tlegram.top Open in urlscan Pro
94.103.125.103 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://tlegram.top/
Effective URL:
https://tlegram.top/
Submission: On November 01 via api (November 1st 2024, 6:31:28 am UTC) from CN — Scanned from DE

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 12 HTTP transactions. The main IP is 94.103.125.103, located in Reston, United States and belongs to NYBULA, US. The main domain is tlegram.top.
TLS certificate: Issued by R10 on October 29th 2024. Valid for: 3 months.

This is the only time tlegram.top was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Telegram (Instant Messenger)

Domain & IP information

	IP Address		AS Autonomous System
12	94.103.125.103 94.103.125.103		401116 (NYBULA) (NYBULA)
12	2

12 94.103.125.103 (Reston, United States)

ASN401116 (NYBULA, US)

tlegram.top	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	tlegram.top tlegram.top	189 KB
12	1

	Domain	Requested by
12	tlegram.top	tlegram.top
12	1

This site contains no links.

Subject Issuer	Validity	Valid
telegram-help.com R10	`2024-10-29` - `2025-01-27`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://tlegram.top/
Frame ID: 66F2FB9FB888289688A04E899E7819CD
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Telegram

Page URL History Show full URLs

http://tlegram.top/ HTTP 307
https://tlegram.top/ Page URL

Detected technologies

Vue.js (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+\sdata-v(?:ue)?-

Page Statistics

12
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

189 kB
Transfer

734 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://tlegram.top/ HTTP 307
https://tlegram.top/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response tlegram.top/ Redirect Chain http://tlegram.top/ https://tlegram.top/	201 B 266 B	484ms 26ms	Document text/html	94.103.125.103 NYBULA
General Check archive.org Show headers Download Go to Full URL https://tlegram.top/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 94.103.125.103 Reston, United States, ASN401116 (NYBULA, US), Reverse DNS Software Apache / Resource Hash `76b17ba777dc72050dbfd5b1f27df36fc5a299a701e4cf7bd698208bce6bc11e` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers content-encoding gzip content-length 169 content-type text/html; charset=UTF-8 date Fri, 01 Nov 2024 06:31:23 GMT server Apache vary Accept-Encoding Redirect headers Location https://tlegram.top/ Non-Authoritative-Reason HttpsUpgrades
GET H2	200	key.js Show response tlegram.top/next/	2 KB 993 B	18ms 18ms	Script text/javascript	94.103.125.103 NYBULA
General Check archive.org Show headers Download Go to Full URL https://tlegram.top/next/key.js Requested by Host: tlegram.top URL: https://tlegram.top/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 94.103.125.103 Reston, United States, ASN401116 (NYBULA, US), Reverse DNS Software Apache / Resource Hash `0ff957638e69ed53f108bed9e71dfd8208002bd40b3ff2a041ed6571349f2fbe` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://tlegram.top/ Response headers content-encoding gzip etag "8ee-61bf97743c280-gzip" accept-ranges bytes content-length 900 date Fri, 01 Nov 2024 06:31:23 GMT last-modified Fri, 28 Jun 2024 20:55:22 GMT vary Accept-Encoding server Apache content-type text/javascript
GET H2	200	chunk-vendors.a5604ca1.js Show response tlegram.top/js/	156 KB 57 KB	54ms 54ms	Script text/javascript	94.103.125.103 NYBULA
General Check archive.org Show headers Download Go to Full URL https://tlegram.top/js/chunk-vendors.a5604ca1.js Requested by Host: tlegram.top URL: https://tlegram.top/next/key.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 94.103.125.103 Reston, United States, ASN401116 (NYBULA, US), Reverse DNS Software Apache / Resource Hash `bd7849203281ea4d825e5e905a1f0b826be8ed5b8f935dce4f765ed532da6f53` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://tlegram.top/ Response headers content-encoding gzip etag "26ecf-61bf97391b700-gzip" accept-ranges bytes content-length 58276 date Fri, 01 Nov 2024 06:31:23 GMT last-modified Fri, 28 Jun 2024 20:54:20 GMT vary Accept-Encoding server Apache content-type text/javascript
GET H2	200	app.2464f4f7.js Show response tlegram.top/js/	6 KB 3 KB	39ms 38ms	Script text/javascript	94.103.125.103 NYBULA
General Check archive.org Show headers Download Go to Full URL https://tlegram.top/js/app.2464f4f7.js Requested by Host: tlegram.top URL: https://tlegram.top/next/key.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 94.103.125.103 Reston, United States, ASN401116 (NYBULA, US), Reverse DNS Software Apache / Resource Hash `348a0ab945cfbae683883a6b2fb2cbfdb7eaca7f972a622ca19254ba5be2a014` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://tlegram.top/ Response headers content-encoding gzip etag "1737-61bf97391b700-gzip" accept-ranges bytes content-length 2652 date Fri, 01 Nov 2024 06:31:23 GMT last-modified Fri, 28 Jun 2024 20:54:20 GMT vary Accept-Encoding server Apache content-type text/javascript
GET H2	200	app.92828434.css tlegram.top/css/	520 KB 112 KB	39ms 39ms	Stylesheet text/css	94.103.125.103 NYBULA
General Check archive.org Show headers Download Go to Full URL https://tlegram.top/css/app.92828434.css Requested by Host: tlegram.top URL: https://tlegram.top/next/key.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 94.103.125.103 Reston, United States, ASN401116 (NYBULA, US), Reverse DNS Software Apache / Resource Hash `73a68f256057d773247ebcf62a2d36a55e8db4e669cd299ff9c5225bb91c86d1` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://tlegram.top/ Response headers content-encoding gzip etag "81e75-61bf97391b700-gzip" accept-ranges bytes date Fri, 01 Nov 2024 06:31:23 GMT last-modified Fri, 28 Jun 2024 20:54:20 GMT vary Accept-Encoding server Apache content-type text/css
GET H2	200	user Show response tlegram.top/graphql/	13 B 164 B	20ms 19ms	XHR text/html	94.103.125.103 NYBULA
General Check archive.org Show headers Download Go to Full URL https://tlegram.top/graphql/user?act=record Requested by Host: tlegram.top URL: https://tlegram.top/js/chunk-vendors.a5604ca1.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 94.103.125.103 Reston, United States, ASN401116 (NYBULA, US), Reverse DNS Software Apache / Resource Hash `aa3d21398252adb9f16b5208884b4da22eec9f2019a0139b114a61f178396794` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Accept application/json, text/plain, / Referer https://tlegram.top/ Response headers cache-control no-store, no-cache, must-revalidate content-encoding gzip pragma no-cache expires Thu, 19 Nov 1981 08:52:00 GMT content-length 33 date Fri, 01 Nov 2024 06:31:23 GMT content-type text/html; charset=UTF-8 vary Accept-Encoding server Apache
GET H2	200	favicon.ico tlegram.top/	15 KB 3 KB	17ms 17ms	Other image/x-icon	94.103.125.103 NYBULA
General Check archive.org Show headers Download Go to Full URL https://tlegram.top/favicon.ico Protocol H2 Security TLS 1.3, , AES_256_GCM Server 94.103.125.103 Reston, United States, ASN401116 (NYBULA, US), Reverse DNS Software Apache / Resource Hash `7e2388ec283fe17472ef02829a93da550af8f3ad4a975f50a0110bff61afe523` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://tlegram.top/ Response headers content-encoding gzip etag "3aee-61b10b166e080-gzip" accept-ranges bytes content-length 3215 date Fri, 01 Nov 2024 06:31:23 GMT last-modified Mon, 17 Jun 2024 07:12:50 GMT vary Accept-Encoding server Apache content-type image/x-icon
GET H2	200	897.1ae37c1b.js Show response tlegram.top/js/	17 KB 10 KB	18ms 18ms	Script text/javascript	94.103.125.103 NYBULA
General Check archive.org Show headers Download Go to Full URL https://tlegram.top/js/897.1ae37c1b.js Requested by Host: tlegram.top URL: https://tlegram.top/js/app.2464f4f7.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 94.103.125.103 Reston, United States, ASN401116 (NYBULA, US), Reverse DNS Software Apache / Resource Hash `3c3983a908d57ea1984a9e10245967acd38e5b1f84dc3b4da207d49d7ef7dafb` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://tlegram.top/ Response headers content-encoding gzip etag "432a-61bf97391b700-gzip" accept-ranges bytes content-length 9894 date Fri, 01 Nov 2024 06:31:23 GMT last-modified Fri, 28 Jun 2024 20:54:20 GMT vary Accept-Encoding server Apache content-type text/javascript
GET DATA	200 OK	truncated /	4 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `a9dbdf064d9fd22138994e83a581271d07a70fa97ebe62d02b0fdff1a44418f5` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer Response headers Content-Type image/png
GET H2	200	favicon.ico tlegram.top/	15 KB 3 KB	19ms 18ms	Other image/x-icon	94.103.125.103 NYBULA
General Check archive.org Show headers Download Go to Full URL https://tlegram.top/favicon.ico Protocol H2 Security TLS 1.3, , AES_256_GCM Server 94.103.125.103 Reston, United States, ASN401116 (NYBULA, US), Reverse DNS Software Apache / Resource Hash `7e2388ec283fe17472ef02829a93da550af8f3ad4a975f50a0110bff61afe523` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://tlegram.top/ Response headers content-encoding gzip etag "3aee-61b10b166e080-gzip" accept-ranges bytes content-length 3215 date Fri, 01 Nov 2024 06:31:23 GMT last-modified Mon, 17 Jun 2024 07:12:50 GMT vary Accept-Encoding server Apache content-type image/x-icon
GET H2	200	user Show response tlegram.top/graphql/	13 B 88 B	19ms 19ms	XHR text/html	94.103.125.103 NYBULA
General Check archive.org Show headers Download Go to Full URL https://tlegram.top/graphql/user?act=heart_beat Requested by Host: tlegram.top URL: https://tlegram.top/js/chunk-vendors.a5604ca1.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 94.103.125.103 Reston, United States, ASN401116 (NYBULA, US), Reverse DNS Software Apache / Resource Hash `9cbb029ed73eb93a0dfe76faa5d0f9f99d26a00a1c1ce1b96af2cfb9c1ef8fd7` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Accept application/json, text/plain, / Referer https://tlegram.top/ Response headers cache-control no-store, no-cache, must-revalidate content-encoding gzip pragma no-cache expires Thu, 19 Nov 1981 08:52:00 GMT content-length 33 date Fri, 01 Nov 2024 06:31:25 GMT content-type text/html; charset=UTF-8 vary Accept-Encoding server Apache
GET H2	200	user Show response tlegram.top/graphql/	13 B 88 B	20ms 20ms	XHR text/html	94.103.125.103 NYBULA
General Check archive.org Show headers Download Go to Full URL https://tlegram.top/graphql/user?act=heart_beat Requested by Host: tlegram.top URL: https://tlegram.top/js/chunk-vendors.a5604ca1.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 94.103.125.103 Reston, United States, ASN401116 (NYBULA, US), Reverse DNS Software Apache / Resource Hash `9cbb029ed73eb93a0dfe76faa5d0f9f99d26a00a1c1ce1b96af2cfb9c1ef8fd7` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Accept application/json, text/plain, / Referer https://tlegram.top/ Response headers cache-control no-store, no-cache, must-revalidate content-encoding gzip pragma no-cache expires Thu, 19 Nov 1981 08:52:00 GMT content-length 33 date Fri, 01 Nov 2024 06:31:26 GMT content-type text/html; charset=UTF-8 vary Accept-Encoding server Apache
GET H2	200	user Show response tlegram.top/graphql/	13 B 88 B	21ms 20ms	XHR text/html	94.103.125.103 NYBULA
General Check archive.org Show headers Download Go to Full URL https://tlegram.top/graphql/user?act=heart_beat Requested by Host: tlegram.top URL: https://tlegram.top/js/chunk-vendors.a5604ca1.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 94.103.125.103 Reston, United States, ASN401116 (NYBULA, US), Reverse DNS Software Apache / Resource Hash `9cbb029ed73eb93a0dfe76faa5d0f9f99d26a00a1c1ce1b96af2cfb9c1ef8fd7` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Accept application/json, text/plain, / Referer https://tlegram.top/ Response headers cache-control no-store, no-cache, must-revalidate content-encoding gzip pragma no-cache expires Thu, 19 Nov 1981 08:52:00 GMT content-length 33 date Fri, 01 Nov 2024 06:31:28 GMT content-type text/html; charset=UTF-8 vary Accept-Encoding server Apache

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Telegram (Instant Messenger)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			tlegram.top/	1969-12-31 23:59:59	Name: PHPSESSID Value: o09thj4r1q8h7f3dth6ibk0r6c

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

tlegram.top
94.103.125.103
0ff957638e69ed53f108bed9e71dfd8208002bd40b3ff2a041ed6571349f2fbe
348a0ab945cfbae683883a6b2fb2cbfdb7eaca7f972a622ca19254ba5be2a014
3c3983a908d57ea1984a9e10245967acd38e5b1f84dc3b4da207d49d7ef7dafb
73a68f256057d773247ebcf62a2d36a55e8db4e669cd299ff9c5225bb91c86d1
76b17ba777dc72050dbfd5b1f27df36fc5a299a701e4cf7bd698208bce6bc11e
7e2388ec283fe17472ef02829a93da550af8f3ad4a975f50a0110bff61afe523
9cbb029ed73eb93a0dfe76faa5d0f9f99d26a00a1c1ce1b96af2cfb9c1ef8fd7
a9dbdf064d9fd22138994e83a581271d07a70fa97ebe62d02b0fdff1a44418f5
aa3d21398252adb9f16b5208884b4da22eec9f2019a0139b114a61f178396794
bd7849203281ea4d825e5e905a1f0b826be8ed5b8f935dce4f765ed532da6f53

tlegram.top Open in urlscan Pro 94.103.125.103 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

0 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

189 kBTransfer

734 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

1 Cookies

Indicators

tlegram.top Open in urlscan Pro
94.103.125.103 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

189 kB
Transfer

734 kB
Size

1
Cookies

12 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!