www.telegram-channel.blog Open in urlscan Pro
91.235.142.233 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.telegram-channel.blog/
Submission: On February 02 via automatic, source certstream-suspicious (February 2nd 2024, 2:24:31 pm UTC) — Scanned from DE

Summary HTTP 8 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 8 HTTP transactions. The main IP is 91.235.142.233, located in Kyiv, Ukraine and belongs to YURTEH-AS, UA. The main domain is www.telegram-channel.blog.
TLS certificate: Issued by R3 on February 2nd 2024. Valid for: 3 months.

This is the only time www.telegram-channel.blog was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Telegram (Instant Messenger)

Domain & IP information

	IP Address	AS Autonomous System
7	91.235.142.233 91.235.142.233	30860 (YURTEH-AS) (YURTEH-AS)
1	2a03:2880:f04... 2a03:2880:f045:10:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
8	2

7 91.235.142.233 (Kyiv, Ukraine)

ASN30860 (YURTEH-AS, UA)
PTR: hosted.by.specialrdp

www.telegram-channel.blog	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f045:10:face:b00c:0:3 (Amsterdam, Netherlands)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	telegram-channel.blog www.telegram-channel.blog	601 KB
1	facebook.net connect.facebook.net — Cisco Umbrella Rank: 174	58 KB
8	2

	Domain	Requested by
7	www.telegram-channel.blog	www.telegram-channel.blog
1	connect.facebook.net	www.telegram-channel.blog
8	2

This site contains links to these domains. Also see Links.

Domain
telegram.org

Subject Issuer	Validity	Valid
telegram-channel.blog R3	`2024-02-02` - `2024-05-02`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-11-11` - `2024-02-09`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.telegram-channel.blog/
Frame ID: 0A976FB6A269BF2DCBF11E9E1D3F5CBD
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Telegram: @onlyfans_ukraine

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Page Statistics

8
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

658 kB
Transfer

813 kB
Size

1
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://telegram.org/

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
www.telegram-channel.blog/ 10 KB
10 KB 284ms
69ms Document
text/html 91.235.142.233
YURTEH-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.telegram-channel.blog/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 91.235.142.233 Kyiv, Ukraine, ASN30860 (YURTEH-AS, UA),
Reverse DNS: hosted.by.specialrdp
Software: nginx /
Resource Hash: 2a96d38a5c34a01e37744bc0474e26b6721fd9cb8acf14a9bf0909153487df6f

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Date: Fri, 02 Feb 2024 14:24:27 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Server: nginx
Transfer-Encoding: chunked

GET
H/1.1 200
OK bootstrap.min.css
www.telegram-channel.blog/css/ 42 KB
42 KB 71ms
71ms Stylesheet
text/css 91.235.142.233
YURTEH-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.telegram-channel.blog/css/bootstrap.min.css
Requested by: Host: www.telegram-channel.blog
URL: https://www.telegram-channel.blog/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 91.235.142.233 Kyiv, Ukraine, ASN30860 (YURTEH-AS, UA),
Reverse DNS: hosted.by.specialrdp
Software: nginx /
Resource Hash: f1d083ffaa644c708f11db29707aa57c19246e6d32643b03fee3f82c17b224b3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.telegram-channel.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Fri, 02 Feb 2024 14:24:27 GMT
Last-Modified: Mon, 03 Apr 2023 03:18:48 GMT
Server: nginx
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 42523
Content-Type: text/css

GET
H/1.1 200
OK telegram.css
www.telegram-channel.blog/css/ 111 KB
111 KB 274ms
137ms Stylesheet
text/css 91.235.142.233
YURTEH-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.telegram-channel.blog/css/telegram.css
Requested by: Host: www.telegram-channel.blog
URL: https://www.telegram-channel.blog/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 91.235.142.233 Kyiv, Ukraine, ASN30860 (YURTEH-AS, UA),
Reverse DNS: hosted.by.specialrdp
Software: nginx /
Resource Hash: de3eea1fc34cc991af29767c44d6ef42f6de33044ce09958cfe5bd50a0fe6d71

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.telegram-channel.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Fri, 02 Feb 2024 14:24:27 GMT
Last-Modified: Thu, 01 Feb 2024 19:37:26 GMT
Server: nginx
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 113849
Content-Type: text/css

GET
H/1.1 200
OK refaunt.jpg
www.telegram-channel.blog/photo/ 86 KB
86 KB 275ms
138ms Image
image/jpeg 91.235.142.233
YURTEH-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.telegram-channel.blog/photo/refaunt.jpg
Requested by: Host: www.telegram-channel.blog
URL: https://www.telegram-channel.blog/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 91.235.142.233 Kyiv, Ukraine, ASN30860 (YURTEH-AS, UA),
Reverse DNS: hosted.by.specialrdp
Software: nginx /
Resource Hash: dc6d6d4cb1e15d286075c9508a3aa00ecfc68b5ba13ec7ee2a9cd8f7be8e6cf0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.telegram-channel.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Fri, 02 Feb 2024 14:24:27 GMT
Last-Modified: Thu, 01 Feb 2024 19:35:08 GMT
Server: nginx
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 87821
Content-Type: image/jpeg

GET
H/1.1 200
OK verif.svg
www.telegram-channel.blog/svg/ 978 B
1 KB 208ms
70ms Image
image/svg+xml 91.235.142.233
YURTEH-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.telegram-channel.blog/svg/verif.svg
Requested by: Host: www.telegram-channel.blog
URL: https://www.telegram-channel.blog/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 91.235.142.233 Kyiv, Ukraine, ASN30860 (YURTEH-AS, UA),
Reverse DNS: hosted.by.specialrdp
Software: nginx /
Resource Hash: 77c7245862717d06e6aed1bb0804aa07959e081c9e50a6ee51fcceeda6a66fb0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.telegram-channel.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Fri, 02 Feb 2024 14:24:27 GMT
Last-Modified: Mon, 03 Apr 2023 03:18:48 GMT
Server: nginx
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 978
Content-Type: image/svg+xml

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 214 KB
58 KB 132ms
39ms Script
application/x-javascript 2a03:2880:f045:10:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.telegram-channel.blog
URL: https://www.telegram-channel.blog/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f045:10:face:b00c:0:3 Amsterdam, Netherlands, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

22cf1baba55eced80d7ebb0de51fc8961757ef581964f8e10ebc8676399eba81

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.telegram-channel.blog/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Fri, 02 Feb 2024 14:24:27 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 57202
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0"
pragma: public
x-fb-debug: OsIqbkMM9Nr54cLQMXyK6nR3wlzS/9p8I0s6BlYBtk3AfmdnHbUFpC/Al7/Wl494RQUSkGyUr+v4CM/nvmj/5Q==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK background.svg
www.telegram-channel.blog/svg/ 124 KB
124 KB 74ms
73ms Image
image/svg+xml 91.235.142.233
YURTEH-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.telegram-channel.blog/svg/background.svg
Requested by: Host: www.telegram-channel.blog
URL: https://www.telegram-channel.blog/css/telegram.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 91.235.142.233 Kyiv, Ukraine, ASN30860 (YURTEH-AS, UA),
Reverse DNS: hosted.by.specialrdp
Software: nginx /
Resource Hash: 5514ab2c931a9da74904b0788076bff9e6ba28f0cc42db7aceb518c75c2bb554

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.telegram-channel.blog/css/telegram.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Fri, 02 Feb 2024 14:24:27 GMT
Last-Modified: Mon, 03 Apr 2023 03:18:48 GMT
Server: nginx
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 126652
Content-Type: image/svg+xml

GET
H/1.1 200
OK pattern.svg
www.telegram-channel.blog/svg/ 226 KB
226 KB 70ms
70ms Image
image/svg+xml 91.235.142.233
YURTEH-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.telegram-channel.blog/svg/pattern.svg
Requested by: Host: www.telegram-channel.blog
URL: https://www.telegram-channel.blog/css/telegram.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 91.235.142.233 Kyiv, Ukraine, ASN30860 (YURTEH-AS, UA),
Reverse DNS: hosted.by.specialrdp
Software: nginx /
Resource Hash: 118add53487c02aaf5b5ab9f69380fa06717deb10492e14aaa487e3c62806ad4

Request headers

Referer: https://www.telegram-channel.blog/css/telegram.css
Origin: https://www.telegram-channel.blog
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Fri, 02 Feb 2024 14:24:27 GMT
Last-Modified: Mon, 03 Apr 2023 03:18:48 GMT
Server: nginx
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 231706
Content-Type: image/svg+xml

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Telegram (Instant Messenger)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| fbq function| _fbq

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.telegram-channel.blog/	1969-12-31 23:59:59	Name: PHPSESSID Value: 0ebf96488e8555507087058fc378d5d2

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

connect.facebook.net
www.telegram-channel.blog
2a03:2880:f045:10:face:b00c:0:3
91.235.142.233
118add53487c02aaf5b5ab9f69380fa06717deb10492e14aaa487e3c62806ad4
22cf1baba55eced80d7ebb0de51fc8961757ef581964f8e10ebc8676399eba81
2a96d38a5c34a01e37744bc0474e26b6721fd9cb8acf14a9bf0909153487df6f
5514ab2c931a9da74904b0788076bff9e6ba28f0cc42db7aceb518c75c2bb554
77c7245862717d06e6aed1bb0804aa07959e081c9e50a6ee51fcceeda6a66fb0
dc6d6d4cb1e15d286075c9508a3aa00ecfc68b5ba13ec7ee2a9cd8f7be8e6cf0
de3eea1fc34cc991af29767c44d6ef42f6de33044ce09958cfe5bd50a0fe6d71
f1d083ffaa644c708f11db29707aa57c19246e6d32643b03fee3f82c17b224b3

www.telegram-channel.blog Open in urlscan Pro 91.235.142.233 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

8 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

658 kBTransfer

813 kBSize

1 Cookies

1 Outgoing links

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

1 Cookies

Indicators

www.telegram-channel.blog Open in urlscan Pro
91.235.142.233 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

658 kB
Transfer

813 kB
Size

1
Cookies

8 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!