abc.telemaa.icu
Open in
urlscan Pro
2606:4700:3034::ac43:d54e
Malicious Activity!
Public Scan
Effective URL: https://abc.telemaa.icu/?gclid=bc125e35bf857f7c3805d2c1c310c947-8e828c1f82b0dde158a78f3d8bef9d68
Submission: On June 23 via manual from HK — Scanned from DE
Summary
TLS certificate: Issued by E1 on June 20th 2023. Valid for: 3 months.
This is the only time abc.telemaa.icu was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Telegram (Instant Messenger)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2606:4700:303... 2606:4700:3035::6815:5602 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
16 | 2606:4700:303... 2606:4700:3034::ac43:d54e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:82b::2008 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2001:4de0:ac1... 2001:4de0:ac18::1:a:3b | 20446 (STACKPATH...) (STACKPATH-CDN) | |
2 | 2001:4860:480... 2001:4860:4802:32::36 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:831::200a | 15169 (GOOGLE) (GOOGLE) | |
3 | 2a00:1450:400... 2a00:1450:4001:828::2003 | 15169 (GOOGLE) (GOOGLE) | |
24 | 6 |
ASN15169 (GOOGLE, US)
www.googletagmanager.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
17 |
telemaa.icu
1 redirects
abc.telemaa.icu |
20 MB |
3 |
gstatic.com
fonts.gstatic.com |
47 KB |
2 |
google-analytics.com
region1.google-analytics.com — Cisco Umbrella Rank: 1832 |
308 B |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 80 |
1 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 771 |
31 KB |
1 |
googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 82 |
87 KB |
24 | 6 |
Domain | Requested by | |
---|---|---|
17 | abc.telemaa.icu |
1 redirects
abc.telemaa.icu
|
3 | fonts.gstatic.com |
fonts.googleapis.com
|
2 | region1.google-analytics.com |
www.googletagmanager.com
|
1 | fonts.googleapis.com |
abc.telemaa.icu
|
1 | code.jquery.com |
abc.telemaa.icu
|
1 | www.googletagmanager.com |
abc.telemaa.icu
|
24 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
1687502032.yyyk8326.top |
Subject Issuer | Validity | Valid | |
---|---|---|---|
telemaa.icu E1 |
2023-06-20 - 2023-09-18 |
3 months | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2023-05-29 - 2023-08-21 |
3 months | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2022-08-03 - 2023-07-14 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-05-29 - 2023-08-21 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-05-29 - 2023-08-21 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://abc.telemaa.icu/?gclid=bc125e35bf857f7c3805d2c1c310c947-8e828c1f82b0dde158a78f3d8bef9d68
Frame ID: 5419ACE28FF817B044FFC0C60185E7B0
Requests: 24 HTTP requests in this frame
Screenshot
Page Title
TG 官方汉语版Page URL History Show full URLs
-
http://abc.telemaa.icu/
HTTP 302
https://abc.telemaa.icu/?gclid=bc125e35bf857f7c3805d2c1c310c947-8e828c1f82b0dde158a78f3d8bef9d68 Page URL
Detected technologies
Vue.js (JavaScript Frameworks) ExpandDetected patterns
- <[^>]+\sdata-v(?:ue)?-
Google Analytics (Analytics) Expand
Detected patterns
Google Tag Manager (Tag Managers) Expand
Detected patterns
- googletagmanager\.com/gtag/js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: iPhone/iPad
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://abc.telemaa.icu/
HTTP 302
https://abc.telemaa.icu/?gclid=bc125e35bf857f7c3805d2c1c310c947-8e828c1f82b0dde158a78f3d8bef9d68 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
24 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
abc.telemaa.icu/ Redirect Chain
|
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
255 KB 87 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
filename.js
abc.telemaa.icu/src/assets/download/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
downloader.js
abc.telemaa.icu/src/assets/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.6.2.min.js
abc.telemaa.icu/src/assets/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.6.2.min.js
code.jquery.com/ |
88 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index-c26c93f0.js
abc.telemaa.icu/assets/ |
57 KB 23 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index-fc402973.css
abc.telemaa.icu/assets/ |
4 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
region1.google-analytics.com/g/ |
0 253 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
9 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
ic_telegram-594146f4.svg
abc.telemaa.icu/assets/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
d_why_1-58a9156f.gif
abc.telemaa.icu/assets/ |
2 MB 2 MB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
d_why_4-b285715d.gif
abc.telemaa.icu/assets/ |
3 MB 3 MB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
d_why_8-3da30018.gif
abc.telemaa.icu/assets/ |
3 MB 3 MB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
d_why_2-a8250de7.gif
abc.telemaa.icu/assets/ |
2 MB 2 MB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
d_why_3-15d01829.gif
abc.telemaa.icu/assets/ |
2 MB 2 MB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
d_why_6-116029bd.gif
abc.telemaa.icu/assets/ |
2 MB 2 MB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
d_why_5-f8152a8d.gif
abc.telemaa.icu/assets/ |
2 MB 2 MB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
d_why_7-e21cceb8.gif
abc.telemaa.icu/assets/ |
3 MB 3 MB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
d_why_9-03e6d8a1.png
abc.telemaa.icu/assets/ |
130 KB 131 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ |
15 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ |
16 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOkCnqEu92Fr1MmgVxIIzI.woff2
fonts.gstatic.com/s/roboto/v30/ |
15 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
region1.google-analytics.com/g/ |
0 55 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Telegram (Instant Messenger)12 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| onbeforetoggle object| onscrollend function| gtag object| dataLayer object| google_tag_manager object| google_tag_data function| onYouTubeIframeAPIReady object| gaGlobal function| $ function| jQuery boolean| __VUE__2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.telemaa.icu/ | Name: _ga Value: GA1.1.2127021690.1687502033 |
|
.telemaa.icu/ | Name: _ga_6DCRSK6EQ2 Value: GS1.1.1687502032.1.0.1687502032.0.0.0 |
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
abc.telemaa.icu
code.jquery.com
fonts.googleapis.com
fonts.gstatic.com
region1.google-analytics.com
www.googletagmanager.com
2001:4860:4802:32::36
2001:4de0:ac18::1:a:3b
2606:4700:3034::ac43:d54e
2606:4700:3035::6815:5602
2a00:1450:4001:828::2003
2a00:1450:4001:82b::2008
2a00:1450:4001:831::200a
03e6d8a1cf16f3cbd1ac72ffd790cb4f14c3273433c2d638753d3e656665fe5d
05da0932cbad49604d47e598aeee5d852a1324f15dbc4726e8a70d0680e711c0
0e2d9764e7b8eec4488c53522d5e663f500d282ffd1efc836ce5637d1fe3f822
0f303f31706d39866cced9dcc17b61fb8423674278d7f6051d66b3a79ffbca18
116029bd091ec390064879df7dad05e601e284413f53b9d51978875b85dc7471
15d01829fac9057a922b9168d68d9ea940d7612b0128ae9b67fe69a1dd10e62d
3da30018745ee9d2032bb71f2907a2fa3647d1660d402200d35f161854b0ef48
4441accab290403e36df7d4f9d4a78a7cbe85d882d418facb329af1037d8db17
58a9156f7cb557eb157598032fd67ade899a5a8b635455fbeb46c7bfa0f122e4
594146f45ed93efd4aa83148f12edb05c769c67c248cac28b4538396d6130ff8
a8250de71d10600c25e46fcd67c0d144434ed460d98a236773eddc3bd81043b3
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
b285715d34361c4fed5058a10eb830bf2dd61126518477ded340dd7f95221417
d07e3619bcd5ab9cc81d065c02ed87bca8063fab360811cb0adb40f4720a2f21
da4ad864a87ffcf71c851b5df87f95cb242867f7b711cae4c6133cc9cc0048f0
e21cceb8262a91f878fe4e5202139793e9cd3a02da2dd08d2dc4180cd29ac402
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f8152a8d500807f824571c3256320bbf578cdce88d45d0fd048a6422f71c272b
fc402973c1a261652f19422c81fc3ea85bc592f0e5312856e15bc2a51d2991cb