recovery.tg
Open in
urlscan Pro
2606:4700:3030::6815:265d
Malicious Activity!
Public Scan
Submission: On October 27 via automatic, source openphish — Scanned from DE
Summary
TLS certificate: Issued by WE1 on October 23rd 2024. Valid for: 3 months.
This is the only time recovery.tg was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Telegram (Instant Messenger)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 11 | 2606:4700:303... 2606:4700:3030::6815:265d | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
23 | 2 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
recovery.tg
1 redirects
recovery.tg |
227 KB |
23 | 1 |
Domain | Requested by | |
---|---|---|
11 | recovery.tg |
1 redirects
recovery.tg
|
23 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
recovery.tg WE1 |
2024-10-23 - 2025-01-21 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://recovery.tg/
Frame ID: 079B18DAAFFF9E3D4381E491F05958E2
Requests: 18 HTTP requests in this frame
Frame:
https://recovery.tg/cdn-cgi/challenge-platform/h/b/scripts/jsd/e1a56f38220d/main.js
Frame ID: 4DE5F213BDBE68DE00211C3DEE77B005
Requests: 2 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 4- https://recovery.tg/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
- https://recovery.tg/cdn-cgi/challenge-platform/h/b/scripts/jsd/e1a56f38220d/main.js
23 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
Primary Request
/
recovery.tg/ |
14 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
index-JsnNGzh6.js
recovery.tg/ |
123 KB 49 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
index-oCcwLZ8q.css
recovery.tg/ |
428 KB 93 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
369 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
crypto.worker--tP3flpe.js
recovery.tg/ |
67 KB 26 KB |
Fetch
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
main.js
recovery.tg/cdn-cgi/challenge-platform/h/b/scripts/jsd/e1a56f38220d/ Frame 4DE5 Redirect Chain
|
8 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
mtproto.worker-oz6wjU4G.js
recovery.tg/ Frame |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
crypto.worker--tP3flpe.js
recovery.tg/ Frame |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
recovery.tg/assets/img/ |
15 KB 4 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
lang-5amZgLT1.js
recovery.tg/ |
109 KB 36 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
langSign-lcKrqmwM.js
recovery.tg/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
countries-lRU-UavE.js
recovery.tg/ |
24 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
8d8ed7ca3c9f0232
recovery.tg/cdn-cgi/challenge-platform/h/b/jsd/r/ Frame 4DE5 |
0 1 KB |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
pageSignQR-4sfJJ7IQ.js
recovery.tg/ |
5 KB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
c9ccd447-5104-4946-931b-19182e20350b
https://recovery.tg/ Frame |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
3c855b7a-2660-409b-9c15-b4eccedffe51
https://recovery.tg/ Frame |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
0a694b07-e281-4c88-aa9d-051e6265d3e3
https://recovery.tg/ Frame |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
page-63IMsWQg.js
recovery.tg/ |
10 KB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
button--IyVPnTS.js
recovery.tg/ |
8 KB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
putPreloader-1bCxEoas.js
recovery.tg/ |
699 B 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
textToSvgURL-Z4O-nL1S.js
recovery.tg/ |
357 B 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
qr-code-styling-ogpV7fl-.js
recovery.tg/ |
65 KB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
_commonjsHelpers-5-cIlDoe.js
recovery.tg/ |
290 B 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logo_padded.svg
recovery.tg/assets/img/ |
1 KB 0 |
Fetch
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- recovery.tg
- URL
- https://recovery.tg/mtproto.worker-oz6wjU4G.js
- Domain
- recovery.tg
- URL
- https://recovery.tg/crypto.worker--tP3flpe.js
- Domain
- recovery.tg
- URL
- blob:https://recovery.tg/c9ccd447-5104-4946-931b-19182e20350b
- Domain
- recovery.tg
- URL
- blob:https://recovery.tg/3c855b7a-2660-409b-9c15-b4eccedffe51
- Domain
- recovery.tg
- URL
- blob:https://recovery.tg/0a694b07-e281-4c88-aa9d-051e6265d3e3
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Telegram (Instant Messenger)30 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| rootScope function| deferredPromise function| AppStorage object| stateStorage function| wrapUrl object| I18n object| webpWorkerController object| appStorage object| singleInstance object| webPushApiManager object| telegramMeWebManager object| opusDecodeController object| cryptoMessagePort object| mtprotoMessagePort object| serviceMessagePort object| apiManagerProxy function| calcImageInBox object| mediaSizes object| customProperties object| windowSize object| liteMode object| themeController object| overlayCounter function| formatDateAccordingToTodayNew function| fillTipDates function| dispatchHeavyAnimationEvent object| pagesManager object| sequentialDom function| putPreloader1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.recovery.tg/ | Name: cf_clearance Value: jemaATv8ZU6luB0l1Fnip6vQ0taONbT2fvZ_ii3ZGzU-1729991811-1.2.1.1-LA3hOVTuiN4t_nXBUEFmds3vXG7n6fecmMQKj_twV7qmdEC_nmltImE5V5avX30vracNN1kU3m_26Zi1RI8qc_so.jKuJnMqXjHKZEr8Z_sj6nY4orZoBE6gysWkJcRca0kp9NUVbai3PmnMRwbnIEAYjjTD0N1JsCLViP7rIwx0Y7s1EjVnzazFGiHv1XQHB4CzHZ00iYTJx8i9z7gN7QNBzDBQpIO7aDI.SHw8ZYAxnqNSmxl.ytWPdpZd.ZPXY3sglTxuXfKLMUul.OO_zKS1MHTFPJoXGcYyYiTP0JKiqesrEDFJ3eOGxwZbpMDcBn1gX1q57oBF7PJsO.A8zDu2ylnKA_TU.wNI8_qfGnC1KlHnRytlyvR3X67rlKx4 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
recovery.tg
recovery.tg
2606:4700:3030::6815:265d
04e8d7187fe6a874e6282f1ec0cff388492edf1bd75f7348669cbcb118adeafb
2b5e8dd0627e6d0b008833e6bb61f5c140726ecf256ce2831364304b34dfbf3a
32a2c1295fe228caa99d0c0c9b5f23d56747b7880ec7470311f2997cc070885f
36cb02e59322028c02c5365bd56cbd129b3eb2fb4aaec625160ca2dc9786a4bd
656f25971826e4100dcf7042b3c8c3c7228ba3ec26b96be8f8fab4855f499f6b
6c4900d40f3335423817340edddd7655d96e707156923fcf3cbf5a6520008d6e
6f2cf0c99091af44641cb27eee6a0f32a56aa85f446f60a9482864f2ade413d4
7bdb7d42bbd4b4f52afaae44adae2ebcf1a6a5ad79fa94bd23dd7b28208415fd
7e2388ec283fe17472ef02829a93da550af8f3ad4a975f50a0110bff61afe523
8528a55ba5d25bb2b6463f369b7a2046c08ced5f20256978a06119c0d50d08a2
900f22723c45f67600638812021437a089daa7c2f0a559ebb85a0726183cee79
a8df41d98a0fa3d1cb8c8661377ac1a572beb9cd0b68e968f92d69f7c8331483
ba13c9ebc95dc73dfe46a3ecb61bd70b63938d1983bebc573c681e7de74370fb
ce22f68a29c6cde7a53af7c8969ac7be83245976b41c63f71d815623df5f5297
d9d774ee58360a92398bb52c76eccd86964d3b4700ee1ef163fd4e6ff7cf636f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e76923c354b89bc0a5830380492116ff23abcb7205fe83f071fbf37f7bed5f38
eeb79b0ae5da35d3433de6edeec3a0e3cce9c24f517dbad26ed97e852666c8f4
f10ac0c5727dd099fb3e3826684122d25ec1ba7ade7db821aa2cb91d06d33816