t.me
2001:67c:4e8:f004::9 Public Scan Open in urlscan Pro

Go To Rescan
Add Verdict Report

Submitted URL:
https://nike-soccer-jersey-authentic-vs-replica.pages.dev/ 1yr old
Effective URL:
https://t.me/Shopybuy 10yr old
Submission: On September 11 via automatic, source certstream-suspicious (September 11th 2026, 6:15:44 pm UTC) — Scanned from DE Go Pro

Only in urlscan Pro

Select different country locations for Private Scans.
Use a global network of additional scanning locations and residential IPs for scanning.
Interact with pages while you are scanning them.
Download files from remote websites.
Scan websites on the Tor Network.

Click for more information

Free trials of urlscan Pro are available.

Summary HTTP 24 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 7 domains to perform 24 HTTP transactions. The main IP is 2001:67c:4e8:f004::9, located in Amsterdam, Netherlands and belongs to Telegram Telegram Messenger Inc, VG. The main domain is t.me. The Cisco Umbrella rank of the primary domain is 11655. 10yr old
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on October 21st 2025. Valid for: 1yr.

This is the only time t.me was scanned on urlscan.io!

urlscan.io Verdict: No classification

Go Pro

Only in urlscan Pro

Use our Phishing URL feed to retrieve phishing pages targeting 3000+ brands in real-time. Set up monitoring and alerts. Use maliciousness scores and AI-powered brand name recognition to hunt for brand impersonation.

Click for more information

Free trials of urlscan Pro are available.

Domain & IP information

	IP Address	AS Autonomous System
1	172.66.47.80 172.66.47.80	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	172.66.44.130 172.66.44.130	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
9	2001:67c:4e8:... 2001:67c:4e8:f004::9	62041 (Telegram ...) (Telegram Telegram Messenger Inc)
1	149.154.165.133 149.154.165.133	62041 (Telegram ...) (Telegram Telegram Messenger Inc)
24	5

1 172.66.47.80 (Ascension Island)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

nike-soccer-jersey-authentic-vs-replica.pages.dev 1yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 172.66.44.130 (Ascension Island)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

enjs.pages.dev 2yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

9 2001:67c:4e8:f004::9 (Amsterdam, Netherlands)

ASN62041 (Telegram Telegram Messenger Inc, VG)

t.me 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools
telegram.org 13yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 149.154.165.133 (Amsterdam, Netherlands)

ASN62041 (Telegram Telegram Messenger Inc, VG)

cdn4.telesco.pe 9yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

	Apex Domain Subdomains	Transfer
8	telegram.org telegram.org — Cisco Umbrella Rank: 7141 13yr old	161 KB
2	pages.dev nike-soccer-jersey-authentic-vs-replica.pages.dev 1yr old enjs.pages.dev 2yr old	4 KB
1	telesco.pe cdn4.telesco.pe — Cisco Umbrella Rank: 35618 9yr old	16 KB
1	t.me t.me — Cisco Umbrella Rank: 11655 10yr old	4 KB
0	Failed function sub() { [native code] }. Failed
0	6v6.work Failed i.6v6.work Failed 4yr old
0	spaceshopping.net Failed poster.spaceshopping.net Failed 2yr old
24	7

	Domain	Requested by
8	telegram.org	t.me telegram.org
1	cdn4.telesco.pe	t.me
1	t.me	nike-soccer-jersey-authentic-vs-replica.pages.dev
1	enjs.pages.dev	nike-soccer-jersey-authentic-vs-replica.pages.dev
1	nike-soccer-jersey-authentic-vs-replica.pages.dev
0	resolve Failed	t.me
0	i.6v6.work Failed	enjs.pages.dev
0	poster.spaceshopping.net Failed	nike-soccer-jersey-authentic-vs-replica.pages.dev
24	8

This site contains links to these domains. Also see Links.

Domain
telegram.org

Subject Issuer	Validity	Valid
nike-soccer-jersey-authentic-vs-replica.pages.dev WE1	`2026-09-11` - `2026-12-10`	3mo	crt.sh
enjs.pages.dev WE1	`2026-08-06` - `2026-11-04`	3mo	crt.sh
*.t.me Go Daddy Secure Certificate Authority - G2	`2025-10-21` - `2026-11-22`	1yr	crt.sh
*.telegram.org GoDaddy TLS Intermediate CA DV - R1v1	`2026-08-25` - `2027-03-11`	7mo	crt.sh
*.telesco.pe Go Daddy Secure Certificate Authority - G2	`2025-11-11` - `2026-12-13`	1yr	crt.sh

This page contains 1 frames:

Primary Page: https://t.me/Shopybuy
Frame ID: F97195F2AFE7A12E90C1A92758DBC9DB
Requests: 24 HTTP requests in this frame

Screenshot Go Pro
Only in urlscan Pro

Use the Visual Search feature to find pages with visually similar screenshots.

Click for more information

Free trials of urlscan Pro are available.

Full Image

Page Title

Telegram: View @Shopybuy

Page URL History Go Pro
Only in urlscan Pro

Search our real-time database of newly observed domains and hostnames. Pivot on different attributes, and setup keyword alerts for newly observed domains.

Click for more information

Free trials of urlscan Pro are available.
Show full URLs

https://nike-soccer-jersey-authentic-vs-replica.pages.dev/ Page URL
https://t.me/Shopybuy Page URL

Detected technologies

Paper.js (JavaScript graphics) Expand

Overall confidence: 100%
Detected patterns

(?:((?:\d+\.)+\d+)\/)?paper(?:-full)?(?:-core)?(?:\.min)?(?:-[\d\w]{0,64})?\.js

Bootstrap (UI frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>-]*?(?:\.min)?\.css

Page Statistics

24
Requests

50 %
HTTPS

25 %
IPv6

7
Domains

8
Subdomains

5
IPs

2
Countries

185 kB
Transfer

468 kB
Size

1
Cookies

2 Outgoing links Go Pro
Only in urlscan Pro

Effortlessly use any on-page link as a pivot to discover other pages pointing to the exact same destination. Seamlessly trace both specific URLs and broader domains to uncover hidden connection networks and map out backlink relationships with ease.

Click for more information

Free trials of urlscan Pro are available.

These are links going to different origins than the main page.

URL: https://telegram.org/

Search URL Search Domain Scan URL

URL: https://telegram.org/dl?tme=98ddbc003e6860db61_10298480447802255283
Title: Download

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://nike-soccer-jersey-authentic-vs-replica.pages.dev/ Page URL
https://t.me/Shopybuy Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

24 HTTP transactions Go Pro
Only in urlscan Pro

Inspect WebSocket connections, examine POST data effortlessly, and track overlap counts in real time. Features live search and filtering across all HTTP output, complete with full response metadata for deep analysis.

Click for more information

Free trials of urlscan Pro are available.

0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3 200 / Show response
nike-soccer-jersey-authentic-vs-replica.pages.dev/ 10 KB
3 KB 123ms
48ms Document
text/html 172.66.47.80
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://nike-soccer-jersey-authentic-vs-replica.pages.dev/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.47.80 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

c50615c5e31457b7fca141fa2679da61e23f46f58437907344f8371a98dd16cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="153", "Google Chrome";v="153", "Not_A Brand";v="8"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=0, must-revalidate
cf-ray: a398a8dca81433e8-FRA
content-encoding: br
content-type: text/html; charset=utf-8
date: Fri, 11 Sep 2026 18:15:45 GMT
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
priority: u=0,i
referrer-policy: strict-origin-when-cross-origin
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=%2BRQe7GagV2uehdO%2B1wJLDEIerNOhRnFmTc254%2Beef6oW1ek%2FDPRbmmO9v%2Fjq4eOJOg0mGofe04bjNs8w3Q1xEyqoFUYkfosLE13YdfXZJJTI31AbFJmCWkUA%2BaplOjLjPyKJBCqDvY4fLIXNe7f8OJz%2BOEgxor590C3rGc8oHYT4PaVp"}]}
server: cloudflare
server-timing: cfExtPri
x-content-type-options: nosniff

GET
H3 200 top-shop.js Show response
enjs.pages.dev/ 383 B
715 B 68ms
35ms Script
application/javascript 172.66.44.130
Cloudflare

General

Check archive.org

Download Go to

Full URL

https://enjs.pages.dev/top-shop.js

Requested by

Host: nike-soccer-jersey-authentic-vs-replica.pages.dev
URL: https://nike-soccer-jersey-authentic-vs-replica.pages.dev/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.44.130 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

0054752d0142fb3cbfe64550926c5c470cea01f1fe0197416d614eec193906f0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://nike-soccer-jersey-authentic-vs-replica.pages.dev/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="153", "Google Chrome";v="153", "Not_A Brand";v="8"
sec-ch-ua-mobile: ?0

Response headers

cache-control: public, max-age=0, must-revalidate
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-encoding: br
etag: W/"0ca04f4d2f6cead8b74bffc0a0f1e570"
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=pQCn4Rr9jaEX4YIrkAz61jCee%2BI1rv6NSiNJRlG7Y00lSXH%2BB8Djc6Bmwea6oCragme12HjAWdoIPlt01RghAXrXL6bkFJ0J%2FjQJwDHfLbDFvvtCT1GuNjxVRJhAWzw9Mw%3D%3D"}]}
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cf-ray: a398a8dd3daadca2-FRA
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 11 Sep 2026 18:15:45 GMT
content-type: application/javascript
server: cloudflare
priority: u=1,i=?0

GET hand.png
poster.spaceshopping.net/img/ 0
0

GET jiantou.png
poster.spaceshopping.net/img/ 0
0

GET icon1.png
poster.spaceshopping.net/img/ 0
0

GET icon2.png
poster.spaceshopping.net/img/ 0
0

GET icon3.png
poster.spaceshopping.net/img/ 0
0

GET icon4.png
poster.spaceshopping.net/img/ 0
0

GET icon5.png
poster.spaceshopping.net/img/ 0
0

GET icon6.png
poster.spaceshopping.net/img/ 0
0

GET icon7.png
poster.spaceshopping.net/img/ 0
0

GET icon8.png
poster.spaceshopping.net/img/ 0
0

GET /
i.6v6.work/v/ 0
0

GET
H2 200 Primary Request Shopybuy Show response
t.me/ 11 KB
4 KB 335ms
38ms Document
text/html 2001:67c:4e8:f004::9
Telegram Telegram...

General

Check archive.org

Download Go to

Full URL

https://t.me/Shopybuy

Requested by

Host: nike-soccer-jersey-authentic-vs-replica.pages.dev
URL: https://nike-soccer-jersey-authentic-vs-replica.pages.dev/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2001:67c:4e8:f004::9 Amsterdam, Netherlands, ASN62041 (Telegram Telegram Messenger Inc, VG),

Reverse DNS

Software

nginx/1.30.1 /

Resource Hash

2cac6e98ffc00bc8e7187f07e88574360de0a4293cfd44f5775112cfca6fda6c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://web.telegram.org
Strict-Transport-Security	max-age=35768000
X-Frame-Options	ALLOW-FROM https://web.telegram.org

Request headers

Referer: https://nike-soccer-jersey-authentic-vs-replica.pages.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="153", "Google Chrome";v="153", "Not_A Brand";v="8"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

cache-control: no-store
content-encoding: gzip
content-length: 4221
content-security-policy: frame-ancestors https://web.telegram.org
content-type: text/html; charset=utf-8
date: Fri, 11 Sep 2026 18:15:45 GMT
pragma: no-cache
server: nginx/1.30.1
strict-transport-security: max-age=35768000
x-frame-options: ALLOW-FROM https://web.telegram.org

GET
H2 200 font-roboto.css
telegram.org/css/ 6 KB
894 B 58ms
11ms Stylesheet
text/css 2001:67c:4e8:f004::9
Telegram Telegram...

General

Check archive.org

Download Go to

Full URL

https://telegram.org/css/font-roboto.css?1

Requested by

Host: t.me
URL: https://t.me/Shopybuy

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2001:67c:4e8:f004::9 Amsterdam, Netherlands, ASN62041 (Telegram Telegram Messenger Inc, VG),

Reverse DNS

Software

nginx/1.30.1 /

Resource Hash

84b97b3fa8847b64c6d3833561e4b3146530577171e85ad226578a087db70974

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://t.me/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="153", "Google Chrome";v="153", "Not_A Brand";v="8"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=345600
content-encoding: gzip
etag: W/"63512b7d-1816"
expires: Tue, 15 Sep 2026 18:15:45 GMT
date: Fri, 11 Sep 2026 18:15:45 GMT
content-type: text/css
last-modified: Thu, 20 Oct 2022 11:05:33 GMT
server: nginx/1.30.1

GET
H2 200 bootstrap.min.css
telegram.org/css/ 42 KB
10 KB 62ms
15ms Stylesheet
text/css 2001:67c:4e8:f004::9
Telegram Telegram...

General

Check archive.org

Download Go to

Full URL

https://telegram.org/css/bootstrap.min.css?3

Requested by

Host: t.me
URL: https://t.me/Shopybuy

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2001:67c:4e8:f004::9 Amsterdam, Netherlands, ASN62041 (Telegram Telegram Messenger Inc, VG),

Reverse DNS

Software

nginx/1.30.1 /

Resource Hash

f1d083ffaa644c708f11db29707aa57c19246e6d32643b03fee3f82c17b224b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://t.me/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="153", "Google Chrome";v="153", "Not_A Brand";v="8"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=345600
content-encoding: gzip
etag: W/"5a05e7c6-a61b"
expires: Tue, 15 Sep 2026 18:15:45 GMT
date: Fri, 11 Sep 2026 18:15:45 GMT
content-type: text/css
last-modified: Fri, 10 Nov 2017 17:54:14 GMT
server: nginx/1.30.1

GET
H2 200 telegram.css
telegram.org/css/ 119 KB
31 KB 70ms
24ms Stylesheet
text/css 2001:67c:4e8:f004::9
Telegram Telegram...

General

Check archive.org

Download Go to

Full URL

https://telegram.org/css/telegram.css?254

Requested by

Host: t.me
URL: https://t.me/Shopybuy

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2001:67c:4e8:f004::9 Amsterdam, Netherlands, ASN62041 (Telegram Telegram Messenger Inc, VG),

Reverse DNS

Software

nginx/1.30.1 /

Resource Hash

b7d3bbab7ae0c019d4e01f3d1d1d1f1c1466c88f9fcd12a795612d7c05e93ec3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://t.me/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="153", "Google Chrome";v="153", "Not_A Brand";v="8"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=345600
content-encoding: gzip
etag: W/"6a5104a9-1dd26"
expires: Tue, 15 Sep 2026 18:15:45 GMT
date: Fri, 11 Sep 2026 18:15:45 GMT
content-type: text/css
last-modified: Fri, 10 Jul 2026 14:41:45 GMT
server: nginx/1.30.1

GET
H/1.1 200
OK W4gaL7irjwx2ERTGH1NcICs7cjAx6NPMtaEBSyoQ3mrmFuP2po9YHy1iE9dKXHnnRm2pvm1CcUninfHEF13Le-jV-wSyWWAFxlVmRTn0GjrdwvLtCPr_3nENKYRzu7R1hcX07tuSohr5hQWqRBEtMmpiZeXsv-s9vvpVd7FRhIAIpEhOSn587qvRP-33kxL2PpZn8...
cdn4.telesco.pe/file/ 15 KB
16 KB 98ms
39ms Image
image/jpeg 149.154.165.133
Telegram Telegram...

General

Check archive.org

Download Go to Show image

Full URL

https://cdn4.telesco.pe/file/W4gaL7irjwx2ERTGH1NcICs7cjAx6NPMtaEBSyoQ3mrmFuP2po9YHy1iE9dKXHnnRm2pvm1CcUninfHEF13Le-jV-wSyWWAFxlVmRTn0GjrdwvLtCPr_3nENKYRzu7R1hcX07tuSohr5hQWqRBEtMmpiZeXsv-s9vvpVd7FRhIAIpEhOSn587qvRP-33kxL2PpZn8cTaaNYfrcEBVDo0k6FCmnSK4rWXtf-H0ZzvbprpK9QWM2kcranfJVSRwJA9f7oVFAZA99DwlUiXjX2Df1vixb_e4O4XzofEJ1EDJT4QdxNCadIs3XQhJWojPnmMRV08gzq26M8sFsf_CoJrdw.jpg

Requested by

Host: t.me
URL: https://t.me/Shopybuy

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

149.154.165.133 Amsterdam, Netherlands, ASN62041 (Telegram Telegram Messenger Inc, VG),

Reverse DNS

Software

nginx/1.30.1 /

Resource Hash

5f74f2db62e0763ef42cfd9f65875d2e795b09ecd7b67baf9d5d54479336efb7

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; sandbox
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://t.me/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="153", "Google Chrome";v="153", "Not_A Brand";v="8"
sec-ch-ua-mobile: ?0

Response headers

Access-Control-Expose-Headers: Accept-Ranges, Content-Range, Content-Length
ETag: "ddf324334a650b01be4768684dc7f53eae76b532"
X-Content-Type-Options: nosniff
Expires: Fri, 11 Sep 2026 21:15:45 GMT
Date: Fri, 11 Sep 2026 18:15:45 GMT
Content-Type: image/jpeg
X-Frame-Options: DENY
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Security-Policy: default-src 'none'; sandbox
Cache-Control: max-age=10800, must-revalidate
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Length: 15350
X-XSS-Protection: 1; mode=block
Server: nginx/1.30.1

GET
H2 200 tgwallpaper.min.js Show response
telegram.org/js/ 3 KB
2 KB 61ms
24ms Script
application/javascript 2001:67c:4e8:f004::9
Telegram Telegram...

General

Check archive.org

Download Go to

Full URL

https://telegram.org/js/tgwallpaper.min.js?3

Requested by

Host: t.me
URL: https://t.me/Shopybuy

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2001:67c:4e8:f004::9 Amsterdam, Netherlands, ASN62041 (Telegram Telegram Messenger Inc, VG),

Reverse DNS

Software

nginx/1.30.1 /

Resource Hash

2031e418ee10af8110729b3f327b968462fc0a9d8d1da095387bb472ccd0dee6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://t.me/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="153", "Google Chrome";v="153", "Not_A Brand";v="8"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=345600
content-encoding: gzip
etag: W/"62211da5-ba3"
expires: Tue, 15 Sep 2026 18:15:45 GMT
date: Fri, 11 Sep 2026 18:15:45 GMT
content-type: application/javascript
last-modified: Thu, 03 Mar 2022 19:57:25 GMT
server: nginx/1.30.1

GET
H2 200 pattern.svg
telegram.org/img/tgme/ 226 KB
81 KB 16ms
15ms Image
image/svg+xml 2001:67c:4e8:f004::9
Telegram Telegram...

General

Check archive.org

Download Go to Show image

Full URL: https://telegram.org/img/tgme/pattern.svg?1
Requested by: Host: telegram.org
URL: https://telegram.org/css/telegram.css?254
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2001:67c:4e8:f004::9 Amsterdam, Netherlands, ASN62041 (Telegram Telegram Messenger Inc, VG),
Reverse DNS
Software: nginx/1.30.1 /
Resource Hash: 118add53487c02aaf5b5ab9f69380fa06717deb10492e14aaa487e3c62806ad4

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://telegram.org/css/telegram.css?254
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="153", "Google Chrome";v="153", "Not_A Brand";v="8"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=345600
content-encoding: gzip
etag: W/"63b70e44-3891a"
expires: Tue, 15 Sep 2026 18:15:45 GMT
access-control-allow-origin: *
date: Fri, 11 Sep 2026 18:15:45 GMT
content-type: image/svg+xml
last-modified: Thu, 05 Jan 2023 17:52:04 GMT
server: nginx/1.30.1

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
telegram.org/fonts/Roboto/ 11 KB
11 KB 38ms
12ms Font
application/octet-stream 2001:67c:4e8:f004::9
Telegram Telegram...

General

Check archive.org

Download Go to

Full URL: https://telegram.org/fonts/Roboto/KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
Requested by: Host: telegram.org
URL: https://telegram.org/css/font-roboto.css?1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2001:67c:4e8:f004::9 Amsterdam, Netherlands, ASN62041 (Telegram Telegram Messenger Inc, VG),
Reverse DNS
Software: nginx/1.30.1 /
Resource Hash: 0f53e8b0a717ca4ce313eec62b90d41db62c2f4946259a65c93bf8e84c5b0c44

Request headers

Origin: https://t.me
sec-ch-ua-platform: "Linux"
Referer: https://telegram.org/css/font-roboto.css?1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="153", "Google Chrome";v="153", "Not_A Brand";v="8"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=345600
etag: "63512b7d-2b20"
expires: Tue, 15 Sep 2026 18:15:45 GMT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 11040
date: Fri, 11 Sep 2026 18:15:45 GMT
content-type: application/octet-stream
last-modified: Thu, 20 Oct 2022 11:05:33 GMT
server: nginx/1.30.1

GET
H2 200 KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
telegram.org/fonts/Roboto/ 11 KB
11 KB 49ms
24ms Font
application/octet-stream 2001:67c:4e8:f004::9
Telegram Telegram...

General

Check archive.org

Download Go to

Full URL: https://telegram.org/fonts/Roboto/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
Requested by: Host: telegram.org
URL: https://telegram.org/css/font-roboto.css?1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2001:67c:4e8:f004::9 Amsterdam, Netherlands, ASN62041 (Telegram Telegram Messenger Inc, VG),
Reverse DNS
Software: nginx/1.30.1 /
Resource Hash: 796de064b8d80eba7ccacb8ba67d77fdbcdf4b385c844645d452c24537b3108f

Request headers

Origin: https://t.me
sec-ch-ua-platform: "Linux"
Referer: https://telegram.org/css/font-roboto.css?1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="153", "Google Chrome";v="153", "Not_A Brand";v="8"
sec-ch-ua-mobile: ?0

Response headers

cache-control: max-age=345600
etag: "63512b7d-2b14"
expires: Tue, 15 Sep 2026 18:15:45 GMT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 11028
date: Fri, 11 Sep 2026 18:15:45 GMT
content-type: application/octet-stream
last-modified: Thu, 20 Oct 2022 11:05:33 GMT
server: nginx/1.30.1

GET
H2 200 favicon.ico
telegram.org/img/ 15 KB
15 KB 13ms
13ms Other
image/x-icon 2001:67c:4e8:f004::9
Telegram Telegram...

General

Check archive.org

Download Go to

Full URL

https://telegram.org/img/favicon.ico

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2001:67c:4e8:f004::9 Amsterdam, Netherlands, ASN62041 (Telegram Telegram Messenger Inc, VG),

Reverse DNS

Software

nginx/1.30.1 /

Resource Hash

4ff54bc38c267dc3a8c95f6ed4590336baaec70433ef15d027ddca608c391e78

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://t.me/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="153", "Google Chrome";v="153", "Not_A Brand";v="8"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=604800
etag: "62616083-3aee"
expires: Fri, 18 Sep 2026 18:15:46 GMT
accept-ranges: bytes
content-length: 15086
date: Fri, 11 Sep 2026 18:15:46 GMT
content-type: image/x-icon
last-modified: Thu, 21 Apr 2022 13:47:47 GMT
server: nginx/1.30.1

GET tg://resolve?domain=Shopybuy
tg://resolve?domain=Shopybuy 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: poster.spaceshopping.net
URL: https://poster.spaceshopping.net/img/hand.png

Domain: poster.spaceshopping.net
URL: https://poster.spaceshopping.net/img/jiantou.png

Domain: poster.spaceshopping.net
URL: https://poster.spaceshopping.net/img/icon1.png

Domain: poster.spaceshopping.net
URL: https://poster.spaceshopping.net/img/icon2.png

Domain: poster.spaceshopping.net
URL: https://poster.spaceshopping.net/img/icon3.png

Domain: poster.spaceshopping.net
URL: https://poster.spaceshopping.net/img/icon4.png

Domain: poster.spaceshopping.net
URL: https://poster.spaceshopping.net/img/icon5.png

Domain: poster.spaceshopping.net
URL: https://poster.spaceshopping.net/img/icon6.png

Domain: poster.spaceshopping.net
URL: https://poster.spaceshopping.net/img/icon7.png

Domain: poster.spaceshopping.net
URL: https://poster.spaceshopping.net/img/icon8.png

Domain: i.6v6.work
URL: https://i.6v6.work/v/?uid=390834

Domain: resolve
URL: tg://resolve?domain=Shopybuy

Verdicts & Comments Add Verdict or Comment

5 JavaScript Window variables Go Pro
Only in urlscan Pro

Inspect and pivot on JavaScript variables, identifiers, and other key site metadata data with urlscan Pro. Reveal and search on client-side frameworks, runtime variables, and custom values.

Click for more information

Free trials of urlscan Pro are available.

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

1 Cookies Go Pro
Only in urlscan Pro

Review, search, and pivot on browser cookies and persistence site data to see how a site tracks users and keeps sessions alive across visits.

Click for more information

Free trials of urlscan Pro are available.

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			t.me/	1970-01-21 17:00:36	Name: stel_ssid Value: 98ddbc003e6860db61_10298480447802255283

10 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://poster.spaceshopping.net/img/hand.png Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://poster.spaceshopping.net/img/jiantou.png Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://poster.spaceshopping.net/img/icon1.png Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://poster.spaceshopping.net/img/icon2.png Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://poster.spaceshopping.net/img/icon3.png Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://poster.spaceshopping.net/img/icon4.png Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://poster.spaceshopping.net/img/icon5.png Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://poster.spaceshopping.net/img/icon6.png Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://poster.spaceshopping.net/img/icon7.png Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://poster.spaceshopping.net/img/icon8.png Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn4.telesco.pe
enjs.pages.dev
i.6v6.work
nike-soccer-jersey-authentic-vs-replica.pages.dev
poster.spaceshopping.net
resolve
t.me
telegram.org
i.6v6.work
poster.spaceshopping.net
resolve
149.154.165.133
172.66.44.130
172.66.47.80
2001:67c:4e8:f004::9
0054752d0142fb3cbfe64550926c5c470cea01f1fe0197416d614eec193906f0
0f53e8b0a717ca4ce313eec62b90d41db62c2f4946259a65c93bf8e84c5b0c44
118add53487c02aaf5b5ab9f69380fa06717deb10492e14aaa487e3c62806ad4
2031e418ee10af8110729b3f327b968462fc0a9d8d1da095387bb472ccd0dee6
2cac6e98ffc00bc8e7187f07e88574360de0a4293cfd44f5775112cfca6fda6c
4ff54bc38c267dc3a8c95f6ed4590336baaec70433ef15d027ddca608c391e78
5f74f2db62e0763ef42cfd9f65875d2e795b09ecd7b67baf9d5d54479336efb7
796de064b8d80eba7ccacb8ba67d77fdbcdf4b385c844645d452c24537b3108f
84b97b3fa8847b64c6d3833561e4b3146530577171e85ad226578a087db70974
b7d3bbab7ae0c019d4e01f3d1d1d1f1c1466c88f9fcd12a795612d7c05e93ec3
c50615c5e31457b7fca141fa2679da61e23f46f58437907344f8371a98dd16cd
f1d083ffaa644c708f11db29707aa57c19246e6d32643b03fee3f82c17b224b3

t.me 2001:67c:4e8:f004::9 Public Scan Open in urlscan Pro

Internal

Effective Hostname

Submitted URL

Effective URL Pivot

Effective IP

Only in urlscan Pro

Summary

urlscan.io Verdict: No classification

Only in urlscan Pro

Domain & IP information

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

Screenshot Go Pro Only in urlscan Pro Use the Visual Search feature to find pages with visually similar screenshots. Click for more information Free trials of urlscan Pro are available. Full Image

Only in urlscan Pro

Page Title

Page URL History Go Pro Only in urlscan Pro Search our real-time database of newly observed domains and hostnames. Pivot on different attributes, and setup keyword alerts for newly observed domains. Click for more information Free trials of urlscan Pro are available. Show full URLs

Only in urlscan Pro

Detected technologies

Page Statistics

24 Requests

50 %HTTPS

25 %IPv6

7 Domains

8 Subdomains

5 IPs

2 Countries

185 kBTransfer

468 kBSize

1 Cookies

Only in urlscan Pro

Page URL History

Redirected requests

Only in urlscan Pro

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Only in urlscan Pro

1 Cookies Go Pro Only in urlscan Pro Review, search, and pivot on browser cookies and persistence site data to see how a site tracks users and keeps sessions alive across visits. Click for more information Free trials of urlscan Pro are available.

Only in urlscan Pro

10 Console Messages

Security Headers

Indicators

t.me
2001:67c:4e8:f004::9 Public Scan Open in urlscan Pro

Screenshot Go Pro
Only in urlscan Pro

Use the Visual Search feature to find pages with visually similar screenshots.

Click for more information

Free trials of urlscan Pro are available.

Full Image

Page URL History Go Pro
Only in urlscan Pro

Search our real-time database of newly observed domains and hostnames. Pivot on different attributes, and setup keyword alerts for newly observed domains.

Click for more information

Free trials of urlscan Pro are available.
Show full URLs

24
Requests

50 %
HTTPS

25 %
IPv6

7
Domains

8
Subdomains

5
IPs

2
Countries

185 kB
Transfer

468 kB
Size

1
Cookies

1 Cookies Go Pro
Only in urlscan Pro

Review, search, and pivot on browser cookies and persistence site data to see how a site tracks users and keeps sessions alive across visits.

Click for more information

Free trials of urlscan Pro are available.