urlscan.io logo urlscan.io
SecurityTrails logo

monacoteam.store Open in urlscan Pro
91.235.142.233  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://monacoteam.store/
Submission: On February 08 via api from US — Scanned from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 8 HTTP transactions. The main IP is 91.235.142.233, located in Kyiv, Ukraine and belongs to YURTEH-AS, UA. The main domain is monacoteam.store.
This is the only time monacoteam.store was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Telegram (Instant Messenger)

Domain & IP information

IP Address AS Autonomous System
7 91.235.142.233 30860 (YURTEH-AS)
1 2a03:2880:f01... 32934 (FACEBOOK)
8 2
Apex Domain
Subdomains		 Transfer
7 monacoteam.store
monacoteam.store
705 KB
1 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 171
58 KB
8 2
Domain Requested by
7 monacoteam.store monacoteam.store
1 connect.facebook.net monacoteam.store
8 2

This site contains links to these domains. Also see Links.

Domain
telegram.org
Subject Issuer Validity Valid
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2023-11-17 -
2024-02-15		 3 months crt.sh

This page contains 1 frames:

Primary Page: http://monacoteam.store/
Frame ID: 0EFBEFE8922D4DF3074055D368BA9BBB
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Telegram: Join Group Chat

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Page Statistics

8
Requests

13 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

763 kB
Transfer

917 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
monacoteam.store/ 		10 KB
10 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://monacoteam.store/
Protocol
HTTP/1.1
Server
91.235.142.233 Kyiv, Ukraine, ASN30860 (YURTEH-AS, UA),
Reverse DNS
hosted.by.specialrdp
Software
nginx /
Resource Hash
a907d368fa4ed4e8cbb8fc57f8434f22f361d787d03a79b4559c2a7c63eed939

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

Cache-Control
no-store, no-cache, must-revalidate
Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Date
Thu, 08 Feb 2024 15:25:14 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Pragma
no-cache
Server
nginx
Transfer-Encoding
chunked
bootstrap.min.css
monacoteam.store/css/ 		42 KB
42 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://monacoteam.store/css/bootstrap.min.css
Requested by
Host: monacoteam.store
URL: http://monacoteam.store/
Protocol
HTTP/1.1
Server
91.235.142.233 Kyiv, Ukraine, ASN30860 (YURTEH-AS, UA),
Reverse DNS
hosted.by.specialrdp
Software
nginx /
Resource Hash
f1d083ffaa644c708f11db29707aa57c19246e6d32643b03fee3f82c17b224b3

Request headers

accept-language
en-US,en;q=0.9
Referer
http://monacoteam.store/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

Date
Thu, 08 Feb 2024 15:25:14 GMT
Last-Modified
Mon, 03 Apr 2023 03:18:48 GMT
Server
nginx
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
42523
Content-Type
text/css
telegram.css
monacoteam.store/css/ 		111 KB
111 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://monacoteam.store/css/telegram.css
Requested by
Host: monacoteam.store
URL: http://monacoteam.store/
Protocol
HTTP/1.1
Server
91.235.142.233 Kyiv, Ukraine, ASN30860 (YURTEH-AS, UA),
Reverse DNS
hosted.by.specialrdp
Software
nginx /
Resource Hash
c8d12f28131e26b35b7836c9b9d23cff92d7154f76e7ea2b699fd01e2ca8ff9e

Request headers

accept-language
en-US,en;q=0.9
Referer
http://monacoteam.store/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

Date
Thu, 08 Feb 2024 15:25:14 GMT
Last-Modified
Thu, 01 Feb 2024 20:15:06 GMT
Server
nginx
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
113849
Content-Type
text/css
refaunt.jpg
monacoteam.store/photo/ 		190 KB
190 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://monacoteam.store/photo/refaunt.jpg
Requested by
Host: monacoteam.store
URL: http://monacoteam.store/
Protocol
HTTP/1.1
Server
91.235.142.233 Kyiv, Ukraine, ASN30860 (YURTEH-AS, UA),
Reverse DNS
hosted.by.specialrdp
Software
nginx /
Resource Hash
2f0ff83a6fe8eefc214e09561634f3f8c8bff96cf381cafeae8e045cf05d208f

Request headers

accept-language
en-US,en;q=0.9
Referer
http://monacoteam.store/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

Date
Thu, 08 Feb 2024 15:25:14 GMT
Last-Modified
Fri, 02 Feb 2024 19:37:40 GMT
Server
nginx
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
194158
Content-Type
image/jpeg
verif.svg
monacoteam.store/svg/ 		978 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://monacoteam.store/svg/verif.svg
Requested by
Host: monacoteam.store
URL: http://monacoteam.store/
Protocol
HTTP/1.1
Server
91.235.142.233 Kyiv, Ukraine, ASN30860 (YURTEH-AS, UA),
Reverse DNS
hosted.by.specialrdp
Software
nginx /
Resource Hash
77c7245862717d06e6aed1bb0804aa07959e081c9e50a6ee51fcceeda6a66fb0

Request headers

accept-language
en-US,en;q=0.9
Referer
http://monacoteam.store/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

Date
Thu, 08 Feb 2024 15:25:14 GMT
Last-Modified
Mon, 03 Apr 2023 03:18:48 GMT
Server
nginx
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
978
Content-Type
image/svg+xml
fbevents.js
connect.facebook.net/en_US/ 		214 KB
58 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: monacoteam.store
URL: http://monacoteam.store/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f012:8:face:b00c:0:1 Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
bca51ed2fe251488a1b150edf560d43880f1486740f34d24120ede486f99676b
Security Headers
Name Value
Content-Security-Policy default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
en-US,en;q=0.9
Referer
http://monacoteam.store/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

permissions-policy-report-only
autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=();report-to="permissions_policy"
content-security-policy
default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Thu, 08 Feb 2024 15:25:14 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
57257
x-xss-protection
0
reporting-endpoints
coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
pragma
public
x-fb-debug
jQVVdStU9CEj/98sBwcLNzAH3Qq7ZKm/5FlHFJ3aIXFfc7ppdlbXvFcVINR1NvE7961UCxDcJA8AgPRPz23mFQ==
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
cross-origin-opener-policy
same-origin-allow-popups;report-to="coop_report"
vary
Accept-Encoding
report-to
{"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type
application/x-javascript; charset=utf-8
x-frame-options
DENY
cache-control
public, max-age=1200
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=();report-to="permissions_policy"
timing-allow-origin
*
expires
Sat, 01 Jan 2000 00:00:00 GMT
background.svg
monacoteam.store/svg/ 		124 KB
124 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://monacoteam.store/svg/background.svg
Requested by
Host: monacoteam.store
URL: http://monacoteam.store/css/telegram.css
Protocol
HTTP/1.1
Server
91.235.142.233 Kyiv, Ukraine, ASN30860 (YURTEH-AS, UA),
Reverse DNS
hosted.by.specialrdp
Software
nginx /
Resource Hash
5514ab2c931a9da74904b0788076bff9e6ba28f0cc42db7aceb518c75c2bb554

Request headers

accept-language
en-US,en;q=0.9
Referer
http://monacoteam.store/css/telegram.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

Date
Thu, 08 Feb 2024 15:25:15 GMT
Last-Modified
Mon, 03 Apr 2023 03:18:48 GMT
Server
nginx
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
126652
Content-Type
image/svg+xml
pattern.svg
monacoteam.store/svg/ 		226 KB
226 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://monacoteam.store/svg/pattern.svg
Requested by
Host: monacoteam.store
URL: http://monacoteam.store/css/telegram.css
Protocol
HTTP/1.1
Server
91.235.142.233 Kyiv, Ukraine, ASN30860 (YURTEH-AS, UA),
Reverse DNS
hosted.by.specialrdp
Software
nginx /
Resource Hash
118add53487c02aaf5b5ab9f69380fa06717deb10492e14aaa487e3c62806ad4

Request headers

Referer
http://monacoteam.store/css/telegram.css
Origin
http://monacoteam.store
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

Date
Thu, 08 Feb 2024 15:25:15 GMT
Last-Modified
Mon, 03 Apr 2023 03:18:48 GMT
Server
nginx
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
231706
Content-Type
image/svg+xml

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Telegram (Instant Messenger)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| fbq function| _fbq

1 Cookies

Domain/Path Name / Value
monacoteam.store/ Name: PHPSESSID
Value: 11e0a8151d9740c381e8861db9e1c4b7