urlscan.io logo urlscan.io
SecurityTrails logo

mail.nitrooseen.ir Open in urlscan Pro
45.87.42.33  Public Scan

Go To Rescan Add Verdict Report
URL: https://mail.nitrooseen.ir/
Submission Tags: phishingrod
Submission: On March 24 via api from DE — Scanned from NL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 7 HTTP transactions. The main IP is 45.87.42.33, located in Amsterdam, Netherlands and belongs to SPECTRAIP SpectraIP B.V., NL. The main domain is mail.nitrooseen.ir.
TLS certificate: Issued by R3 on March 24th 2023. Valid for: 3 months.
This is the only time mail.nitrooseen.ir was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 45.87.42.33 62068 (SPECTRAIP...)
5 2606:4700:303... 13335 (CLOUDFLAR...)
7 3
Apex Domain
Subdomains		 Transfer
5 tgmembers.com
tgmembers.com
54 KB
1 nitrooseen.ir
mail.nitrooseen.ir
394 KB
7 2
Domain Requested by
5 tgmembers.com mail.nitrooseen.ir
1 mail.nitrooseen.ir
7 2

This site contains no links.

Subject Issuer Validity Valid
nitrooseen.ir
R3		 2023-03-24 -
2023-06-22		 3 months crt.sh
*.tgmembers.com
GTS CA 1P5		 2023-01-25 -
2023-04-25		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://mail.nitrooseen.ir/
Frame ID: 55558FDB064B0B97E63EF36D31F96C6C
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

خرید ممبر فیک تلگرام ، خرید لایک تلگرام خرید رای تلگرام

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

7
Requests

86 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

449 kB
Transfer

545 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
mail.nitrooseen.ir/ 		394 KB
394 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://mail.nitrooseen.ir/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
45.87.42.33 Amsterdam, Netherlands, ASN62068 (SPECTRAIP SpectraIP B.V., NL),
Reverse DNS
harim88.pht.pw
Software
Apache /
Resource Hash
bf3778594e087437d4ab005fd8d42106a62eb115d168b2b40e8735636a9eab04

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

Accept-Ranges
bytes
Connection
Keep-Alive
Content-Length
403492
Content-Type
text/html
Date
Fri, 24 Mar 2023 18:00:58 GMT
Keep-Alive
timeout=5, max=100
Last-Modified
Sat, 26 Feb 2022 12:16:38 GMT
Server
Apache
jquery.min.js
tgmembers.com/wp-includes/js/jquery/ 		88 KB
32 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tgmembers.com/wp-includes/js/jquery/jquery.min.js
Requested by
Host: mail.nitrooseen.ir
URL: https://mail.nitrooseen.ir/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::6815:d5f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cc7403bab52ed166e24ea9324241045af370be482f5b594468f4a6ac6e7e7981

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://mail.nitrooseen.ir/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date
Fri, 24 Mar 2023 18:00:58 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Fri, 25 Nov 2022 09:35:40 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pPMssueANOVwqqEAotWHqhwF8bbJp8LGs%2B05eOHtj6KUvfpg0KMsoucoBgZdfLTKmcLe%2Fo65JR6C27XGxzUTPNW52SluKl9qU03mdl3cs6zp7lfgiOYGi9NnWUOJi9p6%2FOOGTxVvHA9%2BzJLG"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=2592000
cf-ray
7ad0d1147b10b77f-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires
Sun, 23 Apr 2023 18:00:58 GMT
jquery-migrate.min.js
tgmembers.com/wp-includes/js/jquery/ 		11 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tgmembers.com/wp-includes/js/jquery/jquery-migrate.min.js
Requested by
Host: mail.nitrooseen.ir
URL: https://mail.nitrooseen.ir/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::6815:d5f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://mail.nitrooseen.ir/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date
Fri, 24 Mar 2023 18:00:58 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Fri, 11 Dec 2020 17:20:39 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DAlFeuQNnwSsHQvZo0zgyIbRdTb9sts12QBLs8%2F1wMlAvEcFz1pTOXdQJ6Xncl%2BBDFZEsg2YVosjxKdT0tfSgcFAbPZnRj06OCeoLNmIWDwrFY0vEobmSYf6C3A5aF%2FTK75DrLrhbF2cHxeJ"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=2592000
cf-ray
7ad0d1147b13b77f-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires
Sun, 23 Apr 2023 18:00:58 GMT
autoptimize_single_c25c63a099fb2135bb24a00293bd19a8.php
tgmembers.com/wp-content/cache/autoptimize/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://tgmembers.com/wp-content/cache/autoptimize/autoptimize_single_c25c63a099fb2135bb24a00293bd19a8.php
Requested by
Host: mail.nitrooseen.ir
URL: https://mail.nitrooseen.ir/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::6815:d5f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
/
Resource Hash

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://mail.nitrooseen.ir/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers
autoptimize_3f393cf08298ce57026422b489d36a0c.php
tgmembers.com/wp-content/cache/autoptimize/ 		48 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tgmembers.com/wp-content/cache/autoptimize/autoptimize_3f393cf08298ce57026422b489d36a0c.php
Requested by
Host: mail.nitrooseen.ir
URL: https://mail.nitrooseen.ir/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::6815:d5f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b5c14d2f482bf7ee7a0b2c01a85de90018170cc5e2e03fa0db003697dd5f7543

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://mail.nitrooseen.ir/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date
Fri, 24 Mar 2023 18:00:58 GMT
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Sat, 28 Jan 2023 08:06:31 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nh9xPvhtk1RMarkvmhmUYrncJulilNVCdY5JZzAS67feseqpFmhUvzCdfPpT4l59RFk%2B1gTAasOdL56CEMilzq7SAkOkJyYPPQxVUAnt%2Bj86ZNI6Zh16lFLCHlhuS9g5EZlhQUjS66mAeGqT"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript; charset=utf-8
cache-control
max-age=30672000, public, immutable,public, immutable
cf-ray
7ad0d1154c12b77f-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires
Wed, 13 Mar 2024 18:00:58 GMT
vazir.woff
tgmembers.com/wp-content/themes/construction-zone/fonts/ 		0
0
zarinpaal.jpg
tgmembers.com/wp-content/uploads/2019/12/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tgmembers.com/wp-content/uploads/2019/12/zarinpaal.jpg
Requested by
Host: mail.nitrooseen.ir
URL: https://mail.nitrooseen.ir/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::6815:d5f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
aefe2613d46b2bc43b0b44e7fbbd8363a8d4814dfae0a0d75bd328031519e4a7

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://mail.nitrooseen.ir/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date
Fri, 24 Mar 2023 18:00:58 GMT
cf-cache-status
MISS
last-modified
Tue, 17 Dec 2019 06:47:36 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CBN9RcJy3CEvpTrMrT7ipq0171ICnEH5UMW8d9tn54ZF1oq%2BOUv9D36ATJvPGQM9HwjSUNT3fr1a9jEisNNnlQx6GQWrRYghT8QqaVaJu%2Ba1Ur6pdgkCJmLcBhlPzpQ9PGgjT2wACY1HUgFa"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
7ad0d1158c54b77f-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
3826
expires
Sun, 23 Apr 2023 18:00:58 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
tgmembers.com
URL
https://tgmembers.com/wp-content/themes/construction-zone/fonts/vazir.woff

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless undefined| $ function| jQuery

0 Cookies

3 Console Messages

Source Level URL
Text
javascript error URL: https://mail.nitrooseen.ir/
Message:
Access to font at 'https://tgmembers.com/wp-content/themes/construction-zone/fonts/vazir.woff' from origin 'https://mail.nitrooseen.ir' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://tgmembers.com/wp-content/themes/construction-zone/fonts/vazir.woff
Message:
Failed to load resource: net::ERR_FAILED
network error URL: https://tgmembers.com/wp-content/cache/autoptimize/autoptimize_single_c25c63a099fb2135bb24a00293bd19a8.php
Message:
Failed to load resource: the server responded with a status of 410 ()