entry5500-js2024r2.usercontent.dev Open in urlscan Pro
178.128.255.27 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://entry5500-js2024r2.usercontent.dev/
Effective URL:
https://entry5500-js2024r2.usercontent.dev/
Submission: On October 14 via api (October 14th 2024, 1:16:58 am UTC) from US — Scanned from NL

Summary HTTP 21 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 21 HTTP transactions. The main IP is 178.128.255.27, located in Amsterdam, Netherlands and belongs to DIGITALOCEAN-ASN, US. The main domain is entry5500-js2024r2.usercontent.dev.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on September 19th 2023. Valid for: a year.

This is the only time entry5500-js2024r2.usercontent.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Telegram (Instant Messenger)

Domain & IP information

	IP Address		AS Autonomous System
15	178.128.255.27 178.128.255.27		14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
21	2

15 178.128.255.27 (Amsterdam, Netherlands)

ASN14061 (DIGITALOCEAN-ASN, US)

entry5500-js2024r2.usercontent.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
15	usercontent.dev entry5500-js2024r2.usercontent.dev	249 KB
21	1

	Domain	Requested by
15	entry5500-js2024r2.usercontent.dev	entry5500-js2024r2.usercontent.dev
21	1

This site contains no links.

Subject Issuer	Validity	Valid
*.usercontent.dev Go Daddy Secure Certificate Authority - G2	`2023-09-19` - `2024-10-20`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://entry5500-js2024r2.usercontent.dev/
Frame ID: 34BF77AC48EB826EA611667C3BFBCE93
Requests: 20 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Telegram Web

Page URL History Show full URLs

http://entry5500-js2024r2.usercontent.dev/ HTTP 307
https://entry5500-js2024r2.usercontent.dev/ Page URL

Page Statistics

21
Requests

71 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

249 kB
Transfer

967 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://entry5500-js2024r2.usercontent.dev/ HTTP 307
https://entry5500-js2024r2.usercontent.dev/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

21 HTTP transactions
4 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response entry5500-js2024r2.usercontent.dev/ Redirect Chain http://entry5500-js2024r2.usercontent.dev/ https://entry5500-js2024r2.usercontent.dev/	13 KB 5 KB	83ms 19ms	Document text/html	178.128.255.27 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://entry5500-js2024r2.usercontent.dev/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 178.128.255.27 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software nginx/1.10.3 / Resource Hash `edb840b9f5c98a4f5248f3b188718801c5880cb58b683bb3f77aa847c1ce09cc` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Response headers Connection keep-alive Content-Encoding gzip Content-Type text/html; charset=UTF-8 Date Mon, 14 Oct 2024 02:27:33 GMT ETag W/"66a96578-3523" Last-Modified Tue, 30 Jul 2024 22:13:12 GMT Server nginx/1.10.3 Transfer-Encoding chunked Vary Accept-Encoding Redirect headers Cross-Origin-Resource-Policy Cross-Origin Location https://entry5500-js2024r2.usercontent.dev/ Non-Authoritative-Reason HSTS
GET H/1.1	200 OK	index-DAwVIcSV.js Show response entry5500-js2024r2.usercontent.dev/	133 KB 48 KB	35ms 35ms	Script application/javascript	178.128.255.27 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://entry5500-js2024r2.usercontent.dev/index-DAwVIcSV.js Requested by Host: entry5500-js2024r2.usercontent.dev URL: https://entry5500-js2024r2.usercontent.dev/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 178.128.255.27 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software nginx/1.10.3 / Resource Hash `59603047eac7cf946dc4aa982a74193c206781b0570c33cb0b627ea34c0e801c` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://entry5500-js2024r2.usercontent.dev Referer https://entry5500-js2024r2.usercontent.dev/ Response headers Transfer-Encoding chunked Content-Encoding gzip ETag W/"66a96578-21255" Connection keep-alive Date Mon, 14 Oct 2024 02:27:33 GMT Content-Type application/javascript; charset=UTF-8 Last-Modified Tue, 30 Jul 2024 22:13:12 GMT Server nginx/1.10.3 Vary Accept-Encoding
GET H/1.1	200 OK	index-CTVyo94k.css entry5500-js2024r2.usercontent.dev/	490 KB 84 KB	70ms 39ms	Stylesheet text/css	178.128.255.27 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://entry5500-js2024r2.usercontent.dev/index-CTVyo94k.css Requested by Host: entry5500-js2024r2.usercontent.dev URL: https://entry5500-js2024r2.usercontent.dev/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 178.128.255.27 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software nginx/1.10.3 / Resource Hash `0023f0bb0c3821799bd519707ab25a88964d55fabab8acc4754ad3207bf545c5` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://entry5500-js2024r2.usercontent.dev Referer https://entry5500-js2024r2.usercontent.dev/ Response headers Transfer-Encoding chunked Content-Encoding gzip ETag W/"66a96578-7a8b9" Connection keep-alive Date Mon, 14 Oct 2024 02:27:33 GMT Content-Type text/css Last-Modified Tue, 30 Jul 2024 22:13:12 GMT Server nginx/1.10.3 Vary Accept-Encoding
GET		mtproto.worker-B-1JLZRa.js entry5500-js2024r2.usercontent.dev/	0 0

GET		crypto.worker-CfCshcpI.js entry5500-js2024r2.usercontent.dev/	0 0

GET DATA	200 OK	truncated /	369 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `6f2cf0c99091af44641cb27eee6a0f32a56aa85f446f60a9482864f2ade413d4` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers Content-Type image/svg+xml
GET H/1.1	200 OK	crypto.worker-CfCshcpI.js Show response entry5500-js2024r2.usercontent.dev/	67 KB 24 KB	21ms 21ms	Fetch application/javascript	178.128.255.27 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://entry5500-js2024r2.usercontent.dev/crypto.worker-CfCshcpI.js Requested by Host: entry5500-js2024r2.usercontent.dev URL: https://entry5500-js2024r2.usercontent.dev/index-DAwVIcSV.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 178.128.255.27 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software nginx/1.10.3 / Resource Hash `db66f764c311c8c976601370a59831be1b792fe9535c8f36f7de75334226b071` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://entry5500-js2024r2.usercontent.dev/ Response headers Transfer-Encoding chunked Content-Encoding gzip ETag W/"66a96578-10d02" Connection keep-alive Date Mon, 14 Oct 2024 02:27:33 GMT Content-Type application/javascript; charset=UTF-8 Last-Modified Tue, 30 Jul 2024 22:13:12 GMT Server nginx/1.10.3 Vary Accept-Encoding
GET DATA	200 OK	truncated /	59 B 59 B		Image image/jxl
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers Content-Type image/jxl
GET DATA	200 OK	truncated /	311 B 0		Image image/avif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `04dfc8e1a6e59e36a3a3a5c15443a97a92a6d2a7da9d276b050d58be3c7952a7` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers Content-Type image/avif
GET H/1.1	200 OK	favicon.ico entry5500-js2024r2.usercontent.dev/assets/img/	15 KB 15 KB	26ms 16ms	Other image/x-icon	178.128.255.27 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://entry5500-js2024r2.usercontent.dev/assets/img/favicon.ico?v=jw3mK7G9Ry Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 178.128.255.27 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software nginx/1.10.3 / Resource Hash `7e2388ec283fe17472ef02829a93da550af8f3ad4a975f50a0110bff61afe523` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://entry5500-js2024r2.usercontent.dev/ Response headers ETag "66a96578-3aee" Connection keep-alive Accept-Ranges bytes Content-Length 15086 Date Mon, 14 Oct 2024 02:27:33 GMT Content-Type image/x-icon Last-Modified Tue, 30 Jul 2024 22:13:12 GMT Server nginx/1.10.3
GET H/1.1	200 OK	lang-DnpZoegq.js Show response entry5500-js2024r2.usercontent.dev/	130 KB 38 KB	47ms 24ms	Script application/javascript	178.128.255.27 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://entry5500-js2024r2.usercontent.dev/lang-DnpZoegq.js Requested by Host: entry5500-js2024r2.usercontent.dev URL: https://entry5500-js2024r2.usercontent.dev/index-DAwVIcSV.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 178.128.255.27 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software nginx/1.10.3 / Resource Hash `72c34a540e7ab561851bf947b03a0ae5c18853e251e61609807d12e1080e3326` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://entry5500-js2024r2.usercontent.dev Referer https://entry5500-js2024r2.usercontent.dev/index-DAwVIcSV.js Response headers Transfer-Encoding chunked Content-Encoding gzip ETag W/"66a96578-2090d" Connection keep-alive Date Mon, 14 Oct 2024 02:27:33 GMT Content-Type application/javascript; charset=UTF-8 Last-Modified Tue, 30 Jul 2024 22:13:12 GMT Server nginx/1.10.3 Vary Accept-Encoding
GET H/1.1	200 OK	langSign-CN-ja8rh.js Show response entry5500-js2024r2.usercontent.dev/	2 KB 1 KB	49ms 24ms	Script application/javascript	178.128.255.27 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://entry5500-js2024r2.usercontent.dev/langSign-CN-ja8rh.js Requested by Host: entry5500-js2024r2.usercontent.dev URL: https://entry5500-js2024r2.usercontent.dev/index-DAwVIcSV.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 178.128.255.27 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software nginx/1.10.3 / Resource Hash `2b3cb7fcd5a7cba31f0932276d0673437bb4d8ba9fcfcc3602ec85ea60458ae4` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://entry5500-js2024r2.usercontent.dev Referer https://entry5500-js2024r2.usercontent.dev/index-DAwVIcSV.js Response headers Transfer-Encoding chunked Content-Encoding gzip ETag W/"66a96578-66e" Connection keep-alive Date Mon, 14 Oct 2024 02:27:33 GMT Content-Type application/javascript; charset=UTF-8 Last-Modified Tue, 30 Jul 2024 22:13:12 GMT Server nginx/1.10.3 Vary Accept-Encoding
GET H/1.1	200 OK	countries-CzeCvYH8.js Show response entry5500-js2024r2.usercontent.dev/	24 KB 4 KB	69ms 38ms	Script application/javascript	178.128.255.27 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://entry5500-js2024r2.usercontent.dev/countries-CzeCvYH8.js Requested by Host: entry5500-js2024r2.usercontent.dev URL: https://entry5500-js2024r2.usercontent.dev/index-DAwVIcSV.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 178.128.255.27 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software nginx/1.10.3 / Resource Hash `6876bde98b3f0c4013107f69f6bf375f60a2807bd79c11592131d9b8bbbb76ae` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://entry5500-js2024r2.usercontent.dev Referer https://entry5500-js2024r2.usercontent.dev/index-DAwVIcSV.js Response headers Transfer-Encoding chunked Content-Encoding gzip ETag W/"66a96578-5e21" Connection keep-alive Date Mon, 14 Oct 2024 02:27:33 GMT Content-Type application/javascript; charset=UTF-8 Last-Modified Tue, 30 Jul 2024 22:13:12 GMT Server nginx/1.10.3 Vary Accept-Encoding
GET		68c279b7-8329-4018-8d27-0dcc72cb34f4 https://entry5500-js2024r2.usercontent.dev/	0 0

GET		fe892ee8-7c29-46ba-bb66-6458e45ecd1d https://entry5500-js2024r2.usercontent.dev/	0 0

GET		0a75a384-ff0f-495a-834d-aea27124458b https://entry5500-js2024r2.usercontent.dev/	0 0

GET H/1.1	200 OK	pageSignQR-fn28410v.js Show response entry5500-js2024r2.usercontent.dev/	5 KB 3 KB	19ms 19ms	Script application/javascript	178.128.255.27 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://entry5500-js2024r2.usercontent.dev/pageSignQR-fn28410v.js Requested by Host: entry5500-js2024r2.usercontent.dev URL: https://entry5500-js2024r2.usercontent.dev/index-DAwVIcSV.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 178.128.255.27 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software nginx/1.10.3 / Resource Hash `e46b8b6fbdf4f480df7b7d8cd5019c55aac431d4ef12b412c6409cdd50d5967f` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://entry5500-js2024r2.usercontent.dev Referer Response headers Transfer-Encoding chunked Content-Encoding gzip ETag W/"66a96578-15a0" Connection keep-alive Date Mon, 14 Oct 2024 02:27:33 GMT Content-Type application/javascript; charset=UTF-8 Last-Modified Tue, 30 Jul 2024 22:13:12 GMT Server nginx/1.10.3 Vary Accept-Encoding
GET H/1.1	200 OK	page-CpEWAtN3.js Show response entry5500-js2024r2.usercontent.dev/	10 KB 4 KB	17ms 17ms	Script application/javascript	178.128.255.27 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://entry5500-js2024r2.usercontent.dev/page-CpEWAtN3.js Requested by Host: entry5500-js2024r2.usercontent.dev URL: https://entry5500-js2024r2.usercontent.dev/index-DAwVIcSV.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 178.128.255.27 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software nginx/1.10.3 / Resource Hash `f94a378dc9474d7ea89d55485b242b9d0d0708c00bc5dfb0d7b82e073ead5a30` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://entry5500-js2024r2.usercontent.dev Referer Response headers Transfer-Encoding chunked Content-Encoding gzip ETag W/"66a96578-290c" Connection keep-alive Date Mon, 14 Oct 2024 02:27:33 GMT Content-Type application/javascript; charset=UTF-8 Last-Modified Tue, 30 Jul 2024 22:13:12 GMT Server nginx/1.10.3 Vary Accept-Encoding
GET H/1.1	200 OK	button-D7nDcb2b.js Show response entry5500-js2024r2.usercontent.dev/	9 KB 4 KB	17ms 17ms	Script application/javascript	178.128.255.27 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://entry5500-js2024r2.usercontent.dev/button-D7nDcb2b.js Requested by Host: entry5500-js2024r2.usercontent.dev URL: https://entry5500-js2024r2.usercontent.dev/index-DAwVIcSV.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 178.128.255.27 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software nginx/1.10.3 / Resource Hash `71e9feab271f163d0eb27197c5c9bae04717388c62089aba5349849a33dce451` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://entry5500-js2024r2.usercontent.dev Referer Response headers Transfer-Encoding chunked Content-Encoding gzip ETag W/"66a96578-25c4" Connection keep-alive Date Mon, 14 Oct 2024 02:27:33 GMT Content-Type application/javascript; charset=UTF-8 Last-Modified Tue, 30 Jul 2024 22:13:12 GMT Server nginx/1.10.3 Vary Accept-Encoding
GET H/1.1	200 OK	putPreloader-nJa2X1eP.js Show response entry5500-js2024r2.usercontent.dev/	699 B 783 B	16ms 15ms	Script application/javascript	178.128.255.27 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://entry5500-js2024r2.usercontent.dev/putPreloader-nJa2X1eP.js Requested by Host: entry5500-js2024r2.usercontent.dev URL: https://entry5500-js2024r2.usercontent.dev/index-DAwVIcSV.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 178.128.255.27 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software nginx/1.10.3 / Resource Hash `ed25fa6b74fbac273a12bb8d04faf6b84e478348a807fdf6fba3b3da09723910` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://entry5500-js2024r2.usercontent.dev Referer Response headers Transfer-Encoding chunked Content-Encoding gzip ETag W/"66a96578-2bb" Connection keep-alive Date Mon, 14 Oct 2024 02:27:33 GMT Content-Type application/javascript; charset=UTF-8 Last-Modified Tue, 30 Jul 2024 22:13:12 GMT Server nginx/1.10.3 Vary Accept-Encoding
GET H/1.1	200 OK	textToSvgURL-Cnw_Q8Rw.js Show response entry5500-js2024r2.usercontent.dev/	357 B 589 B	18ms 18ms	Script application/javascript	178.128.255.27 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://entry5500-js2024r2.usercontent.dev/textToSvgURL-Cnw_Q8Rw.js Requested by Host: entry5500-js2024r2.usercontent.dev URL: https://entry5500-js2024r2.usercontent.dev/index-DAwVIcSV.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 178.128.255.27 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software nginx/1.10.3 / Resource Hash `88ef7b589f467f4a280126e59b5428d5169f80a165500687699209f60ca39998` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://entry5500-js2024r2.usercontent.dev Referer Response headers Transfer-Encoding chunked Content-Encoding gzip ETag W/"66a96578-165" Connection keep-alive Date Mon, 14 Oct 2024 02:27:33 GMT Content-Type application/javascript; charset=UTF-8 Last-Modified Tue, 30 Jul 2024 22:13:12 GMT Server nginx/1.10.3 Vary Accept-Encoding
GET H/1.1	200 OK	qr-code-styling-CvBVNv73.js Show response entry5500-js2024r2.usercontent.dev/	65 KB 17 KB	34ms 34ms	Script application/javascript	178.128.255.27 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://entry5500-js2024r2.usercontent.dev/qr-code-styling-CvBVNv73.js Requested by Host: entry5500-js2024r2.usercontent.dev URL: https://entry5500-js2024r2.usercontent.dev/index-DAwVIcSV.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 178.128.255.27 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software nginx/1.10.3 / Resource Hash `4d5108399b82641dbf80148c27bb49203d32e211cec1ed139557ceff975c3896` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://entry5500-js2024r2.usercontent.dev Referer Response headers Transfer-Encoding chunked Content-Encoding gzip ETag W/"66a96578-10251" Connection keep-alive Date Mon, 14 Oct 2024 02:27:33 GMT Content-Type application/javascript; charset=UTF-8 Last-Modified Tue, 30 Jul 2024 22:13:12 GMT Server nginx/1.10.3 Vary Accept-Encoding
GET H/1.1	200 OK	_commonjsHelpers-Cpj98o6Y.js Show response entry5500-js2024r2.usercontent.dev/	290 B 539 B	19ms 19ms	Script application/javascript	178.128.255.27 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://entry5500-js2024r2.usercontent.dev/_commonjsHelpers-Cpj98o6Y.js Requested by Host: entry5500-js2024r2.usercontent.dev URL: https://entry5500-js2024r2.usercontent.dev/index-DAwVIcSV.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 178.128.255.27 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software nginx/1.10.3 / Resource Hash `7e898f2560233fe672543bbaffe66542d387208b18f5639cb3050bd75d167e48` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://entry5500-js2024r2.usercontent.dev Referer Response headers Transfer-Encoding chunked Content-Encoding gzip ETag W/"66a96578-122" Connection keep-alive Date Mon, 14 Oct 2024 02:27:33 GMT Content-Type application/javascript; charset=UTF-8 Last-Modified Tue, 30 Jul 2024 22:13:12 GMT Server nginx/1.10.3 Vary Accept-Encoding
GET H/1.1	200 OK	logo_padded.svg Show response entry5500-js2024r2.usercontent.dev/assets/img/	1 KB 0	18ms 18ms	Fetch image/svg+xml
General Check archive.org Show headers Download Go to Full URL https://entry5500-js2024r2.usercontent.dev/assets/img/logo_padded.svg Requested by Host: entry5500-js2024r2.usercontent.dev URL: https://entry5500-js2024r2.usercontent.dev/pageSignQR-fn28410v.js Protocol HTTP/1.1 Server -, , ASN (), Reverse DNS Software nginx/1.10.3 / Resource Hash `eeb79b0ae5da35d3433de6edeec3a0e3cce9c24f517dbad26ed97e852666c8f4` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://entry5500-js2024r2.usercontent.dev/ Response headers ETag "66a96578-42d" Connection keep-alive Accept-Ranges bytes Content-Length 1069 Date Mon, 14 Oct 2024 02:27:35 GMT Content-Type image/svg+xml Last-Modified Tue, 30 Jul 2024 22:13:12 GMT Server nginx/1.10.3
GET DATA	200 OK	truncated /	1 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `eeb79b0ae5da35d3433de6edeec3a0e3cce9c24f517dbad26ed97e852666c8f4` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers Content-Type image/svg+xml;charset=utf-8

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: entry5500-js2024r2.usercontent.dev
URL: https://entry5500-js2024r2.usercontent.dev/mtproto.worker-B-1JLZRa.js

Domain: entry5500-js2024r2.usercontent.dev
URL: https://entry5500-js2024r2.usercontent.dev/crypto.worker-CfCshcpI.js

Domain: entry5500-js2024r2.usercontent.dev
URL: blob:https://entry5500-js2024r2.usercontent.dev/68c279b7-8329-4018-8d27-0dcc72cb34f4

Domain: entry5500-js2024r2.usercontent.dev
URL: blob:https://entry5500-js2024r2.usercontent.dev/fe892ee8-7c29-46ba-bb66-6458e45ecd1d

Domain: entry5500-js2024r2.usercontent.dev
URL: blob:https://entry5500-js2024r2.usercontent.dev/0a75a384-ff0f-495a-834d-aea27124458b

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Telegram (Instant Messenger)

30 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

entry5500-js2024r2.usercontent.dev
entry5500-js2024r2.usercontent.dev
178.128.255.27
0023f0bb0c3821799bd519707ab25a88964d55fabab8acc4754ad3207bf545c5
04dfc8e1a6e59e36a3a3a5c15443a97a92a6d2a7da9d276b050d58be3c7952a7
2b3cb7fcd5a7cba31f0932276d0673437bb4d8ba9fcfcc3602ec85ea60458ae4
4d5108399b82641dbf80148c27bb49203d32e211cec1ed139557ceff975c3896
59603047eac7cf946dc4aa982a74193c206781b0570c33cb0b627ea34c0e801c
6876bde98b3f0c4013107f69f6bf375f60a2807bd79c11592131d9b8bbbb76ae
6f2cf0c99091af44641cb27eee6a0f32a56aa85f446f60a9482864f2ade413d4
71e9feab271f163d0eb27197c5c9bae04717388c62089aba5349849a33dce451
72c34a540e7ab561851bf947b03a0ae5c18853e251e61609807d12e1080e3326
7e2388ec283fe17472ef02829a93da550af8f3ad4a975f50a0110bff61afe523
7e898f2560233fe672543bbaffe66542d387208b18f5639cb3050bd75d167e48
88ef7b589f467f4a280126e59b5428d5169f80a165500687699209f60ca39998
db66f764c311c8c976601370a59831be1b792fe9535c8f36f7de75334226b071
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e46b8b6fbdf4f480df7b7d8cd5019c55aac431d4ef12b412c6409cdd50d5967f
ed25fa6b74fbac273a12bb8d04faf6b84e478348a807fdf6fba3b3da09723910
edb840b9f5c98a4f5248f3b188718801c5880cb58b683bb3f77aa847c1ce09cc
eeb79b0ae5da35d3433de6edeec3a0e3cce9c24f517dbad26ed97e852666c8f4
f94a378dc9474d7ea89d55485b242b9d0d0708c00bc5dfb0d7b82e073ead5a30

entry5500-js2024r2.usercontent.dev Open in urlscan Pro 178.128.255.27 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

21 Requests

71 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

249 kBTransfer

967 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

21 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

30 JavaScript Global Variables

0 Cookies

Indicators

entry5500-js2024r2.usercontent.dev Open in urlscan Pro
178.128.255.27 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

21
Requests

71 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

249 kB
Transfer

967 kB
Size

0
Cookies

21 HTTP transactions
4 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!