f43
832fbefd7a4fe8f651058597d9f1910883d1cbd56d0ceb343e7d6170aeecf982
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f1d083ffaa644c708f11db29707aa57c19246e6d32643b03fee3f82c17b224b3
f843ec50116b144b274c206d7fe25d70328ea6cf38bfcd349c1647f400c284b2
fad7e5604b38a58e74ebfcf5208551752c671234341958e3b1585bd7eea42e9e