tgk.cloudflared.eu.org
Open in
urlscan Pro
2606:4700:3036::ac43:96a6
Malicious Activity!
Public Scan
Submission: On July 28 via api from US — Scanned from DE
Summary
TLS certificate: Issued by E6 on July 27th 2024. Valid for: 3 months.
This is the only time tgk.cloudflared.eu.org was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Telegram (Instant Messenger)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
12 | 2606:4700:303... 2606:4700:3036::ac43:96a6 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
19 | 2 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
eu.org
tgk.cloudflared.eu.org |
175 KB |
19 | 1 |
Domain | Requested by | |
---|---|---|
12 | tgk.cloudflared.eu.org |
tgk.cloudflared.eu.org
|
19 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
tgk.cloudflared.eu.org E6 |
2024-07-27 - 2024-10-25 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://tgk.cloudflared.eu.org/
Frame ID: F6A9E5A98808B079DAA527CAA37F6449
Requests: 15 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
19 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
Primary Request
/
tgk.cloudflared.eu.org/ |
14 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
index-608b9304.js
tgk.cloudflared.eu.org/ |
100 KB 36 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
index-220aaf7e.css
tgk.cloudflared.eu.org/ |
397 KB 69 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
mtproto.worker-b1496cf3.js
tgk.cloudflared.eu.org/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
crypto.worker-9d5beacd.js
tgk.cloudflared.eu.org/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
crypto.worker-9d5beacd.js
tgk.cloudflared.eu.org/ |
67 KB 24 KB |
Fetch
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
lang-c1c2a466.js
tgk.cloudflared.eu.org/ |
76 KB 23 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
langSign-f5a5610c.js
tgk.cloudflared.eu.org/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
countries-5301fc59.js
tgk.cloudflared.eu.org/ |
24 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
tgk.cloudflared.eu.org/assets/img/ |
15 KB 4 KB |
Other
image/vnd.microsoft.icon |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
735d1d78-a597-4c1e-977d-232bf970f85e
https://tgk.cloudflared.eu.org/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
f7e279a6-2dbf-46b4-8faa-fc4a4d0d3543
https://tgk.cloudflared.eu.org/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
6b566400-b7c3-42b6-895f-ca2f0d4e3eb9
https://tgk.cloudflared.eu.org/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
pageSignQR-d156e9ed.js
tgk.cloudflared.eu.org/ |
5 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
page-f3fa5d52.js
tgk.cloudflared.eu.org/ |
10 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bytesCmp-36048258.js
tgk.cloudflared.eu.org/ |
3 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
putPreloader-30e45920.js
tgk.cloudflared.eu.org/ |
697 B 984 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
qr-code-styling-c40cd486.js
tgk.cloudflared.eu.org/ |
65 KB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logo_padded.svg
tgk.cloudflared.eu.org/assets/img/ |
1 KB 0 |
Fetch
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- tgk.cloudflared.eu.org
- URL
- https://tgk.cloudflared.eu.org/mtproto.worker-b1496cf3.js
- Domain
- tgk.cloudflared.eu.org
- URL
- https://tgk.cloudflared.eu.org/crypto.worker-9d5beacd.js
- Domain
- tgk.cloudflared.eu.org
- URL
- blob:https://tgk.cloudflared.eu.org/735d1d78-a597-4c1e-977d-232bf970f85e
- Domain
- tgk.cloudflared.eu.org
- URL
- blob:https://tgk.cloudflared.eu.org/f7e279a6-2dbf-46b4-8faa-fc4a4d0d3543
- Domain
- tgk.cloudflared.eu.org
- URL
- blob:https://tgk.cloudflared.eu.org/6b566400-b7c3-42b6-895f-ca2f0d4e3eb9
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Telegram (Instant Messenger)26 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| rootScope function| AppStorage object| stateStorage function| wrapUrl object| I18n object| webpWorkerController object| appStorage object| singleInstance object| webPushApiManager object| telegramMeWebManager object| opusDecodeController object| cryptoMessagePort object| mtprotoMessagePort object| serviceMessagePort object| apiManagerProxy function| calcImageInBox object| mediaSizes object| customProperties object| themeController function| formatDateAccordingToTodayNew function| fillTipDates function| dispatchHeavyAnimationEvent object| liteMode object| pagesManager object| sequentialDom function| putPreloader0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
tgk.cloudflared.eu.org
tgk.cloudflared.eu.org
2606:4700:3036::ac43:96a6
11ca618d8837ebe9691487335a53e7d3fd5edc7428a56e3b8ceb2e9c200b77bd
220aaf7ecb349275e87712148c3a60fe8bf438b430775494faf6f5d55c83c3ca
36c05f41d64ffc094490d1fa53097ed9380608ff904f2db231d98aa439b8e9d7
4418dd970a23a06fd8bc4d081fe0ce0180dae450f2f97a4a0c6f7f0baf1f69d5
48d812700c5555c6823724cb0ce93936e5067175e37a41b6f3edd1ceecea2bfc
680ffaadae6dbafdcac61b10ebeddb345a7d810559a651a11ac4de53ee5ca56a
69cddd63de895c51d41b85a0b17b701276910af02c51694ce652d1ca9ff9f7fc
75b2b1645da9407793d922a19e00801b031593e54e1f9f8aa5644621daaeb495
76070b61f4b1a734176b561671a3fe24d21d383fe568e0b45f3acad2c016a4a2
7b4921656e143af35794b7fc9d4d23580fa232ffcf179bc8569317e424032d80
7e2388ec283fe17472ef02829a93da550af8f3ad4a975f50a0110bff61afe523
a3746fddcdb2dbeb06bf2704e63893f9b2f53fe69429f96b96c86e8fabbf8073
a6821e933ed5783983277ca00bae17c08bdb5764eba6aa3d2cb30dc40dabb672
eeb79b0ae5da35d3433de6edeec3a0e3cce9c24f517dbad26ed97e852666c8f4