URL: https://laclus.shop/militran
Submission Tags: @phish_report
Submission: On August 28 via api from FI — Scanned from FI

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 11 HTTP transactions. The main IP is 172.67.169.45, located in United States and belongs to CLOUDFLARENET, US. The main domain is laclus.shop.
TLS certificate: Issued by WE1 on August 14th 2024. Valid for: 3 months.
This is the only time laclus.shop was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Telegram (Instant Messenger)

Domain & IP information

IP Address AS Autonomous System
11 172.67.169.45 13335 (CLOUDFLAR...)
11 2
Apex Domain
Subdomains
Transfer
11 laclus.shop
laclus.shop
170 KB
11 1
Domain Requested by
11 laclus.shop laclus.shop
11 1

This site contains links to these domains. Also see Links.

Domain
telegram.org
Subject Issuer Validity Valid
laclus.shop
WE1
2024-08-14 -
2024-11-12
3 months crt.sh

This page contains 1 frames:

Primary Page: https://laclus.shop/militran
Frame ID: E51978FB49B2C30A53F7A3914C135EEA
Requests: 12 HTTP requests in this frame

Screenshot

Page Title

Тебе понравится

Detected technologies

Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Page Statistics

11
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

170 kB
Transfer

566 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request militran
laclus.shop/
105 KB
27 KB
Document
General
Full URL
https://laclus.shop/militran
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.169.45 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3fd05b9010bb92c0129576276fb5f3eb1ae731f5ced1adba07a6c9a052bf4d98

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8ba7d6e42a10c918-KBP
content-encoding
br
content-type
text/html; charset=UTF-8
date
Wed, 28 Aug 2024 22:46:49 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=z5flZ65cuuMjHp7yB5e6yg9RecaGq6cFSNHHCSjtvqiakudlGXMc6KmjIdfJmIR7Pc4RU4ztVQn5SwGhuDaiJrgBmL9FXh02HHfow9M%2B7O%2FO25HfoOfaXO%2BqL60J1Q%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
font-roboto.css
laclus.shop/css/
6 KB
1 KB
Stylesheet
General
Full URL
https://laclus.shop/css/font-roboto.css
Requested by
Host: laclus.shop
URL: https://laclus.shop/militran
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.169.45 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7dc681d034591a7547af531a6c9d5a757a37179f9d9796db25a990a510e51182

Request headers

Referer
https://laclus.shop/militran
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date
Wed, 28 Aug 2024 22:46:49 GMT
content-encoding
gzip
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
6846
alt-svc
h3=":443"; ma=86400
content-length
635
last-modified
Sun, 24 Mar 2024 16:08:58 GMT
server
cloudflare
etag
"1783-6146a4640ba80-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S3GXH9lkH5Csw6Uy8%2B7Ujs0YCYn16Xj3eC3b2yUNDVABjsXw55gRdqOeOVjzbxS%2FiZUS6OH%2FMH508aV7yHLkiOa2dUR%2FWuuNzTzbYbKy7rq0fuQL6e04zd9Resh%2Byg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
8ba7d6ef693cc918-KBP
bootstrap.min.css
laclus.shop/css/
42 KB
8 KB
Stylesheet
General
Full URL
https://laclus.shop/css/bootstrap.min.css
Requested by
Host: laclus.shop
URL: https://laclus.shop/militran
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.169.45 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f1d083ffaa644c708f11db29707aa57c19246e6d32643b03fee3f82c17b224b3

Request headers

Referer
https://laclus.shop/militran
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date
Wed, 28 Aug 2024 22:46:49 GMT
content-encoding
gzip
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
6846
alt-svc
h3=":443"; ma=86400
content-length
8013
last-modified
Sun, 24 Mar 2024 16:08:58 GMT
server
cloudflare
etag
"a61b-6146a4640ba80-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aHMTscIdOOVkcdMDVhq%2FpbLK%2BWWM4INPwOLD8relv3gpHBFOHcpqxBcocJR3az8tQtk%2FDt5DHKUzt5BO2SklsWGNLm8%2FGgTfSDnrWZFY6d3XWesZOfeUd4tV70CuFg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
8ba7d6ef693dc918-KBP
telegram.css
laclus.shop/css/
112 KB
22 KB
Stylesheet
General
Full URL
https://laclus.shop/css/telegram.css
Requested by
Host: laclus.shop
URL: https://laclus.shop/militran
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.169.45 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
05372aaccd083e2890a25e6d5cb09c8a46a3d4084bf7b9b8f48cf0e86f73e9b5

Request headers

Referer
https://laclus.shop/militran
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date
Wed, 28 Aug 2024 22:46:49 GMT
content-encoding
gzip
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
6846
alt-svc
h3=":443"; ma=86400
content-length
22377
last-modified
Sun, 24 Mar 2024 16:09:22 GMT
server
cloudflare
etag
"1c126-6146a47aef080-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QN5v9VtzK%2F2UX3HDwNTjNkMDkd9wWcNadjPjau%2F7ckRJ9SNSV6O6hbB%2FQNc%2B6nEXdBD3D%2B5%2Bnzf4tYYqZL1qT%2FRmQ2brpC5LD78j4QAr%2FMhI%2B4pjH9FTYkcyMDtg3Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
8ba7d6ef693fc918-KBP
truncated
/
24 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
255b7b9a7d050386f43689d136bf4cabce6f13ba158c162d5b3d54c2803a7dc1

Request headers

Referer
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

Content-Type
image/jpeg
tgwallpaper.min.js
laclus.shop/js/
3 KB
2 KB
Script
General
Full URL
https://laclus.shop/js/tgwallpaper.min.js
Requested by
Host: laclus.shop
URL: https://laclus.shop/militran
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.169.45 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2031e418ee10af8110729b3f327b968462fc0a9d8d1da095387bb472ccd0dee6

Request headers

Referer
https://laclus.shop/militran
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date
Wed, 28 Aug 2024 22:46:49 GMT
content-encoding
gzip
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
6846
alt-svc
h3=":443"; ma=86400
content-length
1477
last-modified
Sun, 24 Mar 2024 16:08:57 GMT
server
cloudflare
etag
"ba3-6146a46317840-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I8OhIcdOFKAtb16uH6KHMeAVzD1oqo8lNQ0UF1lJpDk5QRocjl0eZ18CWstNpzfgUNPdk7gCWaR8rnQQXAJ6ql2eXMwy4XJlxjUgYzPQ0sLqGI5kdx1kKGHKwY2L%2BQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
8ba7d6ef6942c918-KBP
pattern.svg
laclus.shop/fonts/
226 KB
69 KB
Image
General
Full URL
https://laclus.shop/fonts/pattern.svg
Requested by
Host: laclus.shop
URL: https://laclus.shop/css/telegram.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.169.45 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
118add53487c02aaf5b5ab9f69380fa06717deb10492e14aaa487e3c62806ad4

Request headers

Referer
https://laclus.shop/css/telegram.css
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date
Wed, 28 Aug 2024 22:46:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sun, 24 Mar 2024 16:09:22 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
6845
etag
W/"3891a-6146a47aef080"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HppZAMiyz3obF30tyIqTPHtCXfVG3oo7Q72ETjd1Gly0jrOzaiYtum68pe4qmOG74BqwCA%2Bojo2liC%2B2LevYGkQ46bPJNx64TLh7wuzopTmeKoU2Y2Si5ILwp7Wr3A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/svg+xml
cache-control
max-age=14400
cf-ray
8ba7d6f03a2bc918-KBP
alt-svc
h3=":443"; ma=86400
KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
laclus.shop/fonts/
11 KB
11 KB
Font
General
Full URL
https://laclus.shop/fonts/KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
Requested by
Host: laclus.shop
URL: https://laclus.shop/css/font-roboto.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.169.45 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0f53e8b0a717ca4ce313eec62b90d41db62c2f4946259a65c93bf8e84c5b0c44

Request headers

Referer
https://laclus.shop/css/font-roboto.css
Origin
https://laclus.shop
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date
Wed, 28 Aug 2024 22:46:49 GMT
cf-cache-status
HIT
last-modified
Sun, 24 Mar 2024 16:09:22 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
6532
etag
"2b20-6146a47aef080"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FCZFOrx1a9qAxQB3UqE9bFeI7LpXxg2j%2B1YgfhcXwptNZ%2Fvwm%2BIUBiLcx6tRs7joSm%2Bgj5jNCPFNGi65leUiIsBwVZ05Qxy4ZTWdn9sIrOWo6RsArI9L1M59p64ETQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
font/woff2
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
8ba7d6f06a54c918-KBP
alt-svc
h3=":443"; ma=86400
content-length
11040
KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
laclus.shop/fonts/
11 KB
11 KB
Font
General
Full URL
https://laclus.shop/fonts/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
Requested by
Host: laclus.shop
URL: https://laclus.shop/css/font-roboto.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.169.45 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
796de064b8d80eba7ccacb8ba67d77fdbcdf4b385c844645d452c24537b3108f

Request headers

Referer
https://laclus.shop/css/font-roboto.css
Origin
https://laclus.shop
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date
Wed, 28 Aug 2024 22:46:49 GMT
cf-cache-status
HIT
last-modified
Sun, 24 Mar 2024 16:09:22 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
6532
etag
"2b14-6146a47aef080"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4O20FJQRW5fOQpJja46IpDi%2FUOWPQM%2Fxb0yw%2Flqzbm8Z5av2zBG0Fai7Cz%2B%2Bybn9Jpdexx3NP6RMcj0fTzH61jslTBB3Zmj4odokgA0MrUidT2w51kN0%2BWD%2B%2F5qTTQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
font/woff2
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
8ba7d6f06a57c918-KBP
alt-svc
h3=":443"; ma=86400
content-length
11028
KFOlCnqEu92Fr1MmWUlfABc4AMP6lbBP.woff2
laclus.shop/fonts/
6 KB
7 KB
Font
General
Full URL
https://laclus.shop/fonts/KFOlCnqEu92Fr1MmWUlfABc4AMP6lbBP.woff2
Requested by
Host: laclus.shop
URL: https://laclus.shop/css/font-roboto.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.169.45 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2f662599cf4323a18b4f7da381a998a8873c0277fff2d866336f7ee943a102d6

Request headers

Referer
https://laclus.shop/css/font-roboto.css
Origin
https://laclus.shop
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date
Wed, 28 Aug 2024 22:46:49 GMT
cf-cache-status
HIT
last-modified
Sun, 24 Mar 2024 16:09:22 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1553
etag
"19dc-6146a47aef080"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BBSu%2FNIoMRvjHureAQ2fXIQcz8opYv2eJ%2BQ%2Fk2fX7DIsp1XZT6Gp7NhHCxqnODay5DrYCRhJZ%2BooUCPzxfGLJDd%2BTqt%2FSTV9e4o9u%2FgMar4DVMNlKXRSD21izKMSxw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
font/woff2
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
8ba7d6f06a58c918-KBP
alt-svc
h3=":443"; ma=86400
content-length
6620
KFOmCnqEu92Fr1Mu5mxKKTU1Kvnz.woff2
laclus.shop/fonts/
6 KB
7 KB
Font
General
Full URL
https://laclus.shop/fonts/KFOmCnqEu92Fr1Mu5mxKKTU1Kvnz.woff2
Requested by
Host: laclus.shop
URL: https://laclus.shop/css/font-roboto.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.169.45 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
41b5c3b25f4258190937deb900fa57a6db6d450ce7dd2af2259af760119a1c41

Request headers

Referer
https://laclus.shop/css/font-roboto.css
Origin
https://laclus.shop
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date
Wed, 28 Aug 2024 22:46:49 GMT
cf-cache-status
HIT
last-modified
Sun, 24 Mar 2024 16:09:22 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
6531
etag
"193c-6146a47aef080"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b3fKvb1TTLgkt4UXG6fSZnpnvsSfjbzpmkCvv5DSBd8r8uO5eoX27t9vlJVV8UsYv%2Frq%2Fda0YKrk4QFIYmt6f6UnLIGUqHRJ9u80xX5T%2BPP3GhSzJSh0ePDs3jogSw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
font/woff2
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
8ba7d6f06a59c918-KBP
alt-svc
h3=":443"; ma=86400
content-length
6460
favicon.ico
laclus.shop/
15 KB
4 KB
Other
General
Full URL
https://laclus.shop/favicon.ico
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.169.45 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7e2388ec283fe17472ef02829a93da550af8f3ad4a975f50a0110bff61afe523

Request headers

Referer
https://laclus.shop/militran
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date
Wed, 28 Aug 2024 22:46:49 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 23 Mar 2024 08:06:26 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
6845
etag
W/"3aee-6144f6abce480"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=s%2Fhs8HSL8xiTV5v0CNLuIOO7PzD0yvd%2ByYYqZOln67NItpydgpJsret30jmbcaEvB21xTfmF6AcObDKv5WrDA3A2K%2F4WUK6qtOn7M7h1E84PQNrZre1Z68l6wf%2B4eQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/vnd.microsoft.icon
cache-control
max-age=14400
cf-ray
8ba7d6f16ba7c918-KBP
alt-svc
h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Telegram (Instant Messenger)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| TWallpaper object| tme_bg function| toggleTheme object| darkMedia

0 Cookies

1 Console Messages

Source Level URL
Text
network error URL: https://laclus.shop/militran
Message:
Failed to load resource: the server responded with a status of 404 ()