tele.fgrteg55.site Open in urlscan Pro
172.67.143.128  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H3	200	Primary Request / Show response tele.fgrteg55.site/	72 KB 16 KB	243ms 145ms	Document text/html	172.67.143.128 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://tele.fgrteg55.site/ Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.143.128 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3b3075f3fc03069b6d5cacbade4db3c664eff44986fd2a484534dc75e2466472 Security Headers Name Value X-Content-Type-Options nosniff Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers access-control-allow-origin * alt-svc h3=":443"; ma=86400 cache-control public, max-age=0, must-revalidate cf-cache-status DYNAMIC cf-ray 8e4871211a07150e-LAX content-encoding br content-type text/html; charset=utf-8 date Mon, 18 Nov 2024 13:52:36 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} priority u=0,i referrer-policy strict-origin-when-cross-origin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=09EhIm7Wnesozv5WOluBn7MdUGx94pg1hJzpdtVT8d615p5F1nAEtK8MdexMUBtgCNW371B85vDvborFNtJlpkrv9NvpvNsCcn1%2FVl5o1MLcYV3bsycpB0xhR2KQuDF7GkfNmGo%3D"}],"group":"cf-nel","max_age":604800} server cloudflare server-timing cfL4;desc="?proto=QUIC&rtt=64603&sent=11&recv=9&lost=0&retrans=0&sent_bytes=4134&recv_bytes=4439&delivery_rate=8003&cwnd=12000&unsent_bytes=0&cid=56f3c096d66ae54f&ts=163&x=1" cfExtPri cfHdrFlush;dur=0 vary Accept-Encoding x-content-type-options nosniff
GET		.js nurred-vullers.icu/d/	0 0
GET H2	200	css fonts.googleapis.com/	4 KB 1 KB	557ms 144ms	Stylesheet text/css	2607:f8b0:4004:c08::5f GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto:400,700 Requested by Host: tele.fgrteg55.site URL: https://tele.fgrteg55.site/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4004:c08::5f Washington, United States, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 32f95e06752eed31f536332c3d257e10241239d70e322c54bfa75faaba09ab53 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://tele.fgrteg55.site/ Response headers content-encoding gzip x-content-type-options nosniff expires Mon, 18 Nov 2024 13:52:36 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Mon, 18 Nov 2024 13:52:36 GMT content-type text/css; charset=utf-8 vary Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site last-modified Mon, 18 Nov 2024 12:33:55 GMT x-frame-options SAMEORIGIN strict-transport-security max-age=31536000 link <https://fonts.gstatic.com>; rel=preconnect; crossorigin cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * cross-origin-opener-policy same-origin-allow-popups cross-origin-resource-policy cross-origin access-control-allow-origin * x-xss-protection 0 server ESF
GET H3	200	style.css tele.fgrteg55.site/css/	337 B 925 B	106ms 103ms	Stylesheet text/css	172.67.143.128 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://tele.fgrteg55.site/css/style.css Requested by Host: tele.fgrteg55.site URL: https://tele.fgrteg55.site/ Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.143.128 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5c892a0a872b30b4dcad6d5b308c44d1ceb335594b2e330a1efb1c7b8742a8bc Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://tele.fgrteg55.site/ Response headers content-encoding gzip cf-cache-status MISS etag W/"90f6d7cd3044dadc6d9b9f251b985245" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UhQugckNlRQMEoxnXs6erQ%2Fg9zWUOV7Lmx%2FsfovMvmZHDJ1Z7KLDmPg2XG7Dla2sIFRy30gV4TYRmvUFdekz8r2wavwDPSdZ48ZWOWgJoUuFa12FIYQu3UZO%2BvtgRr%2B9wunGGfI%3D"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=65257&sent=27&recv=19&lost=0&retrans=0&sent_bytes=21353&recv_bytes=5454&delivery_rate=133684&cwnd=20400&unsent_bytes=0&cid=56f3c096d66ae54f&ts=349&x=1", cfExtPri, cfHdrFlush;dur=0 date Mon, 18 Nov 2024 13:52:36 GMT content-type text/css; charset=utf-8 vary Accept-Encoding priority u=0,i=?0 cache-control public, max-age=14400, must-revalidate nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} referrer-policy strict-origin-when-cross-origin cf-ray 8e4871227b15150e-LAX access-control-allow-origin * server cloudflare
GET H2	200	bootstrap-icons.css cdn.jsdelivr.net/npm/bootstrap-icons@1.8.1/font/	79 KB 10 KB	436ms 60ms	Stylesheet text/css	2a04:4e42::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/bootstrap-icons@1.8.1/font/bootstrap-icons.css Requested by Host: tele.fgrteg55.site URL: https://tele.fgrteg55.site/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash af35cc6aba34e5005de77099dfa72d4c1a7715d28ddcec343f48031dc8cb08bc Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://tele.fgrteg55.site/ Response headers access-control-expose-headers * content-encoding br etag W/"13a7e-T26mnA4DQx/6Ggl6RUU7WzskbYs" age 1601949 x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT, HIT date Mon, 18 Nov 2024 13:52:36 GMT content-type text/css; charset=utf-8 x-served-by cache-fra-etou8220090-FRA, cache-bur-kbur8200171-BUR vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=31536000, s-maxage=31536000, immutable timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 10209 x-jsd-version 1.8.1
GET H2	200	bootstrap.min.css telegram.org/css/	42 KB 10 KB	707ms 218ms	Stylesheet text/css	2001:67c:4e8:f004::9 Telegram Telegram...
General Check archive.org Show headers Download Go to Full URL https://telegram.org/css/bootstrap.min.css?3 Requested by Host: tele.fgrteg55.site URL: https://tele.fgrteg55.site/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2001:67c:4e8:f004::9 Amsterdam, Netherlands, ASN62041 (Telegram Telegram Messenger Inc, VG), Reverse DNS Software nginx/1.18.0 / Resource Hash f1d083ffaa644c708f11db29707aa57c19246e6d32643b03fee3f82c17b224b3 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://tele.fgrteg55.site/ Response headers strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=345600 content-encoding gzip etag W/"5a05e7c6-a61b" expires Fri, 22 Nov 2024 13:52:36 GMT date Mon, 18 Nov 2024 13:52:36 GMT content-type text/css last-modified Fri, 10 Nov 2017 17:54:14 GMT server nginx/1.18.0
GET H2	200	telegram.css telegram.org/css/	113 KB 29 KB	914ms 426ms	Stylesheet text/css	2001:67c:4e8:f004::9 Telegram Telegram...
General Check archive.org Show headers Download Go to Full URL https://telegram.org/css/telegram.css?227 Requested by Host: tele.fgrteg55.site URL: https://tele.fgrteg55.site/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2001:67c:4e8:f004::9 Amsterdam, Netherlands, ASN62041 (Telegram Telegram Messenger Inc, VG), Reverse DNS Software nginx/1.18.0 / Resource Hash f5f739b99351c1d64b3b890e80e78a9267e9ad2efe8116999ead3749d849e131 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://tele.fgrteg55.site/ Response headers strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=345600 content-encoding gzip etag W/"66f1ab9b-1c21c" expires Fri, 22 Nov 2024 13:52:36 GMT date Mon, 18 Nov 2024 13:52:36 GMT content-type text/css last-modified Mon, 23 Sep 2024 17:55:39 GMT server nginx/1.18.0
GET H/1.1	403 Forbidden	invoke.js ss0uu1lpirig.com/59fb5350e5ee63153438fdd5c0db3b63/	0 0	546ms 131ms	Script application/javascript	192.243.59.12 ADVANCEDHOSTERS-A...
General Check archive.org Show headers Download Go to Full URL https://ss0uu1lpirig.com/59fb5350e5ee63153438fdd5c0db3b63/invoke.js Requested by Host: tele.fgrteg55.site URL: https://tele.fgrteg55.site/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 192.243.59.12 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS DataWeb Global Group B.V., NL), Reverse DNS Software nginx/1.19.5 / Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Referer https://tele.fgrteg55.site/ Response headers Accept-CH Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA Connection keep-alive Access-Control-Allow-Origin * Content-Length 0 P3P CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Date Mon, 18 Nov 2024 13:52:36 GMT Content-Type application/javascript Host ss0uu1lpirig.com Server nginx/1.19.5
GET H3	200	img-profile-1.jpg tele.fgrteg55.site/images/	152 KB 153 KB	138ms 138ms	Image image/jpeg	172.67.143.128 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://tele.fgrteg55.site/images/img-profile-1.jpg Requested by Host: tele.fgrteg55.site URL: https://tele.fgrteg55.site/ Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.143.128 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash eb1afa33de03f6734510282fbe8cf0c0dbab3c91fccbfa379c50681d419adb65 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://tele.fgrteg55.site/ Response headers cf-cache-status MISS etag "398570c34aafa08182d3cd0963670b22" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ex9du3Mk3hMRj63bHt3jrS6u1tr4S8FK43h5yRFvLB87nQw2FPUI3NUe8abLIoJYd2F2M01jtRIt2Ar0HVdMwbghq%2FOh4nZ1XXmm7XLu9hjpzyADcmpKXcnMrKXKLS%2B8cXJdYNg%3D"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=65257&sent=28&recv=19&lost=0&retrans=0&sent_bytes=22301&recv_bytes=5454&delivery_rate=133684&cwnd=20400&unsent_bytes=0&cid=56f3c096d66ae54f&ts=381&x=1", cfExtPri, cfHdrFlush;dur=0 date Mon, 18 Nov 2024 13:52:36 GMT content-type image/jpeg vary Accept-Encoding priority u=2,i cache-control public, max-age=14400, must-revalidate nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} referrer-policy strict-origin-when-cross-origin cf-ray 8e4871227b18150e-LAX accept-ranges bytes access-control-allow-origin * content-length 156077 server cloudflare
GET H3	200	js-tgwallpaper.min.js Show response tele.fgrteg55.site/js/	3 KB 2 KB	114ms 113ms	Script text/javascript	172.67.143.128 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://tele.fgrteg55.site/js/js-tgwallpaper.min.js Requested by Host: tele.fgrteg55.site URL: https://tele.fgrteg55.site/ Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.143.128 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2031e418ee10af8110729b3f327b968462fc0a9d8d1da095387bb472ccd0dee6 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://tele.fgrteg55.site/ Response headers content-encoding gzip cf-cache-status MISS etag W/"d9ca483f58139363967b38c06deb324c" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7s2dlDAY90z8SbP1GENdR6lxqJYpe2RsOghPM0bqBDtiOcQViZttNEnhImjasBYpGaCd1xcJFmerIoPlTxvwQjIRv4baeKVRWNGrHxWY9IKN%2FKBTUiXoUwAKSTia9pO5jbnV13o%3D"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=64982&sent=167&recv=68&lost=0&retrans=0&sent_bytes=182710&recv_bytes=7875&delivery_rate=943219&cwnd=94800&unsent_bytes=0&cid=56f3c096d66ae54f&ts=1284&x=1", cfExtPri, cfHdrFlush;dur=0 date Mon, 18 Nov 2024 13:52:37 GMT content-type text/javascript; charset=utf-8 vary Accept-Encoding priority u=1,i=?0 cache-control public, max-age=14400, must-revalidate nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} referrer-policy strict-origin-when-cross-origin cf-ray 8e4871284f23150e-LAX access-control-allow-origin * server cloudflare
GET H2	200	pattern.svg telegram.org/img/tgme/	226 KB 81 KB	213ms 213ms	Image image/svg+xml	2001:67c:4e8:f004::9 Telegram Telegram...
General Check archive.org Show headers Download Go to Show image Full URL https://telegram.org/img/tgme/pattern.svg?1 Requested by Host: telegram.org URL: https://telegram.org/css/telegram.css?227 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2001:67c:4e8:f004::9 Amsterdam, Netherlands, ASN62041 (Telegram Telegram Messenger Inc, VG), Reverse DNS Software nginx/1.18.0 / Resource Hash 118add53487c02aaf5b5ab9f69380fa06717deb10492e14aaa487e3c62806ad4 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://telegram.org/css/telegram.css?227 Response headers cache-control max-age=345600 content-encoding gzip etag W/"63b70e44-3891a" expires Fri, 22 Nov 2024 13:52:37 GMT access-control-allow-origin * date Mon, 18 Nov 2024 13:52:37 GMT content-type image/svg+xml last-modified Thu, 05 Jan 2023 17:52:04 GMT server nginx/1.18.0
GET DATA	200 OK	truncated /	978 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 77c7245862717d06e6aed1bb0804aa07959e081c9e50a6ee51fcceeda6a66fb0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer Response headers Content-Type image/svg+xml
GET H3	200	KFOlCnqEu92Fr1MmWUlfBBc4.woff2 fonts.gstatic.com/s/roboto/v32/	18 KB 18 KB	661ms 124ms	Font font/woff2	64.233.180.94 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfBBc4.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Roboto:400,700 Protocol H3 Security QUIC, , AES_128_GCM Server 64.233.180.94 , United States, ASN15169 (GOOGLE, US), Reverse DNS on-in-f94.1e100.net Software sffe / Resource Hash d9bada3a44bb2ffa66dec5cc781cafc9ef17ed876cd9b0c5f7ef18228b63cebb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://tele.fgrteg55.site Referer https://fonts.googleapis.com/ Response headers age 64173 report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} x-content-type-options nosniff expires Mon, 17 Nov 2025 20:03:04 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Sun, 17 Nov 2024 20:03:04 GMT last-modified Thu, 01 Aug 2024 20:41:21 GMT content-type font/woff2 cache-control public, max-age=31536000 timing-allow-origin * cross-origin-opener-policy same-origin; report-to="apps-themes" cross-origin-resource-policy cross-origin content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes accept-ranges bytes access-control-allow-origin * content-length 18596 x-xss-protection 0 server sffe
GET H3	200	KFOmCnqEu92Fr1Mu4mxK.woff2 fonts.gstatic.com/s/roboto/v32/	18 KB 18 KB	674ms 131ms	Font font/woff2	64.233.180.94 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu4mxK.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Roboto:400,700 Protocol H3 Security QUIC, , AES_128_GCM Server 64.233.180.94 , United States, ASN15169 (GOOGLE, US), Reverse DNS on-in-f94.1e100.net Software sffe / Resource Hash 89978e658e840b927dddb5cb3a835c7d8526ece79933bd9f3096b301fe1a8571 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://tele.fgrteg55.site Referer https://fonts.googleapis.com/ Response headers age 105244 report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} x-content-type-options nosniff expires Mon, 17 Nov 2025 08:38:33 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Sun, 17 Nov 2024 08:38:33 GMT last-modified Thu, 01 Aug 2024 20:41:24 GMT content-type font/woff2 cache-control public, max-age=31536000 timing-allow-origin * cross-origin-opener-policy same-origin; report-to="apps-themes" cross-origin-resource-policy cross-origin content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes accept-ranges bytes access-control-allow-origin * content-length 18536 x-xss-protection 0 server sffe
GET H2	200	bootstrap-icons.woff2 cdn.jsdelivr.net/npm/bootstrap-icons@1.8.1/font/fonts/	100 KB 101 KB	514ms 78ms	Font font/woff2	2a04:4e42::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/bootstrap-icons@1.8.1/font/fonts/bootstrap-icons.woff2?524846017b983fc8ded9325d94ed40f3 Requested by Host: cdn.jsdelivr.net URL: https://cdn.jsdelivr.net/npm/bootstrap-icons@1.8.1/font/bootstrap-icons.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash c874e14c63db86c4c5318c77cb557fce7036645edc7d690dcc1d23b389631b13 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://tele.fgrteg55.site Referer https://cdn.jsdelivr.net/npm/bootstrap-icons@1.8.1/font/bootstrap-icons.css Response headers access-control-expose-headers * etag W/"19088-HKXox9L7jp1grRof6ypG6Ywkij0" age 4580065 x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT, HIT date Mon, 18 Nov 2024 13:52:37 GMT content-type font/woff2 x-served-by cache-fra-eddf8230061-FRA, cache-lax-kwhp1940103-LAX vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=31536000, s-maxage=31536000, immutable timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 102536 x-jsd-version 1.8.1
GET H3	200	img-favicon.ico tele.fgrteg55.site/favicons/	15 KB 4 KB	224ms 222ms	Other image/x-icon	172.67.143.128 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://tele.fgrteg55.site/favicons/img-favicon.ico Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.143.128 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4ff54bc38c267dc3a8c95f6ed4590336baaec70433ef15d027ddca608c391e78 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://tele.fgrteg55.site/ Response headers content-encoding gzip cf-cache-status MISS etag W/"8c2e745f81233dfd0d5a28b113eaa37f" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GXjXVn3CJIPS2MY9z5Ztu5WYAJBRlBoGzahKXXDvPkaARl84svSNCQSCppeYTTAkdNUG6yb3VumdseUSdPCe0SU6IdUBw6NrFGXe7MYO2w3oI8iJmaR8vyqgqnNlApSuMvvQ58E%3D"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=64601&sent=170&recv=70&lost=0&retrans=0&sent_bytes=185000&recv_bytes=8277&delivery_rate=17876&cwnd=94800&unsent_bytes=0&cid=56f3c096d66ae54f&ts=2209&x=1", cfExtPri, cfHdrFlush;dur=0 date Mon, 18 Nov 2024 13:52:38 GMT content-type image/x-icon vary Accept-Encoding priority u=1,i cache-control public, max-age=14400, must-revalidate nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} referrer-policy strict-origin-when-cross-origin cf-ray 8e48712d7acf150e-LAX access-control-allow-origin * server cloudflare

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

nurred-vullers.icu

URL

https://nurred-vullers.icu/d/.js?lpref=&lpurl=https%3A%2F%2Ftele.fgrteg55.site%2F&lpt=Telegram%3A%20Join%20Adult%20Dating&vtm=1731937956182

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Telegram (Instant Messenger)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| dtpCallback function| _0x3da56d function| _0x5d2a function| _0x5615 object| atOptions function| _0x29e8 function| _0x5c7aa5 function| _0x15ca object| TWallpaper object| tme_bg function| toggleTheme object| darkMedia string| backOfferUrl

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	(Line 8) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ss0uu1lpirig.com/59fb5350e5ee63153438fdd5c0db3b63/invoke.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	(Line 8) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ss0uu1lpirig.com/59fb5350e5ee63153438fdd5c0db3b63/invoke.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network	error	URL: https://ss0uu1lpirig.com/59fb5350e5ee63153438fdd5c0db3b63/invoke.js Message: Failed to load resource: the server responded with a status of 403 (Forbidden)

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
fonts.googleapis.com
fonts.gstatic.com
nurred-vullers.icu
ss0uu1lpirig.com
tele.fgrteg55.site
telegram.org
nurred-vullers.icu
172.67.143.128
192.243.59.12
2001:67c:4e8:f004::9
2607:f8b0:4004:c08::5f
2a04:4e42::485
64.233.180.94
118add53487c02aaf5b5ab9f69380fa06717deb10492e14aaa487e3c62806ad4
2031e418ee10af8110729b3f327b968462fc0a9d8d1da095387bb472ccd0dee6
32f95e06752eed31f536332c3d257e10241239d70e322c54bfa75faaba09ab53
3b3075f3fc03069b6d5cacbade4db3c664eff44986fd2a484534dc75e2466472
4ff54bc38c267dc3a8c95f6ed4590336baaec70433ef15d027ddca608c391e78
5c892a0a872b30b4dcad6d5b308c44d1ceb335594b2e330a1efb1c7b8742a8bc
77c7245862717d06e6aed1bb0804aa07959e081c9e50a6ee51fcceeda6a66fb0
89978e658e840b927dddb5cb3a835c7d8526ece79933bd9f3096b301fe1a8571
af35cc6aba34e5005de77099dfa72d4c1a7715d28ddcec343f48031dc8cb08bc
c874e14c63db86c4c5318c77cb557fce7036645edc7d690dcc1d23b389631b13
d9bada3a44bb2ffa66dec5cc781cafc9ef17ed876cd9b0c5f7ef18228b63cebb
eb1afa33de03f6734510282fbe8cf0c0dbab3c91fccbfa379c50681d419adb65
f1d083ffaa644c708f11db29707aa57c19246e6d32643b03fee3f82c17b224b3
f5f739b99351c1d64b3b890e80e78a9267e9ad2efe8116999ead3749d849e131