pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu Open in urlscan Pro
103.163.208.163 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://pp.tggname.icu/
Effective URL:
https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/
Submission: On November 01 via automatic, source openphish (November 1st 2024, 1:20:05 pm UTC) — Scanned from DE

Summary HTTP 22 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 22 HTTP transactions. The main IP is 103.163.208.163, located in Hong Kong and belongs to STARBOWLTD-AS-AP Starbow Ltd., JP. The main domain is pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu.
TLS certificate: Issued by R11 on November 1st 2024. Valid for: 3 months.

This is the only time pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Telegram (Instant Messenger)

Domain & IP information

	IP Address	AS Autonomous System
1 16	103.163.208.163 103.163.208.163	140683 (STARBOWLT...) (STARBOWLTD-AS-AP Starbow Ltd.)
1 1	2606:4700:303... 2606:4700:3036::ac43:8b69	13335 (CLOUDFLAR...) (CLOUDFLARENET)
22	2

16 103.163.208.163 (Hong Kong) 1 redirects

ASN140683 (STARBOWLTD-AS-AP Starbow Ltd., JP)

pp.tggname.icu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3036::ac43:8b69 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

goo.su	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
15	t-uo-i-i-i-i-i-i-i-i-i-i.icu pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu	887 KB
1	goo.su 1 redirects goo.su — Cisco Umbrella Rank: 477843	1 KB
1	tggname.icu 1 redirects pp.tggname.icu	281 B
22	3

	Domain	Requested by
15	pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu	pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu
1	goo.su	1 redirects
1	pp.tggname.icu	1 redirects
22	3

This site contains no links.

Subject Issuer	Validity	Valid
*.t-uo-i-i-i-i-i-i-i-i-i-i.icu R11	`2024-11-01` - `2025-01-30`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/
Frame ID: 5C8B6E225506030FA6CCD81A72C2D9D7
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Telegram Web

Page URL History Show full URLs

https://pp.tggname.icu/ HTTP 301
https://goo.su/jUy9Qi/ HTTP 301
https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/ Page URL

Page Statistics

22
Requests

68 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

887 kB
Transfer

2974 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://pp.tggname.icu/ HTTP 301
https://goo.su/jUy9Qi/ HTTP 301
https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

22 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/
Redirect Chain

https://pp.tggname.icu/
https://goo.su/jUy9Qi/
https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/

11 KB
5 KB

881ms
207ms

Document
text/html

103.163.208.163
STARBOWLTD-AS-AP ...

General

Check archive.org

Show headers Download Go to

Full URL

https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.163.208.163 , Hong Kong, ASN140683 (STARBOWLTD-AS-AP Starbow Ltd., JP),

Reverse DNS

Software

nginx /

Resource Hash

d01eecccba816ca6c355ae79567a59865ab13ef76d6f3bb75f9682048ae4deb8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html
date: Fri, 01 Nov 2024 13:19:59 GMT
etag: W/"672488e2-2d57"
last-modified: Fri, 01 Nov 2024 07:53:06 GMT
server: nginx
strict-transport-security: max-age=31536000
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8dbc2df73ea19a23-FRA
content-type: text/html; charset=UTF-8
date: Fri, 01 Nov 2024 13:19:58 GMT
location: https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority: u=0,i
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zoNVqAzb4U04fmyScyveUQl1OmQyFvaLbou9hBTe%2FrBLxw8xzZo9pGBR6KazNvF3fpaqsU63IG%2BZ6Kar54GEFOqh04VIX5FsEG%2BfvMd15fO4DItKnSdE77UzGIpG14uJHJWm9jY%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=QUIC&rtt=15420&sent=12&recv=10&lost=0&retrans=0&sent_bytes=4231&recv_bytes=4428&delivery_rate=650&cwnd=12000&unsent_bytes=0&cid=c9ce8e92d59a37d0&ts=201&x=1" cfExtPri cfHdrFlush;dur=0
x-powered-by: PHP/8.2.13

GET
H2 200 main.4d7bc528ef300bb77a47.css
pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/ 405 KB
87 KB 212ms
211ms Stylesheet
text/css 103.163.208.163
STARBOWLTD-AS-AP ...

General

Check archive.org

Show headers Download Go to

Full URL

https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/main.4d7bc528ef300bb77a47.css

Requested by

Host: pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu
URL: https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.163.208.163 , Hong Kong, ASN140683 (STARBOWLTD-AS-AP Starbow Ltd., JP),

Reverse DNS

Software

nginx /

Resource Hash

216ac2ed4fb401b782b3aedec58fa3011db42a583f7c0f3b3cfe2a677cf5bb99

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=43200
content-encoding: gzip
etag: W/"657fbfca-65417"
expires: Sat, 02 Nov 2024 01:19:59 GMT
date: Fri, 01 Nov 2024 13:19:59 GMT
content-type: text/css
last-modified: Mon, 18 Dec 2023 03:43:06 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 style-desktop.7ec8ed3b19fabb19d057.css
pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/ 338 B
541 B 629ms
628ms Stylesheet
text/css 103.163.208.163
STARBOWLTD-AS-AP ...

General

Check archive.org

Show headers Download Go to

Full URL

https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/style-desktop.7ec8ed3b19fabb19d057.css

Requested by

Host: pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu
URL: https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.163.208.163 , Hong Kong, ASN140683 (STARBOWLTD-AS-AP Starbow Ltd., JP),

Reverse DNS

Software

nginx /

Resource Hash

322deb24d6d5efcf38e98818033dc373a21e67a4535703a0bae2772b13d9f5ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=43200
etag: "657ecc64-152"
expires: Sat, 02 Nov 2024 01:19:59 GMT
accept-ranges: bytes
content-length: 338
date: Fri, 01 Nov 2024 13:19:59 GMT
content-type: text/css
last-modified: Sun, 17 Dec 2023 10:24:36 GMT
server: nginx

GET
H2 200 mtproto.worker.924294a18bb67d1055db.chunk.js Show response
pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/ 742 KB
203 KB 634ms
633ms Script
application/javascript 103.163.208.163
STARBOWLTD-AS-AP ...

General

Check archive.org

Show headers Download Go to

Full URL

https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/mtproto.worker.924294a18bb67d1055db.chunk.js

Requested by

Host: pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu
URL: https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.163.208.163 , Hong Kong, ASN140683 (STARBOWLTD-AS-AP Starbow Ltd., JP),

Reverse DNS

Software

nginx /

Resource Hash

b3a3c9dc42f394f7d373490eebd925b2b6b9a0679e727a996b6c0bac69838997

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu
Referer: https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=43200
content-encoding: gzip
etag: W/"672488e2-b988a"
expires: Sat, 02 Nov 2024 01:19:59 GMT
date: Fri, 01 Nov 2024 13:19:59 GMT
content-type: application/javascript
last-modified: Fri, 01 Nov 2024 07:53:06 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 85.308e3be95e49c2e36d0d.bundle.js Show response
pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/ 8 KB
3 KB 634ms
634ms Script
application/javascript 103.163.208.163
STARBOWLTD-AS-AP ...

General

Check archive.org

Show headers Download Go to

Full URL

https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/85.308e3be95e49c2e36d0d.bundle.js

Requested by

Host: pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu
URL: https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.163.208.163 , Hong Kong, ASN140683 (STARBOWLTD-AS-AP Starbow Ltd., JP),

Reverse DNS

Software

nginx /

Resource Hash

724d607cbb0fe2e93d7d91f0cf67cdc3bb62bd1ba94263ab98e76162d491b9bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=43200
content-encoding: gzip
etag: W/"672159c8-1e04"
expires: Sat, 02 Nov 2024 01:19:59 GMT
date: Fri, 01 Nov 2024 13:19:59 GMT
content-type: application/javascript
last-modified: Tue, 29 Oct 2024 21:55:20 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 116.34cfd7ff5c594baefb32.bundle.js Show response
pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/ 24 KB
9 KB 632ms
632ms Script
application/javascript 103.163.208.163
STARBOWLTD-AS-AP ...

General

Check archive.org

Show headers Download Go to

Full URL

https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/116.34cfd7ff5c594baefb32.bundle.js

Requested by

Host: pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu
URL: https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.163.208.163 , Hong Kong, ASN140683 (STARBOWLTD-AS-AP Starbow Ltd., JP),

Reverse DNS

Software

nginx /

Resource Hash

11d775e5b4a49b49c652204d0833ae4e62066eef5828d2b5d0de0ebd403923c0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=43200
content-encoding: gzip
etag: W/"672159c8-5f70"
expires: Sat, 02 Nov 2024 01:19:59 GMT
date: Fri, 01 Nov 2024 13:19:59 GMT
content-type: application/javascript
last-modified: Tue, 29 Oct 2024 21:55:20 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 main.e5d40a8392a4d99d035b.bundle.js Show response
pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/ 83 KB
32 KB 633ms
632ms Script
application/javascript 103.163.208.163
STARBOWLTD-AS-AP ...

General

Check archive.org

Show headers Download Go to

Full URL

https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/main.e5d40a8392a4d99d035b.bundle.js

Requested by

Host: pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu
URL: https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.163.208.163 , Hong Kong, ASN140683 (STARBOWLTD-AS-AP Starbow Ltd., JP),

Reverse DNS

Software

nginx /

Resource Hash

ec7a982f96b984f024f24b436502a953268d56b21a165f6ef10888ef9f8bef54

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=43200
content-encoding: gzip
etag: W/"672488e2-14bc7"
expires: Sat, 02 Nov 2024 01:19:59 GMT
date: Fri, 01 Nov 2024 13:19:59 GMT
content-type: application/javascript
last-modified: Fri, 01 Nov 2024 07:53:06 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 crypto.worker.89a5873c7d8f5cf0cbcd.chunk.js Show response
pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/ 24 KB
10 KB 210ms
209ms Fetch
application/javascript 103.163.208.163
STARBOWLTD-AS-AP ...

General

Check archive.org

Show headers Download Go to

Full URL

https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/crypto.worker.89a5873c7d8f5cf0cbcd.chunk.js

Requested by

Host: pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu
URL: https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/main.e5d40a8392a4d99d035b.bundle.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.163.208.163 , Hong Kong, ASN140683 (STARBOWLTD-AS-AP Starbow Ltd., JP),

Reverse DNS

Software

nginx /

Resource Hash

dee9c912e88d1a3cfabef968a24c3b7704b60be59cc8f472db0f8d76fbe4b0be

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=43200
content-encoding: gzip
etag: W/"672488e2-5e2f"
expires: Sat, 02 Nov 2024 01:20:00 GMT
date: Fri, 01 Nov 2024 13:20:00 GMT
content-type: application/javascript
last-modified: Fri, 01 Nov 2024 07:53:06 GMT
server: nginx
vary: Accept-Encoding

GET mtproto.worker.924294a18bb67d1055db.chunk.js
pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/ 0
0

GET
H2 200 favicon.ico
pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/assets/img/ 15 KB
15 KB 209ms
209ms Other
image/x-icon 103.163.208.163
STARBOWLTD-AS-AP ...

General

Check archive.org

Show headers Download Go to

Full URL

https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/assets/img/favicon.ico?v=jw3mK7G9Ry

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.163.208.163 , Hong Kong, ASN140683 (STARBOWLTD-AS-AP Starbow Ltd., JP),

Reverse DNS

Software

nginx /

Resource Hash

7e2388ec283fe17472ef02829a93da550af8f3ad4a975f50a0110bff61afe523

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/

Response headers

strict-transport-security: max-age=31536000
etag: "657ecc64-3aee"
accept-ranges: bytes
content-length: 15086
date: Fri, 01 Nov 2024 13:20:00 GMT
content-type: image/x-icon
last-modified: Sun, 17 Dec 2023 10:24:36 GMT
server: nginx

GET crypto.worker.89a5873c7d8f5cf0cbcd.chunk.js
pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/ 0
0

GET
H2 200 104.b23fc99c0ad8aab75e1a.chunk.js Show response
pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/ 69 KB
23 KB 210ms
209ms Script
application/javascript 103.163.208.163
STARBOWLTD-AS-AP ...

General

Check archive.org

Show headers Download Go to

Full URL

https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/104.b23fc99c0ad8aab75e1a.chunk.js

Requested by

Host: pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu
URL: https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/main.e5d40a8392a4d99d035b.bundle.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.163.208.163 , Hong Kong, ASN140683 (STARBOWLTD-AS-AP Starbow Ltd., JP),

Reverse DNS

Software

nginx /

Resource Hash

01e3e93f0c28761d227195423db2f66c2a7eba747a95b559c7ca0e5ea6d84b57

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=43200
content-encoding: gzip
etag: W/"672159c8-1158d"
expires: Sat, 02 Nov 2024 01:20:00 GMT
date: Fri, 01 Nov 2024 13:20:00 GMT
content-type: application/javascript
last-modified: Tue, 29 Oct 2024 21:55:20 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 301.057f4a981945e824c78f.chunk.js Show response
pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/ 2 KB
1 KB 210ms
210ms Script
application/javascript 103.163.208.163
STARBOWLTD-AS-AP ...

General

Check archive.org

Show headers Download Go to

Full URL

https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/301.057f4a981945e824c78f.chunk.js

Requested by

Host: pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu
URL: https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/main.e5d40a8392a4d99d035b.bundle.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.163.208.163 , Hong Kong, ASN140683 (STARBOWLTD-AS-AP Starbow Ltd., JP),

Reverse DNS

Software

nginx /

Resource Hash

cdbcb6292e07ba83febf941b3358849207493bc6e8f80a41817eb93dec0a19fd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=43200
content-encoding: gzip
etag: W/"672159c8-6fe"
expires: Sat, 02 Nov 2024 01:20:00 GMT
date: Fri, 01 Nov 2024 13:20:00 GMT
content-type: application/javascript
last-modified: Tue, 29 Oct 2024 21:55:20 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 8.f400704066ccf1976603.chunk.js Show response
pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/ 24 KB
5 KB 211ms
211ms Script
application/javascript 103.163.208.163
STARBOWLTD-AS-AP ...

General

Check archive.org

Show headers Download Go to

Full URL

https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/8.f400704066ccf1976603.chunk.js

Requested by

Host: pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu
URL: https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/main.e5d40a8392a4d99d035b.bundle.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.163.208.163 , Hong Kong, ASN140683 (STARBOWLTD-AS-AP Starbow Ltd., JP),

Reverse DNS

Software

nginx /

Resource Hash

138d20dde55ea86511bff53e7b1fe7c2e6b4cf068e2870c11fb574536f1a3938

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=43200
content-encoding: gzip
etag: W/"672159c8-5e90"
expires: Sat, 02 Nov 2024 01:20:00 GMT
date: Fri, 01 Nov 2024 13:20:00 GMT
content-type: application/javascript
last-modified: Tue, 29 Oct 2024 21:55:20 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 41.6ab156a3a39d7a08893f.chunk.js Show response
pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/ 35 KB
16 KB 210ms
210ms Script
application/javascript 103.163.208.163
STARBOWLTD-AS-AP ...

General

Check archive.org

Show headers Download Go to

Full URL

https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/41.6ab156a3a39d7a08893f.chunk.js

Requested by

Host: pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu
URL: https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/main.e5d40a8392a4d99d035b.bundle.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.163.208.163 , Hong Kong, ASN140683 (STARBOWLTD-AS-AP Starbow Ltd., JP),

Reverse DNS

Software

nginx /

Resource Hash

b2508b04b3bef5275419629c0e3f1f01df2cf69c6c97c245373f49317a1a3b73

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=43200
content-encoding: gzip
etag: W/"672159c8-8d61"
expires: Sat, 02 Nov 2024 01:20:01 GMT
date: Fri, 01 Nov 2024 13:20:01 GMT
content-type: application/javascript
last-modified: Tue, 29 Oct 2024 21:55:20 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 480.e548ea77058f9dac9735.chunk.js Show response
pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/ 1 MB
475 KB 212ms
212ms Script
application/javascript 103.163.208.163
STARBOWLTD-AS-AP ...

General

Check archive.org

Show headers Download Go to

Full URL

https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/480.e548ea77058f9dac9735.chunk.js

Requested by

Host: pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu
URL: https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/main.e5d40a8392a4d99d035b.bundle.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.163.208.163 , Hong Kong, ASN140683 (STARBOWLTD-AS-AP Starbow Ltd., JP),

Reverse DNS

Software

nginx /

Resource Hash

a5f7efab411bf842717576412603ebcdf5401ad6785e6f6b955b43d11b416ac6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=43200
content-encoding: gzip
etag: W/"672159c8-16d484"
expires: Sat, 02 Nov 2024 01:20:01 GMT
date: Fri, 01 Nov 2024 13:20:01 GMT
content-type: application/javascript
last-modified: Tue, 29 Oct 2024 21:55:20 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 709.ae8e0000f4edcfe60aba.chunk.js Show response
pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/ 5 KB
3 KB 238ms
237ms Script
application/javascript 103.163.208.163
STARBOWLTD-AS-AP ...

General

Check archive.org

Show headers Download Go to

Full URL

https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/709.ae8e0000f4edcfe60aba.chunk.js

Requested by

Host: pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu
URL: https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/main.e5d40a8392a4d99d035b.bundle.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

103.163.208.163 , Hong Kong, ASN140683 (STARBOWLTD-AS-AP Starbow Ltd., JP),

Reverse DNS

Software

nginx /

Resource Hash

4aed6ee03b7270790b11cd8f6f8100e3aa9894dc8f719f80fb25329eb90c8d7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=43200
content-encoding: gzip
etag: W/"672159c8-148d"
expires: Sat, 02 Nov 2024 01:20:01 GMT
date: Fri, 01 Nov 2024 13:20:01 GMT
content-type: application/javascript
last-modified: Tue, 29 Oct 2024 21:55:20 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 npm.qr-code-styling.f8f57a1c721e03c3f699.chunk.js Show response
pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/ 64 KB
0 212ms
212ms Script
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL

https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/npm.qr-code-styling.f8f57a1c721e03c3f699.chunk.js

Requested by

Host: pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu
URL: https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/main.e5d40a8392a4d99d035b.bundle.js

Protocol

Server

-, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

932e9a817af82373fc18ab3c39ad1bbc706d3b4e5979407c0ad4f5320b099136

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=43200
content-encoding: gzip
etag: W/"657ecc64-ff4e"
expires: Sat, 02 Nov 2024 01:20:01 GMT
date: Fri, 01 Nov 2024 13:20:01 GMT
content-type: application/javascript
last-modified: Sun, 17 Dec 2023 10:24:36 GMT
server: nginx
vary: Accept-Encoding

GET 310341da-2e21-44e3-b79c-a54972841ba1
https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/ 0
0

GET fab907f8-add9-45c0-9e6b-198367878eb8
https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/ 0
0

GET a97dcf5e-9558-40ec-a9e1-5a2b2a1a41f2
https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/ 0
0

GET
H2 200 logo_padded.svg Show response
pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/assets/img/ 1 KB
0 210ms
210ms Fetch
image/svg+xml

General

Check archive.org

Show headers Download Go to

Full URL

https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/assets/img/logo_padded.svg

Requested by

Host: pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu
URL: https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/709.ae8e0000f4edcfe60aba.chunk.js

Protocol

Server

-, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

eeb79b0ae5da35d3433de6edeec3a0e3cce9c24f517dbad26ed97e852666c8f4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
etag: W/"657ecc64-42d"
date: Fri, 01 Nov 2024 13:20:03 GMT
content-type: image/svg+xml
last-modified: Sun, 17 Dec 2023 10:24:36 GMT
server: nginx
vary: Accept-Encoding

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: eeb79b0ae5da35d3433de6edeec3a0e3cce9c24f517dbad26ed97e852666c8f4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml;charset=utf-8

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu
URL: https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/mtproto.worker.924294a18bb67d1055db.chunk.js

Domain: pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu
URL: https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/crypto.worker.89a5873c7d8f5cf0cbcd.chunk.js

Domain: pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu
URL: blob:https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/310341da-2e21-44e3-b79c-a54972841ba1

Domain: pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu
URL: blob:https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/fab907f8-add9-45c0-9e6b-198367878eb8

Domain: pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu
URL: blob:https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/a97dcf5e-9558-40ec-a9e1-5a2b2a1a41f2

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Telegram (Instant Messenger)

56 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			goo.su/	1970-01-21 00:42:14	Name: XSRF-TOKEN Value: eyJpdiI6InpvMjJBNktCb0tES3JYc0o4RzVJYXc9PSIsInZhbHVlIjoiZjQ2SCthb2htM0loYkdNTjJIbk1rWlFJYmpZSmw0QlJZaWFubi9vRXpRT3F1M0hzRTRsbzBlc2Y5OVdaa003ek5LSitIMmoxWU5PcUlFVGlVYmZlcHFvcHk5UUh2UldwZGpxalNYaytpMTUwVkFsenlrS245bVlWaGp4eVpGYzYiLCJtYWMiOiIyNjAxNWQ3MWIwNmEwNjUzN2Y4MmQxZDMxNzI1NjcwMGM5YzUyOTQ1YjY2MjYzYWZlODlkZmNmMWIxYTgwN2ZiIiwidGFnIjoiIn0%3D
			goo.su/	1970-01-21 00:42:14	Name: goosu_session Value: eyJpdiI6IjRoRGRTT2swYVBFNitzRGQwWEN1RkE9PSIsInZhbHVlIjoiZnhRQzRUMDdOV25pb1NsOElpUzlDVWdGMHdYNE1heXQ2bkJYSWRtUEtybWdoN0twdk9aZFkvczhiM1lVcHVmbC9xVUYvanhCamZNNDRnT0FTbmNVdno3OHBhSTg4bnA5NFRPbVJCMkdUQW96bXpxa0RvbW1IOEhrQXFtZWJoaUsiLCJtYWMiOiI5OTUwYjMyYmVhYzI1YmFkM2FlNmFkY2QwMjJiNzk2ZTRiY2MwOTExZTVmM2MzNjVlZGViYjI3MzExYjJkYjk1IiwidGFnIjoiIn0%3D

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	warning	URL: https://pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu/(Line 2) Message: [GroupMarkerNotSet(crbug.com/242999)!:A0203D0284020000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

goo.su
pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu
pp.tggname.icu
pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu
103.163.208.163
2606:4700:3036::ac43:8b69
01e3e93f0c28761d227195423db2f66c2a7eba747a95b559c7ca0e5ea6d84b57
11d775e5b4a49b49c652204d0833ae4e62066eef5828d2b5d0de0ebd403923c0
138d20dde55ea86511bff53e7b1fe7c2e6b4cf068e2870c11fb574536f1a3938
216ac2ed4fb401b782b3aedec58fa3011db42a583f7c0f3b3cfe2a677cf5bb99
322deb24d6d5efcf38e98818033dc373a21e67a4535703a0bae2772b13d9f5ce
4aed6ee03b7270790b11cd8f6f8100e3aa9894dc8f719f80fb25329eb90c8d7a
724d607cbb0fe2e93d7d91f0cf67cdc3bb62bd1ba94263ab98e76162d491b9bf
7e2388ec283fe17472ef02829a93da550af8f3ad4a975f50a0110bff61afe523
932e9a817af82373fc18ab3c39ad1bbc706d3b4e5979407c0ad4f5320b099136
a5f7efab411bf842717576412603ebcdf5401ad6785e6f6b955b43d11b416ac6
b2508b04b3bef5275419629c0e3f1f01df2cf69c6c97c245373f49317a1a3b73
b3a3c9dc42f394f7d373490eebd925b2b6b9a0679e727a996b6c0bac69838997
cdbcb6292e07ba83febf941b3358849207493bc6e8f80a41817eb93dec0a19fd
d01eecccba816ca6c355ae79567a59865ab13ef76d6f3bb75f9682048ae4deb8
dee9c912e88d1a3cfabef968a24c3b7704b60be59cc8f472db0f8d76fbe4b0be
ec7a982f96b984f024f24b436502a953268d56b21a165f6ef10888ef9f8bef54
eeb79b0ae5da35d3433de6edeec3a0e3cce9c24f517dbad26ed97e852666c8f4

pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu Open in urlscan Pro 103.163.208.163 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

22 Requests

68 %HTTPS

50 %IPv6

3 Domains

3 Subdomains

2 IPs

2 Countries

887 kBTransfer

2974 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

22 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

56 JavaScript Global Variables

2 Cookies

1 Console Messages

Security Headers

Indicators

pp.t-uo-i-i-i-i-i-i-i-i-i-i.icu Open in urlscan Pro
103.163.208.163 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

22
Requests

68 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

887 kB
Transfer

2974 kB
Size

2
Cookies

22 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!