urlscan.io logo urlscan.io
SecurityTrails logo

letsstart.site Open in urlscan Pro
185.104.45.2  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://letsstart.site/
Effective URL: https://letsstart.site/
Submission: On October 16 via api from AU — Scanned from AU
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 13 HTTP transactions. The main IP is 185.104.45.2, located in Ukraine and belongs to UKRAINE-AS, UA. The main domain is letsstart.site.
TLS certificate: Issued by R11 on August 23rd 2024. Valid for: 3 months.
This is the only time letsstart.site was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Telegram (Instant Messenger)

Domain & IP information

IP Address AS Autonomous System
10 185.104.45.2 200000 (UKRAINE-AS)
1 172.67.208.186 13335 (CLOUDFLAR...)
13 3
Apex Domain
Subdomains		 Transfer
10 letsstart.site
letsstart.site
169 KB
1 userstatics.com
userstatics.com — Cisco Umbrella Rank: 130056
697 B
0 Failed
function sub() { [native code] }. Failed
13 3
Domain Requested by
10 letsstart.site letsstart.site
1 userstatics.com letsstart.site
0 join Failed letsstart.site
13 3

This site contains links to these domains. Also see Links.

Domain
t.me
Subject Issuer Validity Valid
www.letsstart.site
R11		 2024-08-23 -
2024-11-21		 3 months crt.sh
userstatics.com
WE1		 2024-09-21 -
2024-12-20		 3 months crt.sh

This page contains 3 frames:

Primary Page: https://letsstart.site/
Frame ID: A8A750DFD037A265EE5EFFFD3D7A114A
Requests: 11 HTTP requests in this frame

Frame: tg://join?invite=lLvCKKlPa-EyZDJi
Frame ID: 68BFAB894C183759574D187B5E0D2642
Requests: 1 HTTP requests in this frame

Frame: tg://join?invite=lLvCKKlPa-EyZDJi
Frame ID: B24F4AFFADEBCA5BCB290AF1F6CD45EE
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Telegram: Join Group Chat

Page URL History Show full URLs

  1. http://letsstart.site/ HTTP 307
    https://letsstart.site/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Page Statistics

13
Requests

85 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

170 kB
Transfer

466 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://letsstart.site/ HTTP 307
    https://letsstart.site/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
letsstart.site/
Redirect Chain
  • http://letsstart.site/
  • https://letsstart.site/
10 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://letsstart.site/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.104.45.2 , Ukraine, ASN200000 (UKRAINE-AS, UA),
Reverse DNS
web377.default-host.net
Software
nginx /
Resource Hash
180ebf45f6e0cc134dd73f732c7fc125dba3f6cb025197d618cad4798e5a6e4c

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

content-encoding
br
content-type
text/html
date
Wed, 16 Oct 2024 07:53:32 GMT
etag
W/"29d3-60f168256680a"
last-modified
Tue, 16 Jan 2024 21:06:50 GMT
server
nginx
x-ray
wnp32786:0.000/wn32786:0.000/wa32786:D=1078

Redirect headers

Location
https://letsstart.site/
Non-Authoritative-Reason
HttpsUpgrades
font-roboto.css
letsstart.site/css/ 		6 KB
725 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://letsstart.site/css/font-roboto.css
Requested by
Host: letsstart.site
URL: https://letsstart.site/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.104.45.2 , Ukraine, ASN200000 (UKRAINE-AS, UA),
Reverse DNS
web377.default-host.net
Software
nginx /
Resource Hash
7dc681d034591a7547af531a6c9d5a757a37179f9d9796db25a990a510e51182

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://letsstart.site/

Response headers

content-encoding
br
x-ray
wnp32786:0.000/wn32786:0.000/
date
Wed, 16 Oct 2024 07:53:32 GMT
etag
W/"658c5cc0-1783"
content-type
text/css
last-modified
Wed, 27 Dec 2023 17:20:00 GMT
server
nginx
bootstrap.min.css
letsstart.site/css/ 		42 KB
8 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://letsstart.site/css/bootstrap.min.css
Requested by
Host: letsstart.site
URL: https://letsstart.site/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.104.45.2 , Ukraine, ASN200000 (UKRAINE-AS, UA),
Reverse DNS
web377.default-host.net
Software
nginx /
Resource Hash
f1d083ffaa644c708f11db29707aa57c19246e6d32643b03fee3f82c17b224b3

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://letsstart.site/

Response headers

content-encoding
br
x-ray
wnp32786:0.000/wn32786:0.000/
date
Wed, 16 Oct 2024 07:53:32 GMT
etag
W/"658c5cc0-a61b"
content-type
text/css
last-modified
Wed, 27 Dec 2023 17:20:00 GMT
server
nginx
telegram.css
letsstart.site/css/ 		112 KB
21 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://letsstart.site/css/telegram.css
Requested by
Host: letsstart.site
URL: https://letsstart.site/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.104.45.2 , Ukraine, ASN200000 (UKRAINE-AS, UA),
Reverse DNS
web377.default-host.net
Software
nginx /
Resource Hash
1e7d2120361036751037cc446d7cec89e45aa6ff43468a921438b0b6dc707dea

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://letsstart.site/

Response headers

content-encoding
br
x-ray
wnp32786:0.010/wn32786:0.000/
date
Wed, 16 Oct 2024 07:53:32 GMT
etag
W/"658c5cc0-1c135"
content-type
text/css
last-modified
Wed, 27 Dec 2023 17:20:00 GMT
server
nginx
123.jpeg
letsstart.site/images/ 		30 KB
31 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://letsstart.site/images/123.jpeg
Requested by
Host: letsstart.site
URL: https://letsstart.site/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.104.45.2 , Ukraine, ASN200000 (UKRAINE-AS, UA),
Reverse DNS
web377.default-host.net
Software
nginx /
Resource Hash
2229bd9aa6b2cf023017a8d18883e3af5557c1cd64c82f14746f62a634537d21

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://letsstart.site/

Response headers

etag
"65b17ab4-794d"
accept-ranges
bytes
content-length
31053
x-ray
wnp32786:0.000/wn32786:0.000/
date
Wed, 16 Oct 2024 07:53:32 GMT
content-type
image/jpeg
last-modified
Wed, 24 Jan 2024 21:01:40 GMT
server
nginx
tgwallpaper.min.js
letsstart.site/js/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://letsstart.site/js/tgwallpaper.min.js
Requested by
Host: letsstart.site
URL: https://letsstart.site/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.104.45.2 , Ukraine, ASN200000 (UKRAINE-AS, UA),
Reverse DNS
web377.default-host.net
Software
nginx /
Resource Hash
1d724dbc182d52d1b7b367fcf6fa14a9ffac4a63c1de1d52648cf123f6c50593

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://letsstart.site/

Response headers

content-encoding
br
x-ray
wnp32786:0.010/wn32786:0.000/
date
Wed, 16 Oct 2024 07:53:32 GMT
etag
W/"658c5cc9-d3a"
content-type
application/javascript
last-modified
Wed, 27 Dec 2023 17:20:09 GMT
server
nginx
tg://join?invite=lLvCKKlPa-EyZDJi
tg://join?invite=lLvCKKlPa-EyZDJi Frame 68BF 		0
0
pattern.svg
letsstart.site/images/ 		226 KB
67 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://letsstart.site/images/pattern.svg
Requested by
Host: letsstart.site
URL: https://letsstart.site/css/telegram.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.104.45.2 , Ukraine, ASN200000 (UKRAINE-AS, UA),
Reverse DNS
web377.default-host.net
Software
nginx /
Resource Hash
118add53487c02aaf5b5ab9f69380fa06717deb10492e14aaa487e3c62806ad4

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://letsstart.site/css/telegram.css

Response headers

content-encoding
br
x-ray
wnp32786:0.000/wn32786:0.000/
date
Wed, 16 Oct 2024 07:53:33 GMT
etag
W/"65b17ab1-3891a"
content-type
image/svg+xml
last-modified
Wed, 24 Jan 2024 21:01:37 GMT
server
nginx
KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
letsstart.site/fonts/ 		11 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://letsstart.site/fonts/KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
Requested by
Host: letsstart.site
URL: https://letsstart.site/css/font-roboto.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.104.45.2 , Ukraine, ASN200000 (UKRAINE-AS, UA),
Reverse DNS
web377.default-host.net
Software
nginx /
Resource Hash
0f53e8b0a717ca4ce313eec62b90d41db62c2f4946259a65c93bf8e84c5b0c44

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin
https://letsstart.site
Referer
https://letsstart.site/css/font-roboto.css

Response headers

etag
"658c5cc1-2b20"
accept-ranges
bytes
content-length
11040
x-ray
wnp32786:0.000/wn32786:0.000/
date
Wed, 16 Oct 2024 07:53:33 GMT
content-type
font/woff2
last-modified
Wed, 27 Dec 2023 17:20:01 GMT
server
nginx
KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
letsstart.site/fonts/ 		11 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://letsstart.site/fonts/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
Requested by
Host: letsstart.site
URL: https://letsstart.site/css/font-roboto.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.104.45.2 , Ukraine, ASN200000 (UKRAINE-AS, UA),
Reverse DNS
web377.default-host.net
Software
nginx /
Resource Hash
796de064b8d80eba7ccacb8ba67d77fdbcdf4b385c844645d452c24537b3108f

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin
https://letsstart.site
Referer
https://letsstart.site/css/font-roboto.css

Response headers

etag
"658c5cc0-2b14"
accept-ranges
bytes
content-length
11028
x-ray
wnp32786:0.000/wn32786:0.000/
date
Wed, 16 Oct 2024 07:53:33 GMT
content-type
font/woff2
last-modified
Wed, 27 Dec 2023 17:20:00 GMT
server
nginx
tg://join?invite=lLvCKKlPa-EyZDJi
tg://join?invite=lLvCKKlPa-EyZDJi Frame B24F 		0
0
favicon.ico
letsstart.site/ 		15 KB
15 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://letsstart.site/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.104.45.2 , Ukraine, ASN200000 (UKRAINE-AS, UA),
Reverse DNS
web377.default-host.net
Software
nginx /
Resource Hash
4ff54bc38c267dc3a8c95f6ed4590336baaec70433ef15d027ddca608c391e78

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://letsstart.site/

Response headers

etag
"65a6efe9-3aee"
accept-ranges
bytes
content-length
15086
x-ray
wnp32786:0.000/wn32786:0.000/
date
Wed, 16 Oct 2024 07:53:34 GMT
content-type
image/x-icon
last-modified
Tue, 16 Jan 2024 21:06:49 GMT
server
nginx
script.js
userstatics.com/get/ 		133 B
697 B 		Script
General
Check archive.org
Download Go to
Full URL
https://userstatics.com/get/script.js?referrer=https://letsstart.site/
Requested by
Host: letsstart.site
URL: https://letsstart.site/js/tgwallpaper.min.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.208.186 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/8.2.1
Resource Hash
df9690fea031319de38a437cb6d393026c4aae70642ed394c4254ed64f035b26

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://letsstart.site/

Response headers

content-encoding
zstd
cf-cache-status
DYNAMIC
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FB%2FWEU12zRxOhqPoL0RYdY%2FpdQblmKye8Q8iZ5lp1nQdAQOX4FR10gkGzrPdsgOm3D0ECMMcqgo8W80ufLL9YP9uiQ70N6FXal%2Fy7XZikFx2u9PvwBnja4nt%2BWxlogys31o%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods
GET, POST
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 16 Oct 2024 07:53:35 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
access-control-allow-headers
X-Requested-With,content-type
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials
true
cf-ray
8d3679d66e3fa7ef-SYD
access-control-allow-origin
https://letsstart.site
x-powered-by
PHP/8.2.1
server
cloudflare

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
join
URL
tg://join?invite=lLvCKKlPa-EyZDJi
Domain
join
URL
tg://join?invite=lLvCKKlPa-EyZDJi

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Telegram (Instant Messenger)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| TWallpaper string| protoUrl object| iframeContEl object| iframeEl object| tme_bg function| toggleTheme object| darkMedia

1 Cookies

Domain/Path Name / Value
letsstart.site/ Name: PHPREFS
Value: full

2 Console Messages

Source Level URL
Text
other error URL: https://letsstart.site/
Message:
Not allowed to launch 'tg://join?invite=lLvCKKlPa-EyZDJi' because a user gesture is required.
other error URL: https://letsstart.site/(Line 149)
Message:
Not allowed to launch 'tg://join?invite=lLvCKKlPa-EyZDJi' because a user gesture is required.