my-telegram.xyz - urlscan.io

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 5 HTTP transactions. The main IP is 2606:4700:3037::ac43:a450, located in United States and belongs to CLOUDFLARENET, US. The main domain is my-telegram.xyz.
TLS certificate: Issued by GTS CA 1P5 on May 27th 2023. Valid for: 3 months.

This is the only time my-telegram.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Telegram (Instant Messenger)

Domain & IP information

	IP Address	AS Autonomous System
1 5	2606:4700:303... 2606:4700:3037::ac43:a450	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:3a	20446 (STACKPATH...) (STACKPATH-CDN)
5	3

5 2606:4700:3037::ac43:a450 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

my-telegram.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:3a (Netherlands)

ASN20446 (STACKPATH-CDN, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	my-telegram.xyz 1 redirects my-telegram.xyz	10 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 696	31 KB
5	2

	Domain	Requested by
5	my-telegram.xyz	1 redirects my-telegram.xyz
1	code.jquery.com	my-telegram.xyz
5	2

This site contains no links.

Subject Issuer	Validity	Valid
my-telegram.xyz GTS CA 1P5	`2023-05-27` - `2023-08-25`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2022-08-03` - `2023-07-14`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://my-telegram.xyz/login
Frame ID: EB38F4E393804E7BA2C5695C56E22766
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Telegram

Page URL History Show full URLs

http://my-telegram.xyz/ HTTP 301
https://my-telegram.xyz/ Page URL
https://my-telegram.xyz/login Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

5
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

40 kB
Transfer

125 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://my-telegram.xyz/ HTTP 301
https://my-telegram.xyz/ Page URL
https://my-telegram.xyz/login Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://my-telegram.xyz/ HTTP 301
https://my-telegram.xyz/

5 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ Show response my-telegram.xyz/ Redirect Chain http://my-telegram.xyz/ https://my-telegram.xyz/	51 B 483 B	97ms 56ms	Document text/html	2606:4700:3037::ac43:a450 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://my-telegram.xyz/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:a450 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `32e61cba02abf69d787f8be652f516775a81270b787cb9f9ebad14198425098d` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 7cee47ccea3523ae-LHR content-encoding br content-type text/html; charset=utf-8 date Mon, 29 May 2023 11:08:37 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oGHXZkxXVeS%2FbCMLvJ%2BSYRxB3j5z7UbBDsXAwEdrCHB2HXrr10Czn26dpRerFdd5n5483QrejN2ioXd31pwdX1ENy0FGYIz8qgz0lSHEYHcA9u3D4a4gf8hy3TZxrSiAL0RRDE%2BNLMjm6ClRv0I%3D"}],"group":"cf-nel","max_age":604800} server cloudflare Redirect headers CF-RAY 7cee47cc7c85718a-LHR Cache-Control max-age=3600 Connection keep-alive Date Mon, 29 May 2023 11:08:37 GMT Expires Mon, 29 May 2023 12:08:37 GMT Location https://my-telegram.xyz/ NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7T2Qkumn2ETjobiuSqtp9T5%2FH%2BAV3rpx%2FusECYy9Jf9nn1eWyRqHzdUSOxJ32JwAecnqM9hP0p7%2Fo55rwq9Nm1WcKrN4OgCwz2wEWlGpdVUwzQTL1OBobsBPRS6v3SCQtlvKdGqgD4k861OwWsw%3D"}],"group":"cf-nel","max_age":604800} Server cloudflare Transfer-Encoding chunked Vary Accept-Encoding alt-svc h3=":443"; ma=86400
GET H2	200	Primary Request login Show response my-telegram.xyz/	5 KB 2 KB	35ms 35ms	Document text/html	2606:4700:3037::ac43:a450 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://my-telegram.xyz/login Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:a450 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `873156de3431acb307a0f9646bde29e14b5dd9561cc9cfdd822a5689113a7746` Request headers Referer https://my-telegram.xyz/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 7cee47cd9b2e23ae-LHR content-encoding br content-type text/html; charset=utf-8 date Mon, 29 May 2023 11:08:37 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=e8nnCn263Bh7cbaq4tnHI8dDDAxDPxiyeQ8z%2FVE9E6F3IzMbbwkdnqvBBG7AyJ6vfT%2F7Q5WoeWpsPjNV2wEvYNKB6S%2FPED%2B3QkscjRSwq5%2FqdqnU5BtcTboVANBfgg1EoJzfT%2BrOpAjStqaL%2FoE%3D"}],"group":"cf-nel","max_age":604800} server cloudflare
GET H2	200	jquery-3.6.3.min.js Show response code.jquery.com/	88 KB 31 KB	63ms 18ms	Script application/javascript	2001:4de0:ac18::1:a:3a STACKPATH-CDN
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.6.3.min.js Requested by Host: my-telegram.xyz URL: https://my-telegram.xyz/login Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:3a , Netherlands, ASN20446 (STACKPATH-CDN, US), Reverse DNS Software nginx / Resource Hash `a6f3f0faea4b3d48e03176341bef0ed3151ffbf226d4c6635f1c6039c0500575` Request headers Referer https://my-telegram.xyz/ Origin https://my-telegram.xyz accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Mon, 29 May 2023 11:08:37 GMT content-encoding gzip last-modified Tue, 20 Dec 2022 21:10:40 GMT server nginx etag W/"63a224d0-15f5b" vary Accept-Encoding x-hw 1685358517.dop203.am5.t,1685358517.cds316.am5.hn,1685358517.cds258.am5.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 31046
GET H2	200	styles.css my-telegram.xyz/static/	31 KB 6 KB	68ms 68ms	Stylesheet text/css	2606:4700:3037::ac43:a450 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://my-telegram.xyz/static/styles.css Requested by Host: my-telegram.xyz URL: https://my-telegram.xyz/login Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:a450 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `b3e77379ba8d163b7585972f2a3a7d6dd8d2561038d1b164ff2b2c265a77e3d3` Request headers accept-language de-DE,de;q=0.9 Referer https://my-telegram.xyz/login User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Mon, 29 May 2023 11:08:37 GMT content-encoding br cf-cache-status MISS last-modified Thu, 18 May 2023 14:37:11 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"1684420631.774571-31630-400035481" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Sv8tfyKyHcM8ctQliXYIhIsxLtMYNKvGjio96UqJdKRlhk5mjw%2Fd%2Bq6L83Y3kAiwcKKlo%2B%2B6vWEFXb1p9gfqNWExIWqwnMPutyaGL1WjgtmPunOA6zSHHC8ZimdDcIKhAyBeKqU2kR%2Fh8RhpQM8%3D"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 cache-control public, max-age=43200 cf-ray 7cee47cdcb8123ae-LHR alt-svc h3=":443"; ma=86400 expires Mon, 29 May 2023 23:08:37 GMT
GET H3	200	telegram-logo.1b2bb5b107f046ea9325.svg my-telegram.xyz/static/	932 B 1 KB	25ms 24ms	Image image/svg+xml	2606:4700:3037::ac43:a450 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://my-telegram.xyz/static/telegram-logo.1b2bb5b107f046ea9325.svg Requested by Host: my-telegram.xyz URL: https://my-telegram.xyz/static/styles.css Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3037::ac43:a450 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `ade1ddec66f6e98e30d8a56b01e7dd9d2c84a8f4dac51bc88d2ab5bc6e5d1a62` Request headers accept-language de-DE,de;q=0.9 Referer https://my-telegram.xyz/static/styles.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Mon, 29 May 2023 11:08:37 GMT content-encoding br cf-cache-status HIT last-modified Thu, 18 May 2023 14:36:29 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 14266 etag W/"1684420589.073519-932-603657898" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HTA2IsO7k0VB%2FWEu5TMlT9opeebkxPiMm0uhE7coIvG6NPhumXlegrVWIRJLAiedtzGeoXTBqhl6DTkcIzAYGs72mfe2hhQl7Rugz1lG3i6DR8zZR%2BshMeI8tCfUeIRWFZeV11FwYnA0VL9UuWU%3D"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml; charset=utf-8 cache-control public, max-age=43200 cf-ray 7cee47ce7abf88a4-LHR alt-svc h3=":443"; ma=86400 expires Mon, 29 May 2023 19:10:51 GMT
GET DATA	200 OK	truncated /	244 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `6b9e73b25890fe9c309feff6ef849db08babba9c055b169c20815866d264f3ef` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers Content-Type image/svg+xml

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Telegram (Instant Messenger)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
my-telegram.xyz
2001:4de0:ac18::1:a:3a
2606:4700:3037::ac43:a450
32e61cba02abf69d787f8be652f516775a81270b787cb9f9ebad14198425098d
6b9e73b25890fe9c309feff6ef849db08babba9c055b169c20815866d264f3ef
873156de3431acb307a0f9646bde29e14b5dd9561cc9cfdd822a5689113a7746
a6f3f0faea4b3d48e03176341bef0ed3151ffbf226d4c6635f1c6039c0500575
ade1ddec66f6e98e30d8a56b01e7dd9d2c84a8f4dac51bc88d2ab5bc6e5d1a62
b3e77379ba8d163b7585972f2a3a7d6dd8d2561038d1b164ff2b2c265a77e3d3

my-telegram.xyz Open in urlscan Pro 2606:4700:3037::ac43:a450 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

5 Requests

100 %HTTPS

100 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

40 kBTransfer

125 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

Indicators

my-telegram.xyz Open in urlscan Pro
2606:4700:3037::ac43:a450 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

40 kB
Transfer

125 kB
Size

0
Cookies

5 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!