urlscan.io logo urlscan.io
SecurityTrails logo

gentelmanclub.online Open in urlscan Pro
104.21.76.135  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://gentelmanclub.online/
Submission: On February 05 via api from US — Scanned from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 1 domains to perform 9 HTTP transactions. The main IP is 104.21.76.135, located in and belongs to CLOUDFLARENET, US. The main domain is gentelmanclub.online.
TLS certificate: Issued by GTS CA 1P5 on February 5th 2024. Valid for: 3 months.
This is the only time gentelmanclub.online was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Telegram (Instant Messenger)

Domain & IP information

IP Address AS Autonomous System
6 104.21.76.135 13335 (CLOUDFLAR...)
3 2606:4700:303... 13335 (CLOUDFLAR...)
9 2
Apex Domain
Subdomains		 Transfer
9 gentelmanclub.online
gentelmanclub.online
167 KB
9 1
Domain Requested by
9 gentelmanclub.online gentelmanclub.online
9 1

This site contains links to these domains. Also see Links.

Domain
telegram.org
Subject Issuer Validity Valid
gentelmanclub.online
GTS CA 1P5		 2024-02-05 -
2024-05-05		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://gentelmanclub.online/
Frame ID: 022546584EB15787D7736372C4AD5AD3
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Telegram: Contact @GentlemanClubRobot

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Page Statistics

9
Requests

100 %
HTTPS

50 %
IPv6

1
Domains

1
Subdomains

2
IPs

2
Countries

167 kB
Transfer

459 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
gentelmanclub.online/ 		11 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://gentelmanclub.online/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.76.135 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f57f1649567867e8e3ae42c8354810240ae6dc02f308a2d566129698b7a32c41

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
850f06dd0973434c-EWR
content-encoding
br
content-type
text/html; charset=utf-8
date
Mon, 05 Feb 2024 23:45:24 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Bur8q7UU8pMR2kLudmObiYnEAuCM%2FdawlZXFKQMzTMQAPncemNJX9a%2BteyCZWBxgg41NS%2FSIYbGEdf6BpFOdPzjAiu%2Fq6wdren05u5IEYMsG%2F1aoFN2T8DGQ3rKdazP4mjeSlDb9Mw%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
font-roboto.css
gentelmanclub.online/assets/ 		6 KB
985 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://gentelmanclub.online/assets/font-roboto.css
Requested by
Host: gentelmanclub.online
URL: https://gentelmanclub.online/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.76.135 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
84b97b3fa8847b64c6d3833561e4b3146530577171e85ad226578a087db70974

Request headers

accept-language
en-US,en;q=0.9
Referer
https://gentelmanclub.online/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Mon, 05 Feb 2024 23:45:24 GMT
content-encoding
br
cf-cache-status
REVALIDATED
last-modified
Mon, 05 Feb 2024 21:03:13 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UdKnWWb%2FqDN0rNtsP7VP36rEvD%2FA2xokKAXShWwBXWZ8RI0Buh0In3%2B6sUagKWdNryCcNjK90RIjzYJY3Noey0G4QUEDQV9g7Iat1dyCwNLwZmC4tod9fjNSJMksrD%2Bm9GhJxd90UQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
cache-control
max-age=14400
cf-ray
850f06e18da0434c-EWR
alt-svc
h3=":443"; ma=86400
bootstrap.min.css
gentelmanclub.online/assets/ 		42 KB
8 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://gentelmanclub.online/assets/bootstrap.min.css
Requested by
Host: gentelmanclub.online
URL: https://gentelmanclub.online/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.76.135 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f1d083ffaa644c708f11db29707aa57c19246e6d32643b03fee3f82c17b224b3

Request headers

accept-language
en-US,en;q=0.9
Referer
https://gentelmanclub.online/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Mon, 05 Feb 2024 23:45:25 GMT
content-encoding
br
cf-cache-status
REVALIDATED
last-modified
Mon, 05 Feb 2024 21:03:13 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5Oum7ne2YyHd1bPm99%2BjM04kqAPs6N%2BaoFCFv%2FgkYQKd4GcHfVdfXvEvdMeTuBDUwfsk3JLln5%2FvKPFzP1imtfa1HIbJ0ljUU7JZ9Il3U5CXrW5KYvJNEf%2FcrfheDyd8BI1PqPZXhw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
cache-control
max-age=14400
cf-ray
850f06e18da2434c-EWR
alt-svc
h3=":443"; ma=86400
telegram.css
gentelmanclub.online/assets/ 		112 KB
23 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://gentelmanclub.online/assets/telegram.css
Requested by
Host: gentelmanclub.online
URL: https://gentelmanclub.online/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.76.135 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
acd326a9263ee8c4cbc757fed46333732a0e3f8f48d398cbd4f8e36a09fdaf76

Request headers

accept-language
en-US,en;q=0.9
Referer
https://gentelmanclub.online/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Mon, 05 Feb 2024 23:45:25 GMT
content-encoding
br
cf-cache-status
REVALIDATED
last-modified
Mon, 05 Feb 2024 21:03:13 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FM4bpA8zMtFz%2BRj%2FJI8YJFz7nQ0FVNWgpoFetGpbzSQoA770hysE4%2BXWKjdAnCymfUSMItRojoj7gsV%2F9OwZkeTeK%2BcFpaYGvUeK0u7TQb5J%2B4yEx%2BDabmJzHe%2BGyB79ltEM8onATA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
cache-control
max-age=14400
cf-ray
850f06e18da4434c-EWR
alt-svc
h3=":443"; ma=86400
Gf7FWYShdh78U777G5CLHxsBl6FjERgjrkFlhHE33_9qF5X0Y_SqErZaGKBBqMzW4vQCkZA9zYYPJ-rbTEI2G7piN8hV9fHIkH0j4qtJ7ENE1xTW5mAT8owodd9h35B9f4xxMwTzajPQCWaoJ7AN6fzXcfh9wKkoeRTVEbiPSefCr4iAwu1xzF2I38gQeLenO.jpg
gentelmanclub.online/assets/ 		37 KB
37 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gentelmanclub.online/assets/Gf7FWYShdh78U777G5CLHxsBl6FjERgjrkFlhHE33_9qF5X0Y_SqErZaGKBBqMzW4vQCkZA9zYYPJ-rbTEI2G7piN8hV9fHIkH0j4qtJ7ENE1xTW5mAT8owodd9h35B9f4xxMwTzajPQCWaoJ7AN6fzXcfh9wKkoeRTVEbiPSefCr4iAwu1xzF2I38gQeLenO.jpg
Requested by
Host: gentelmanclub.online
URL: https://gentelmanclub.online/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.76.135 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
16ce8df18e127f41c15b0fa6d94c24e778204cd06edee75b740cc8860fb40f1b

Request headers

accept-language
en-US,en;q=0.9
Referer
https://gentelmanclub.online/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Mon, 05 Feb 2024 23:45:25 GMT
cf-cache-status
REVALIDATED
last-modified
Mon, 05 Feb 2024 21:03:13 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
11853a9ee381a8e89bf18aca73cc120c
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cJ%2Blqq7iP9Zy2eOqIuMwSl8B%2Fga1vhqO12lcmYgJFrgUp6PkFtXgZFgzK8iaaMbqTW1C9dVG8ttq1DtjiVyzqz%2FSBMZjS5F5rTK5SiKVb9I%2BFtczp%2BNgRf8%2BiWyOotFnQRib7QCong%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
850f06e18da6434c-EWR
alt-svc
h3=":443"; ma=86400
content-length
37906
tgwallpaper.min.js
gentelmanclub.online/assets/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://gentelmanclub.online/assets/tgwallpaper.min.js
Requested by
Host: gentelmanclub.online
URL: https://gentelmanclub.online/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.76.135 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2031e418ee10af8110729b3f327b968462fc0a9d8d1da095387bb472ccd0dee6

Request headers

accept-language
en-US,en;q=0.9
Referer
https://gentelmanclub.online/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Mon, 05 Feb 2024 23:45:25 GMT
content-encoding
br
cf-cache-status
REVALIDATED
last-modified
Mon, 05 Feb 2024 21:03:12 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7UZTpjZqNHKtrIrbqJYYk%2F5msHPYKoTJsdbGMQUjPUGlOHyO7XOzT4eSFBmsRsZ1YB5h68DtgAJU0bfyCjx7khtyVQwjc%2Fkns0%2FFkVd204P1ULVF71c4t%2FY5NWk%2BWI%2BXKU8AvDj5Dw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
850f06e18da7434c-EWR
alt-svc
h3=":443"; ma=86400
pattern.svg
gentelmanclub.online/img/tgme/ 		226 KB
69 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gentelmanclub.online/img/tgme/pattern.svg?1
Requested by
Host: gentelmanclub.online
URL: https://gentelmanclub.online/assets/telegram.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:c3bd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
118add53487c02aaf5b5ab9f69380fa06717deb10492e14aaa487e3c62806ad4

Request headers

Referer
https://gentelmanclub.online/assets/telegram.css
Origin
https://gentelmanclub.online
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Mon, 05 Feb 2024 23:45:25 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Mon, 05 Feb 2024 21:03:13 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VZjBwxGZt7AMB36zLnrzdu2ps4Xtcwq0Ffxwa4V5aQ48WK0VAlamBjQorYCtupzIu8pPf3rrC%2FOQJ5yZuUrNQNEi2zXw%2BZwXXfRMy7yi9u494g5U5ePY7CLPiTWwfrPDHjCCheunay5glHwE7ERAd%2FQNIg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/svg+xml
cache-control
max-age=14400
cf-ray
850f06e38a897cfa-EWR
alt-svc
h3=":443"; ma=86400
KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
gentelmanclub.online/fonts/Roboto/ 		11 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://gentelmanclub.online/fonts/Roboto/KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
Requested by
Host: gentelmanclub.online
URL: https://gentelmanclub.online/assets/font-roboto.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:c3bd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0f53e8b0a717ca4ce313eec62b90d41db62c2f4946259a65c93bf8e84c5b0c44

Request headers

Referer
https://gentelmanclub.online/assets/font-roboto.css
Origin
https://gentelmanclub.online
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Mon, 05 Feb 2024 23:45:25 GMT
cf-cache-status
MISS
last-modified
Mon, 05 Feb 2024 21:03:13 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
c5c7958a86131bcc7ac3b6c618378148
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rn1yd%2FS0nkdDFNFHBMnZFtEdnOdkXh1JnKG%2FzfZG8MqALINDjwdhpTNfZFxTKvXRRdH2qlJ7iDCKGg8zzA25UeYA85%2BgwyNQxzruXf%2BrXhlr%2FkuMTtdvUtP18ZHU8qODwO01MYqHz71btrkQ%2FmTtFh9RnA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
font/woff2
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
850f06e38a8d7cfa-EWR
alt-svc
h3=":443"; ma=86400
content-length
11040
KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
gentelmanclub.online/fonts/Roboto/ 		11 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://gentelmanclub.online/fonts/Roboto/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
Requested by
Host: gentelmanclub.online
URL: https://gentelmanclub.online/assets/font-roboto.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:c3bd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
796de064b8d80eba7ccacb8ba67d77fdbcdf4b385c844645d452c24537b3108f

Request headers

Referer
https://gentelmanclub.online/assets/font-roboto.css
Origin
https://gentelmanclub.online
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date
Mon, 05 Feb 2024 23:45:25 GMT
cf-cache-status
MISS
last-modified
Mon, 05 Feb 2024 21:03:13 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
52c07e7441566a0073b0765621b7125f
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nhAJPCnR6KIaT8gsx8Ll4x%2FKmqLxWGq1%2FFQJQiL3dh6N2BxRxG8p9Foal9LageYzbBddauCpCPI2q1Osd%2BGYSwulptByo8lDvKmLHCEPDNwRS0w9i3Rk%2FK8FMSXV7cmJQggHiXhGMLZMZX9gipwZTSvcfg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
font/woff2
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
850f06e38a8e7cfa-EWR
alt-svc
h3=":443"; ma=86400
content-length
11028

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Telegram (Instant Messenger)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| TWallpaper object| tme_bg function| toggleTheme object| darkMedia

0 Cookies