urlscan.io logo urlscan.io
SecurityTrails logo

mail.nitrooseen.ir Open in urlscan Pro
164.132.30.136  Public Scan

Go To Rescan Add Verdict Report
URL: https://mail.nitrooseen.ir/
Submission Tags: phishingrod
Submission: On November 26 via api from DE — Scanned from FR
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 7 HTTP transactions. The main IP is 164.132.30.136, located in France and belongs to OVH, FR. The main domain is mail.nitrooseen.ir.
TLS certificate: Issued by R3 on November 25th 2023. Valid for: 3 months.
This is the only time mail.nitrooseen.ir was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 164.132.30.136 16276 (OVH)
5 2606:4700:303... 13335 (CLOUDFLAR...)
7 3
Apex Domain
Subdomains		 Transfer
5 tgmembers.com
tgmembers.com
55 KB
1 nitrooseen.ir
mail.nitrooseen.ir
394 KB
7 2
Domain Requested by
5 tgmembers.com mail.nitrooseen.ir
1 mail.nitrooseen.ir
7 2

This site contains no links.

Subject Issuer Validity Valid
*.nitrooseen.ir
R3		 2023-11-25 -
2024-02-23		 3 months crt.sh
tgmembers.com
GTS CA 1P5		 2023-11-17 -
2024-02-15		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://mail.nitrooseen.ir/
Frame ID: 20275EC9744717AC85F52AEA0FEC21C5
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

خرید ممبر فیک تلگرام ، خرید لایک تلگرام خرید رای تلگرام

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

7
Requests

86 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

449 kB
Transfer

545 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
mail.nitrooseen.ir/ 		394 KB
394 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://mail.nitrooseen.ir/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
164.132.30.136 , France, ASN16276 (OVH, FR),
Reverse DNS
ip136.ip-164-132-30.eu
Software
Apache /
Resource Hash
bf3778594e087437d4ab005fd8d42106a62eb115d168b2b40e8735636a9eab04

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language
fr-FR,fr;q=0.9

Response headers

Accept-Ranges
bytes
Connection
Keep-Alive
Content-Length
403492
Content-Type
text/html
Date
Sun, 26 Nov 2023 05:56:35 GMT
Keep-Alive
timeout=5, max=100
Last-Modified
Sat, 26 Feb 2022 12:16:38 GMT
Server
Apache
jquery.min.js
tgmembers.com/wp-includes/js/jquery/ 		86 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tgmembers.com/wp-includes/js/jquery/jquery.min.js
Requested by
Host: mail.nitrooseen.ir
URL: https://mail.nitrooseen.ir/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::6815:d5f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://mail.nitrooseen.ir/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Sun, 26 Nov 2023 05:56:35 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Thu, 09 Nov 2023 12:37:03 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=B5ot%2FcuAXxiWpS91HRvtrjts6kJNgiSSOvbENxfF%2FlDN0LwrGV5P2lrAr%2Fhoj%2BbIJQkOwlgKQQ%2BOata6wyr6et93GwqMeI547BmUdLxw08lPn8s4VM%2Fs2Y0UUBuNWd7TtluPbQjOB%2BE862BZ"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=2592000
cf-ray
82bfe39adfcd3c95-CDG
alt-svc
h3=":443"; ma=86400
expires
Tue, 26 Dec 2023 05:56:35 GMT
jquery-migrate.min.js
tgmembers.com/wp-includes/js/jquery/ 		13 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tgmembers.com/wp-includes/js/jquery/jquery-migrate.min.js
Requested by
Host: mail.nitrooseen.ir
URL: https://mail.nitrooseen.ir/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::6815:d5f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://mail.nitrooseen.ir/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Sun, 26 Nov 2023 05:56:35 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Sat, 19 Aug 2023 07:43:57 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BTSIXdJKp8MVZAOPm1vsAPohRBx6biSgu9AOgpktY%2Bk6r5yH%2Fb7FEnFXAVlJqLhdY4rmtoqRaGFXY5lHL%2B%2FMJ4mReC0YavpL7qXFkOkKeMsmyiyOMmgDiOlD6cTt51ww9DU28Z4XXf%2FTI0Qv"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=2592000
cf-ray
82bfe39adfd03c95-CDG
alt-svc
h3=":443"; ma=86400
expires
Tue, 26 Dec 2023 05:56:35 GMT
autoptimize_single_c25c63a099fb2135bb24a00293bd19a8.php
tgmembers.com/wp-content/cache/autoptimize/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://tgmembers.com/wp-content/cache/autoptimize/autoptimize_single_c25c63a099fb2135bb24a00293bd19a8.php
Requested by
Host: mail.nitrooseen.ir
URL: https://mail.nitrooseen.ir/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::6815:d5f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
/
Resource Hash

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://mail.nitrooseen.ir/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers
autoptimize_3f393cf08298ce57026422b489d36a0c.php
tgmembers.com/wp-content/cache/autoptimize/ 		48 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tgmembers.com/wp-content/cache/autoptimize/autoptimize_3f393cf08298ce57026422b489d36a0c.php
Requested by
Host: mail.nitrooseen.ir
URL: https://mail.nitrooseen.ir/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::6815:d5f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b5c14d2f482bf7ee7a0b2c01a85de90018170cc5e2e03fa0db003697dd5f7543

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://mail.nitrooseen.ir/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Sun, 26 Nov 2023 05:56:35 GMT
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Sat, 28 Jan 2023 08:06:31 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yFuva%2FPHBIQWbVHf%2BF4OLg0VbE5KTDsO3dRp8ho5vWZmdaGbkleKrKvzD7adKmELoNd9SqH%2BCYSNF%2BTZidvfJco%2BeAJtzWkLeTLGmAvO6dXjcPBC%2B560iYjeE2m0C5LpXDxhLGxO%2Bb14G3bf"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript; charset=utf-8
cache-control
max-age=30672000, public, immutable,public, immutable
cf-ray
82bfe39b58063c95-CDG
alt-svc
h3=":443"; ma=86400
expires
Fri, 15 Nov 2024 05:56:35 GMT
vazir.woff
tgmembers.com/wp-content/themes/construction-zone/fonts/ 		0
0
zarinpaal.jpg
tgmembers.com/wp-content/uploads/2019/12/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tgmembers.com/wp-content/uploads/2019/12/zarinpaal.jpg
Requested by
Host: mail.nitrooseen.ir
URL: https://mail.nitrooseen.ir/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::6815:d5f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
aefe2613d46b2bc43b0b44e7fbbd8363a8d4814dfae0a0d75bd328031519e4a7

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://mail.nitrooseen.ir/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Sun, 26 Nov 2023 05:56:35 GMT
cf-cache-status
MISS
last-modified
Tue, 17 Dec 2019 06:47:36 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=F10ixX7W%2FuFHoEyvpVL2Sv7tXBJMDH8ezuI6g8JqkzwE5FZvdrdcag7axATHBL91u%2Ffzy%2F5cOTfXPfAnIHFUdaaMDpFXCuw%2Bj4cLsfRiWefmsUJ6p8j5Yy0T7e4KtsVQCMdRMVHdO%2BeTm3%2BY"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
82bfe39b881b3c95-CDG
alt-svc
h3=":443"; ma=86400
content-length
3826
expires
Tue, 26 Dec 2023 05:56:35 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
tgmembers.com
URL
https://tgmembers.com/wp-content/themes/construction-zone/fonts/vazir.woff

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture undefined| $ function| jQuery

0 Cookies

3 Console Messages

Source Level URL
Text
javascript error URL: https://mail.nitrooseen.ir/
Message:
Access to font at 'https://tgmembers.com/wp-content/themes/construction-zone/fonts/vazir.woff' from origin 'https://mail.nitrooseen.ir' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://tgmembers.com/wp-content/themes/construction-zone/fonts/vazir.woff
Message:
Failed to load resource: net::ERR_FAILED
network error URL: https://tgmembers.com/wp-content/cache/autoptimize/autoptimize_single_c25c63a099fb2135bb24a00293bd19a8.php
Message:
Failed to load resource: the server responded with a status of 410 ()