181.214.208.102.sslip.io Open in urlscan Pro
181.214.208.102 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://181.214.208.102.sslip.io/desktop
Submission: On October 30 via api (October 30th 2024, 5:24:51 pm UTC) from CZ — Scanned from NL

Summary HTTP 7 Redirects Links 18 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 7 HTTP transactions. The main IP is 181.214.208.102, located in Amsterdam, Netherlands and belongs to NFORCE, NL. The main domain is 181.214.208.102.sslip.io.
TLS certificate: Issued by R3 on January 24th 2024. Valid for: 3 months.

This is the only time 181.214.208.102.sslip.io was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Telegram (Instant Messenger)

Domain & IP information

	IP Address		AS Autonomous System
7	181.214.208.102 181.214.208.102		43350 (NFORCE) (NFORCE)
7	2

7 181.214.208.102 (Amsterdam, Netherlands)

ASN43350 (NFORCE, NL)

181.214.208.102.sslip.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	sslip.io 181.214.208.102.sslip.io	380 KB
7	1

	Domain	Requested by
7	181.214.208.102.sslip.io	181.214.208.102.sslip.io
7	1

This site contains links to these domains. Also see Links.

Domain
twitter.com
telegram.org
core.telegram.org
github.com
tx.me

Subject Issuer	Validity	Valid
p0.fsoall.ir R3	`2024-01-24` - `2024-04-23`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://181.214.208.102.sslip.io/desktop
Frame ID: 94BD5115366A5B7713AC8C8D71825B04
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Telegram Desktop

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Page Statistics

7
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

380 kB
Transfer

383 kB
Size

1
Cookies

18 Outgoing links

These are links going to different origins than the main page.

URL: https://twitter.com/telegram
Title: Twitter

Search URL Search Domain Scan URL

URL: https://telegram.org/
Title: Home

Search URL Search Domain Scan URL

URL: https://telegram.org/faq
Title: FAQ

Search URL Search Domain Scan URL

URL: https://telegram.org/apps
Title: Apps

Search URL Search Domain Scan URL

URL: https://core.telegram.org/api
Title: API

Search URL Search Domain Scan URL

URL: https://core.telegram.org/mtproto
Title: Protocol

Search URL Search Domain Scan URL

URL: https://telegram.org/dl/desktop/win64
Title: Download Telegram voor Windows x64

Search URL Search Domain Scan URL

URL: https://telegram.org/dl/desktop/win64_portable
Title: Draagbare versie

Search URL Search Domain Scan URL

URL: https://telegram.org/dl/desktop/mac
Title: Download Telegram voor macOS

Search URL Search Domain Scan URL

URL: https://telegram.org/dl/desktop/mac_store
Title: Mac App Store

Search URL Search Domain Scan URL

URL: https://telegram.org/dl/desktop/linux
Title: Download Telegram voor Linux x64

Search URL Search Domain Scan URL

URL: https://telegram.org/dl/desktop/flatpak
Title: Flatpak

Search URL Search Domain Scan URL

URL: https://telegram.org/dl/desktop/snap
Title: Snap

Search URL Search Domain Scan URL

URL: https://telegram.org/dl/desktop/win
Title: Download Telegram voor Windows

Search URL Search Domain Scan URL

URL: https://telegram.org/dl/desktop/win_portable
Title: Draagbare versie

Search URL Search Domain Scan URL

URL: https://github.com/telegramdesktop/tdesktop/blob/master/LICENSE
Title: GPL v3

Search URL Search Domain Scan URL

URL: https://github.com/telegramdesktop/tdesktop
Title: GitHub

Search URL Search Domain Scan URL

URL: https://tx.me/desktop/changelog#beta-version
Title: Bètaversie

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request desktop Show response
181.214.208.102.sslip.io/ 6 KB
2 KB 643ms
61ms Document
text/html 181.214.208.102
NFORCE

General

Check archive.org

Show headers Download Go to

Full URL

https://181.214.208.102.sslip.io/desktop

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

181.214.208.102 Amsterdam, Netherlands, ASN43350 (NFORCE, NL),

Reverse DNS

Software

nginx/1.24.0 /

Resource Hash

3dcb684c19c1316cd5769b82db22577501a3803f9ce2591273d6c9788f527b88

Security Headers

Name	Value
Strict-Transport-Security	max-age=35768000
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

cache-control: no-store
content-encoding: gzip
content-length: 1970
content-type: text/html; charset=utf-8
date: Wed, 30 Oct 2024 17:24:44 GMT
pragma: no-cache
server: nginx/1.24.0
strict-transport-security: max-age=35768000
x-frame-options: SAMEORIGIN

GET
H2 200 bootstrap.min.css
181.214.208.102.sslip.io/css/ 42 KB
42 KB 39ms
33ms Stylesheet
text/css 181.214.208.102
NFORCE

General

Check archive.org

Show headers Download Go to

Full URL

https://181.214.208.102.sslip.io/css/bootstrap.min.css?3

Requested by

Host: 181.214.208.102.sslip.io
URL: https://181.214.208.102.sslip.io/desktop

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

181.214.208.102 Amsterdam, Netherlands, ASN43350 (NFORCE, NL),

Reverse DNS

Software

nginx/1.24.0 /

Resource Hash

f1d083ffaa644c708f11db29707aa57c19246e6d32643b03fee3f82c17b224b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=35768000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://181.214.208.102.sslip.io/desktop

Response headers

strict-transport-security: max-age=35768000
cache-control: max-age=345600
etag: "5a05e7c6-a61b"
expires: Sun, 03 Nov 2024 17:24:44 GMT
accept-ranges: bytes
content-length: 42523
date: Wed, 30 Oct 2024 17:24:44 GMT
content-type: text/css
last-modified: Fri, 10 Nov 2017 17:54:14 GMT
server: nginx/1.24.0

GET
H2 200 telegram.css
181.214.208.102.sslip.io/css/ 113 KB
113 KB 71ms
65ms Stylesheet
text/css 181.214.208.102
NFORCE

General

Check archive.org

Show headers Download Go to

Full URL

https://181.214.208.102.sslip.io/css/telegram.css?241

Requested by

Host: 181.214.208.102.sslip.io
URL: https://181.214.208.102.sslip.io/desktop

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

181.214.208.102 Amsterdam, Netherlands, ASN43350 (NFORCE, NL),

Reverse DNS

Software

nginx/1.24.0 /

Resource Hash

f5f739b99351c1d64b3b890e80e78a9267e9ad2efe8116999ead3749d849e131

Security Headers

Name	Value
Strict-Transport-Security	max-age=35768000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://181.214.208.102.sslip.io/desktop

Response headers

strict-transport-security: max-age=35768000
cache-control: max-age=345600
etag: "66f1ab9b-1c21c"
expires: Sun, 03 Nov 2024 17:24:44 GMT
accept-ranges: bytes
content-length: 115228
date: Wed, 30 Oct 2024 17:24:45 GMT
content-type: text/css
last-modified: Mon, 23 Sep 2024 17:55:39 GMT
server: nginx/1.24.0

GET
H2 200 main.js Show response
181.214.208.102.sslip.io/js/ 21 KB
21 KB 67ms
64ms Script
application/javascript 181.214.208.102
NFORCE

General

Check archive.org

Show headers Download Go to

Full URL

https://181.214.208.102.sslip.io/js/main.js?47

Requested by

Host: 181.214.208.102.sslip.io
URL: https://181.214.208.102.sslip.io/desktop

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

181.214.208.102 Amsterdam, Netherlands, ASN43350 (NFORCE, NL),

Reverse DNS

Software

nginx/1.24.0 /

Resource Hash

51c4d88fd78f3b8efb16f845e75be7f1bb288fdf2fd39d033868a0346db7fadb

Security Headers

Name	Value
Strict-Transport-Security	max-age=35768000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://181.214.208.102.sslip.io/desktop

Response headers

strict-transport-security: max-age=35768000
cache-control: max-age=345600
etag: "63950fe2-53e6"
expires: Sun, 03 Nov 2024 17:24:44 GMT
accept-ranges: bytes
content-length: 21478
date: Wed, 30 Oct 2024 17:24:45 GMT
content-type: application/javascript
last-modified: Sat, 10 Dec 2022 23:01:54 GMT
server: nginx/1.24.0

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 20f4c7a3a145bb8bd7bbed583088379b30196e62437926bb0433042b81102e19

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
H2 200 twitter.png
181.214.208.102.sslip.io/img/ 1 KB
1 KB 40ms
40ms Image
image/png 181.214.208.102
NFORCE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://181.214.208.102.sslip.io/img/twitter.png
Requested by: Host: 181.214.208.102.sslip.io
URL: https://181.214.208.102.sslip.io/css/telegram.css?241
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 181.214.208.102 Amsterdam, Netherlands, ASN43350 (NFORCE, NL),
Reverse DNS
Software: nginx/1.24.0 /
Resource Hash: e7d23b06a4ffd600558e5443d1e32daaaf13a27cf7bb8b7cc163a92b4054aaf2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://181.214.208.102.sslip.io/css/telegram.css?241

Response headers

cache-control: max-age=345600
etag: "5a05e7c6-4f8"
expires: Sun, 03 Nov 2024 17:24:45 GMT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1272
date: Wed, 30 Oct 2024 17:24:45 GMT
content-type: image/png
last-modified: Fri, 10 Nov 2017 17:54:14 GMT
server: nginx/1.24.0

GET
H2 200 td_laptop.png
181.214.208.102.sslip.io/img/ 185 KB
186 KB 92ms
91ms Image
image/png 181.214.208.102
NFORCE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://181.214.208.102.sslip.io/img/td_laptop.png
Requested by: Host: 181.214.208.102.sslip.io
URL: https://181.214.208.102.sslip.io/css/telegram.css?241
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 181.214.208.102 Amsterdam, Netherlands, ASN43350 (NFORCE, NL),
Reverse DNS
Software: nginx/1.24.0 /
Resource Hash: 3a1d4890b3e91a01c20c65b75f1ae028e3c445cad1fd2d249dd0868876dfe4b4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://181.214.208.102.sslip.io/css/telegram.css?241

Response headers

cache-control: max-age=345600
etag: "5a05e7c6-2e526"
expires: Sun, 03 Nov 2024 17:24:45 GMT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 189734
date: Wed, 30 Oct 2024 17:24:45 GMT
content-type: image/png
last-modified: Fri, 10 Nov 2017 17:54:14 GMT
server: nginx/1.24.0

GET
H2 200 favicon.ico
181.214.208.102.sslip.io/img/ 15 KB
15 KB 33ms
32ms Other
image/x-icon 181.214.208.102
NFORCE

General

Check archive.org

Show headers Download Go to

Full URL

https://181.214.208.102.sslip.io/img/favicon.ico

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

181.214.208.102 Amsterdam, Netherlands, ASN43350 (NFORCE, NL),

Reverse DNS

Software

nginx/1.24.0 /

Resource Hash

4ff54bc38c267dc3a8c95f6ed4590336baaec70433ef15d027ddca608c391e78

Security Headers

Name	Value
Strict-Transport-Security	max-age=35768000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://181.214.208.102.sslip.io/desktop

Response headers

strict-transport-security: max-age=35768000
cache-control: max-age=604800
etag: "62616083-3aee"
expires: Wed, 06 Nov 2024 17:24:45 GMT
accept-ranges: bytes
content-length: 15086
date: Wed, 30 Oct 2024 17:24:45 GMT
content-type: image/x-icon
last-modified: Thu, 21 Apr 2022 13:47:47 GMT
server: nginx/1.24.0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Telegram (Instant Messenger)

41 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			181.214.208.102.sslip.io/	1970-01-21 00:39:09	Name: stel_ssid Value: dceb7883a9421705eb_10049772937555370183

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=35768000
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

181.214.208.102.sslip.io
181.214.208.102
20f4c7a3a145bb8bd7bbed583088379b30196e62437926bb0433042b81102e19
3a1d4890b3e91a01c20c65b75f1ae028e3c445cad1fd2d249dd0868876dfe4b4
3dcb684c19c1316cd5769b82db22577501a3803f9ce2591273d6c9788f527b88
4ff54bc38c267dc3a8c95f6ed4590336baaec70433ef15d027ddca608c391e78
51c4d88fd78f3b8efb16f845e75be7f1bb288fdf2fd39d033868a0346db7fadb
e7d23b06a4ffd600558e5443d1e32daaaf13a27cf7bb8b7cc163a92b4054aaf2
f1d083ffaa644c708f11db29707aa57c19246e6d32643b03fee3f82c17b224b3
f5f739b99351c1d64b3b890e80e78a9267e9ad2efe8116999ead3749d849e131

181.214.208.102.sslip.io Open in urlscan Pro 181.214.208.102 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

7 Requests

0 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

380 kBTransfer

383 kBSize

1 Cookies

18 Outgoing links

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

41 JavaScript Global Variables

1 Cookies

Security Headers

Indicators

181.214.208.102.sslip.io Open in urlscan Pro
181.214.208.102 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

380 kB
Transfer

383 kB
Size

1
Cookies

7 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!