tvhaifriman.dnsget.org Open in urlscan Pro
87.120.126.109 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://tvhaifriman.dnsget.org/web/depart.php
Submission: On November 24 via automatic, source openphish (November 24th 2024, 1:11:28 am UTC) — Scanned from DE

Summary HTTP 14 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 14 HTTP transactions. The main IP is 87.120.126.109, located in Bulgaria and belongs to EKABI, US. The main domain is tvhaifriman.dnsget.org.
TLS certificate: Issued by R11 on November 21st 2024. Valid for: 3 months.

This is the only time tvhaifriman.dnsget.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Credit Agricole (Banking)

Domain & IP information

	IP Address	AS Autonomous System
12	87.120.126.109 87.120.126.109	401115 (EKABI) (EKABI)
1	104.17.25.14 104.17.25.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
14	3

12 87.120.126.109 (Bulgaria)

ASN401115 (EKABI, US)

tvhaifriman.dnsget.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.25.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	dnsget.org tvhaifriman.dnsget.org	458 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 225	27 KB
0	duckdns.org Failed telegrambotcheck.duckdns.org Failed
14	3

	Domain	Requested by
12	tvhaifriman.dnsget.org	tvhaifriman.dnsget.org
1	cdnjs.cloudflare.com	tvhaifriman.dnsget.org
0	telegrambotcheck.duckdns.org Failed	tvhaifriman.dnsget.org
14	3

This site contains no links.

Subject Issuer	Validity	Valid
tvhaifriman.dnsget.org R11	`2024-11-21` - `2025-02-19`	3 months	crt.sh
cdnjs.cloudflare.com WE1	`2024-09-28` - `2024-12-27`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://tvhaifriman.dnsget.org/web/depart.php
Frame ID: 1DCDD889B93A3F77A73F9166957241A0
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

14
Requests

93 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

485 kB
Transfer

927 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request depart.php Show response
tvhaifriman.dnsget.org/web/ 147 KB
6 KB 253ms
47ms Document
text/html 87.120.126.109
EKABI

General

Check archive.org

Show headers Download Go to

Full URL

https://tvhaifriman.dnsget.org/web/depart.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

87.120.126.109 , Bulgaria, ASN401115 (EKABI, US),

Reverse DNS

Software

nginx /

Resource Hash

5647bb568089160d6a6a0b4359292aed23e0f7175a57871efefada2964f88c13

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Sun, 24 Nov 2024 01:11:22 GMT
server: nginx
strict-transport-security: max-age=31536000
vary: Accept-Encoding

GET
H2 200 fonts.css
tvhaifriman.dnsget.org/web/res/ 147 B
350 B 18ms
17ms Stylesheet
text/css 87.120.126.109
EKABI

General

Check archive.org

Show headers Download Go to

Full URL

https://tvhaifriman.dnsget.org/web/res/fonts.css

Requested by

Host: tvhaifriman.dnsget.org
URL: https://tvhaifriman.dnsget.org/web/depart.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

87.120.126.109 , Bulgaria, ASN401115 (EKABI, US),

Reverse DNS

Software

nginx /

Resource Hash

1a0d94397022ccef8557d7c459cca9975496c73965368f2dd0fbf1529ef305a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://tvhaifriman.dnsget.org/web/depart.php

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=43200
etag: "6734f218-93"
expires: Sun, 24 Nov 2024 13:11:22 GMT
accept-ranges: bytes
content-length: 147
date: Sun, 24 Nov 2024 01:11:22 GMT
content-type: text/css
last-modified: Wed, 13 Nov 2024 18:38:16 GMT
server: nginx

GET
H2 200 style.css
tvhaifriman.dnsget.org/web/res/ 3 KB
1 KB 20ms
19ms Stylesheet
text/css 87.120.126.109
EKABI

General

Check archive.org

Show headers Download Go to

Full URL

https://tvhaifriman.dnsget.org/web/res/style.css

Requested by

Host: tvhaifriman.dnsget.org
URL: https://tvhaifriman.dnsget.org/web/depart.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

87.120.126.109 , Bulgaria, ASN401115 (EKABI, US),

Reverse DNS

Software

nginx /

Resource Hash

b61c8248657276765c3281004cb55a2d0fa4400585781f785f17df8983162cd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://tvhaifriman.dnsget.org/web/depart.php

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=43200
content-encoding: gzip
etag: W/"6734f21a-ce1"
expires: Sun, 24 Nov 2024 13:11:22 GMT
date: Sun, 24 Nov 2024 01:11:22 GMT
content-type: text/css
last-modified: Wed, 13 Nov 2024 18:38:18 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 menu.png
tvhaifriman.dnsget.org/web/res/ 311 B
517 B 21ms
20ms Image
image/png 87.120.126.109
EKABI

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tvhaifriman.dnsget.org/web/res/menu.png

Requested by

Host: tvhaifriman.dnsget.org
URL: https://tvhaifriman.dnsget.org/web/depart.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

87.120.126.109 , Bulgaria, ASN401115 (EKABI, US),

Reverse DNS

Software

nginx /

Resource Hash

599e6ff8546fb8183657fba87d64bd6d4c20d642005754f3d05342b2d117ee35

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://tvhaifriman.dnsget.org/web/depart.php

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=2592000
etag: "6734f218-137"
expires: Tue, 24 Dec 2024 01:11:22 GMT
accept-ranges: bytes
content-length: 311
date: Sun, 24 Nov 2024 01:11:22 GMT
content-type: image/png
last-modified: Wed, 13 Nov 2024 18:38:16 GMT
server: nginx

GET
H2 200 logo.png
tvhaifriman.dnsget.org/web/res/ 6 KB
7 KB 20ms
20ms Image
image/png 87.120.126.109
EKABI

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tvhaifriman.dnsget.org/web/res/logo.png

Requested by

Host: tvhaifriman.dnsget.org
URL: https://tvhaifriman.dnsget.org/web/depart.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

87.120.126.109 , Bulgaria, ASN401115 (EKABI, US),

Reverse DNS

Software

nginx /

Resource Hash

d4d7832cf0f0b869c483506c9bc2bd5985233f10c6f985add83f2a6a2a959cdd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://tvhaifriman.dnsget.org/web/depart.php

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=2592000
content-encoding: gzip
etag: W/"6734f218-19b8"
expires: Tue, 24 Dec 2024 01:11:22 GMT
date: Sun, 24 Nov 2024 01:11:22 GMT
content-type: image/png
last-modified: Wed, 13 Nov 2024 18:38:16 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 pc-menu.png
tvhaifriman.dnsget.org/web/res/ 5 KB
5 KB 19ms
15ms Image
image/png 87.120.126.109
EKABI

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tvhaifriman.dnsget.org/web/res/pc-menu.png

Requested by

Host: tvhaifriman.dnsget.org
URL: https://tvhaifriman.dnsget.org/web/depart.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

87.120.126.109 , Bulgaria, ASN401115 (EKABI, US),

Reverse DNS

Software

nginx /

Resource Hash

21063a036ce45e05fcbba86a2475f770fd06c3884011f1755e108a07cb673746

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://tvhaifriman.dnsget.org/web/depart.php

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=2592000
content-encoding: gzip
etag: W/"6734f218-1539"
expires: Tue, 24 Dec 2024 01:11:22 GMT
date: Sun, 24 Nov 2024 01:11:22 GMT
content-type: image/png
last-modified: Wed, 13 Nov 2024 18:38:16 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 search.png
tvhaifriman.dnsget.org/web/res/ 1 KB
2 KB 19ms
16ms Image
image/png 87.120.126.109
EKABI

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tvhaifriman.dnsget.org/web/res/search.png

Requested by

Host: tvhaifriman.dnsget.org
URL: https://tvhaifriman.dnsget.org/web/depart.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

87.120.126.109 , Bulgaria, ASN401115 (EKABI, US),

Reverse DNS

Software

nginx /

Resource Hash

719c0a598c756a61795246b268553b0b45f9c42c831ffc77b3cbcbbea65f52a6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://tvhaifriman.dnsget.org/web/depart.php

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=2592000
content-encoding: gzip
etag: W/"6734f21a-5da"
expires: Tue, 24 Dec 2024 01:11:22 GMT
date: Sun, 24 Nov 2024 01:11:22 GMT
content-type: image/png
last-modified: Wed, 13 Nov 2024 18:38:18 GMT
server: nginx
vary: Accept-Encoding

GET
H3 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.7.1/ 85 KB
27 KB 36ms
19ms Script
application/javascript 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.7.1/jquery.min.js

Requested by

Host: tvhaifriman.dnsget.org
URL: https://tvhaifriman.dnsget.org/web/depart.php

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://tvhaifriman.dnsget.org/

Response headers

cf-cdnjs-via: cfworker/kv
content-encoding: br
cf-cache-status: HIT
etag: "64ed75bb-6b36"
age: 376061
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ILWYro87Wp%2FHZMKbURMlEOUVQMi3AA8HWNJ6DdEP8T7S78wt4NqLWG36fD0n%2FebKfPfJkOGrbsQSbVkwHCeWKJixKqVDR6brV4C4Hxgqj6k%2BPdEkN5G9GNRo4FKo%2F4d1evHBhpre"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Fri, 14 Nov 2025 01:11:22 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sun, 24 Nov 2024 01:11:22 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 29 Aug 2023 04:36:11 GMT
vary: Accept-Encoding
priority: u=1,i=?0
strict-transport-security: max-age=15780000
cache-control: public, max-age=30672000
timing-allow-origin: *
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: 8e75864ded9cd2a9-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 27446
server: cloudflare

GET
H2 200 jq.js Show response
tvhaifriman.dnsget.org/web/res/ 361 KB
137 KB 24ms
21ms Script
application/javascript 87.120.126.109
EKABI

General

Check archive.org

Show headers Download Go to

Full URL

https://tvhaifriman.dnsget.org/web/res/jq.js

Requested by

Host: tvhaifriman.dnsget.org
URL: https://tvhaifriman.dnsget.org/web/depart.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

87.120.126.109 , Bulgaria, ASN401115 (EKABI, US),

Reverse DNS

Software

nginx /

Resource Hash

d066c11600369c32eea993e482d74be1bcc76c906f18f2ea7cd995bba6ecc385

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://tvhaifriman.dnsget.org/web/depart.php

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=43200
content-encoding: gzip
etag: W/"6734f218-5a219"
expires: Sun, 24 Nov 2024 13:11:22 GMT
date: Sun, 24 Nov 2024 01:11:22 GMT
content-type: application/javascript
last-modified: Wed, 13 Nov 2024 18:38:16 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 back2.jpg
tvhaifriman.dnsget.org/web/res/ 238 KB
221 KB 48ms
47ms Image
image/jpeg 87.120.126.109
EKABI

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tvhaifriman.dnsget.org/web/res/back2.jpg

Requested by

Host: tvhaifriman.dnsget.org
URL: https://tvhaifriman.dnsget.org/web/depart.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

87.120.126.109 , Bulgaria, ASN401115 (EKABI, US),

Reverse DNS

Software

nginx /

Resource Hash

c4966ab5e78e2270952b89576c4a0a386e8a7ea673c56f0f396d620abf4f81b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://tvhaifriman.dnsget.org/web/depart.php

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=2592000
content-encoding: gzip
etag: W/"6734f218-3b8cf"
expires: Tue, 24 Dec 2024 01:11:22 GMT
date: Sun, 24 Nov 2024 01:11:22 GMT
content-type: image/jpeg
last-modified: Wed, 13 Nov 2024 18:38:16 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 Gotham-Light.woff2
tvhaifriman.dnsget.org/web/res/ 39 KB
40 KB 103ms
103ms Font
font/woff2 87.120.126.109
EKABI

General

Check archive.org

Show headers Download Go to

Full URL

https://tvhaifriman.dnsget.org/web/res/Gotham-Light.woff2

Requested by

Host: tvhaifriman.dnsget.org
URL: https://tvhaifriman.dnsget.org/web/res/fonts.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

87.120.126.109 , Bulgaria, ASN401115 (EKABI, US),

Reverse DNS

Software

nginx /

Resource Hash

e266d1f2bcf1da0faff6964637fdcd9a4e47c50a7a56be74424f409f30c83c5e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://tvhaifriman.dnsget.org
Referer: https://tvhaifriman.dnsget.org/web/res/fonts.css

Response headers

strict-transport-security: max-age=31536000
etag: "6734f218-9d58"
accept-ranges: bytes
content-length: 40280
date: Sun, 24 Nov 2024 01:11:22 GMT
content-type: font/woff2
last-modified: Wed, 13 Nov 2024 18:38:16 GMT
server: nginx

GET
H2 200 Gotham-Bold.woff2
tvhaifriman.dnsget.org/web/res/ 38 KB
39 KB 105ms
104ms Font
font/woff2 87.120.126.109
EKABI

General

Check archive.org

Show headers Download Go to

Full URL

https://tvhaifriman.dnsget.org/web/res/Gotham-Bold.woff2

Requested by

Host: tvhaifriman.dnsget.org
URL: https://tvhaifriman.dnsget.org/web/res/fonts.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

87.120.126.109 , Bulgaria, ASN401115 (EKABI, US),

Reverse DNS

Software

nginx /

Resource Hash

319881caca6f5f0d1e8e24040579d93386008e39dee1045965124b86303143e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://tvhaifriman.dnsget.org
Referer: https://tvhaifriman.dnsget.org/web/res/fonts.css

Response headers

strict-transport-security: max-age=31536000
etag: "6734f218-9960"
accept-ranges: bytes
content-length: 39264
date: Sun, 24 Nov 2024 01:11:22 GMT
content-type: font/woff2
last-modified: Wed, 13 Nov 2024 18:38:16 GMT
server: nginx

POST receive_token
telegrambotcheck.duckdns.org/ 0
0

GET
H2 404 favicon.ico
tvhaifriman.dnsget.org/ 548 B
611 B 35ms
35ms Other
text/html 87.120.126.109
EKABI

General

Check archive.org

Show headers Download Go to

Full URL: https://tvhaifriman.dnsget.org/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 87.120.126.109 , Bulgaria, ASN401115 (EKABI, US),
Reverse DNS
Software: nginx /
Resource Hash: d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://tvhaifriman.dnsget.org/web/depart.php

Response headers

content-length: 548
date: Sun, 24 Nov 2024 01:11:22 GMT
content-type: text/html
server: nginx

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: telegrambotcheck.duckdns.org
URL: https://telegrambotcheck.duckdns.org:5001/receive_token?referrer=loco

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Credit Agricole (Banking)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://tvhaifriman.dnsget.org/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()
javascript	error	URL: https://tvhaifriman.dnsget.org/web/depart.php Message: Access to fetch at 'https://telegrambotcheck.duckdns.org:5001/receive_token?referrer=loco' from origin 'https://tvhaifriman.dnsget.org' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.
network	error	URL: https://telegrambotcheck.duckdns.org:5001/receive_token?referrer=loco Message: Failed to load resource: net::ERR_FAILED

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
telegrambotcheck.duckdns.org
tvhaifriman.dnsget.org
telegrambotcheck.duckdns.org
104.17.25.14
87.120.126.109
1a0d94397022ccef8557d7c459cca9975496c73965368f2dd0fbf1529ef305a1
21063a036ce45e05fcbba86a2475f770fd06c3884011f1755e108a07cb673746
319881caca6f5f0d1e8e24040579d93386008e39dee1045965124b86303143e1
5647bb568089160d6a6a0b4359292aed23e0f7175a57871efefada2964f88c13
599e6ff8546fb8183657fba87d64bd6d4c20d642005754f3d05342b2d117ee35
719c0a598c756a61795246b268553b0b45f9c42c831ffc77b3cbcbbea65f52a6
b61c8248657276765c3281004cb55a2d0fa4400585781f785f17df8983162cd7
c4966ab5e78e2270952b89576c4a0a386e8a7ea673c56f0f396d620abf4f81b8
d066c11600369c32eea993e482d74be1bcc76c906f18f2ea7cd995bba6ecc385
d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090
d4d7832cf0f0b869c483506c9bc2bd5985233f10c6f985add83f2a6a2a959cdd
e266d1f2bcf1da0faff6964637fdcd9a4e47c50a7a56be74424f409f30c83c5e
fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a

tvhaifriman.dnsget.org Open in urlscan Pro 87.120.126.109 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

14 Requests

93 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

485 kBTransfer

927 kBSize

0 Cookies

0 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

0 Cookies

3 Console Messages

Security Headers

Indicators

tvhaifriman.dnsget.org Open in urlscan Pro
87.120.126.109 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

93 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

485 kB
Transfer

927 kB
Size

0
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!