![](/screenshots/069fde23-cb57-4312-8d1b-3b530c721e22.png)
t.me
Open in
urlscan Pro
2001:67c:4e8:f004::9
Public Scan
Effective URL: https://t.me/SpyBermuda2
Submission: On August 26 via manual from ID — Scanned from DE
Summary
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on October 8th 2022. Valid for: a year.
This is the only time t.me was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 2 | 157.245.113.153 157.245.113.153 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
2 | 54.36.158.42 54.36.158.42 | 16276 (OVH) (OVH) | |
1 | 2a00:1450:400... 2a00:1450:4001:81c::200a | 15169 (GOOGLE) (GOOGLE) | |
5 | 141.94.172.213 141.94.172.213 | 16276 (OVH) (OVH) | |
1 | 2620:116:800d... 2620:116:800d:21:93ca:31d8:d86e:38f6 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2a00:1450:400... 2a00:1450:4001:828::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 1 | 2600:9000:20c... 2600:9000:20c3:3e00:6:44e3:f8c0:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2600:9000:20c... 2600:9000:20c3:8400:6:44e3:f8c0:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2620:116:800d... 2620:116:800d:21:b314:a0ef:ab7c:d546 | 16509 (AMAZON-02) (AMAZON-02) | |
8 | 2001:67c:4e8:... 2001:67c:4e8:f004::9 | 62041 (TELEGRAM) (TELEGRAM) | |
21 | 9 |
ASN16276 (OVH, FR)
d.thumbs.xtstatic.com | |
xtgem.com | |
enif.images.xtstatic.com | |
cif.images.xtstatic.com |
ASN16509 (AMAZON-02, US)
rules.quantcount.com |
ASN16509 (AMAZON-02, US)
rules.quantcount.com |
ASN16509 (AMAZON-02, US)
pixel.quantserve.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
telegram.org
telegram.org — Cisco Umbrella Rank: 11059 |
144 KB |
3 |
xtstatic.com
d.thumbs.xtstatic.com enif.images.xtstatic.com cif.images.xtstatic.com |
3 KB |
2 |
quantcount.com
1 redirects
rules.quantcount.com — Cisco Umbrella Rank: 1176 |
1 KB |
2 |
quantserve.com
edge.quantserve.com — Cisco Umbrella Rank: 18494 pixel.quantserve.com — Cisco Umbrella Rank: 937 |
10 KB |
2 |
xtgem.com
xtgem.com — Cisco Umbrella Rank: 399362 |
2 KB |
2 |
wap.sh
syber07.wap.sh |
71 KB |
2 |
tiny.cc
2 redirects
tiny.cc — Cisco Umbrella Rank: 198959 |
585 B |
1 |
t.me
t.me — Cisco Umbrella Rank: 17033 |
4 KB |
1 |
gstatic.com
fonts.gstatic.com |
13 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 45 |
1 KB |
0 |
Failed
function sub() { [native code] }. Failed |
|
21 | 11 |
Domain | Requested by | |
---|---|---|
7 | telegram.org |
t.me
telegram.org |
2 | rules.quantcount.com |
1 redirects
syber07.wap.sh
|
2 | xtgem.com |
syber07.wap.sh
|
2 | syber07.wap.sh |
syber07.wap.sh
|
2 | tiny.cc | 2 redirects |
1 | t.me | |
1 | pixel.quantserve.com |
syber07.wap.sh
|
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | cif.images.xtstatic.com |
syber07.wap.sh
|
1 | enif.images.xtstatic.com |
syber07.wap.sh
|
1 | edge.quantserve.com |
syber07.wap.sh
|
1 | d.thumbs.xtstatic.com |
syber07.wap.sh
|
1 | fonts.googleapis.com |
syber07.wap.sh
|
0 | resolve Failed |
t.me
|
21 | 14 |
This site contains links to these domains. Also see Links.
Domain |
---|
telegram.org |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.quantserve.com DigiCert TLS RSA SHA256 2020 CA1 |
2022-08-09 - 2023-09-09 |
a year | crt.sh |
*.t.me Go Daddy Secure Certificate Authority - G2 |
2022-10-08 - 2023-11-09 |
a year | crt.sh |
*.telegram.org Go Daddy Secure Certificate Authority - G2 |
2023-08-11 - 2024-09-11 |
a year | crt.sh |
This page contains 3 frames:
Frame:
tg://resolve?domain=SpyBermuda2
Frame ID: F78CA66F936D0320AA7475058CEB9062
Requests: 20 HTTP requests in this frame
Frame:
http://enif.images.xtstatic.com/tp.gif
Frame ID: CC2BCBCF40D2A5A7F13A4E6AAC1BDFF4
Requests: 1 HTTP requests in this frame
Frame:
http://cif.images.xtstatic.com/tp.gif
Frame ID: B3F3B90CB5FB797413238179231D92D4
Requests: 1 HTTP requests in this frame
Screenshot
![](/screenshots/069fde23-cb57-4312-8d1b-3b530c721e22.png)
Page Title
Telegram: Contact @SpyBermuda2Page URL History Show full URLs
-
http://tiny.cc/SY_3
HTTP 301
https://tiny.cc/SY_3 HTTP 303
http://syber07.wap.sh/Cukupdisiniatautdksamasekaliok32 Page URL
- https://t.me/SpyBermuda2 Page URL
Detected technologies
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
![](/vendor/wappa/icons/Quantcast.png)
Detected patterns
- \.quantserve\.com/quant\.js
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: Download
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://tiny.cc/SY_3
HTTP 301
https://tiny.cc/SY_3 HTTP 303
http://syber07.wap.sh/Cukupdisiniatautdksamasekaliok32 Page URL
- https://t.me/SpyBermuda2 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://tiny.cc/SY_3 HTTP 301
- https://tiny.cc/SY_3 HTTP 303
- http://syber07.wap.sh/Cukupdisiniatautdksamasekaliok32
- http://rules.quantcount.com/rules-p-0cfM8Oh7M9bVQ.js HTTP 301
- https://rules.quantcount.com/rules-p-0cfM8Oh7M9bVQ.js
21 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Cukupdisiniatautdksamasekaliok32
syber07.wap.sh/ Redirect Chain
|
459 KB 67 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
xtgem_template.css
syber07.wap.sh/ |
25 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
css
fonts.googleapis.com/ |
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
snack-s-1967-97584.jpg
d.thumbs.xtstatic.com/100/50/-/d0506f67f053b61a6ab8daf3b7ec945c/backtooldschool.xtgem.com/images/blog/ |
2 KB 2 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
page_templates.js
xtgem.com/js/ |
1 KB 953 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
quant.js
edge.quantserve.com/ |
22 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
tp.gif
enif.images.xtstatic.com/ Frame CC2B |
42 B 328 B |
Document
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
tp.gif
cif.images.xtstatic.com/ Frame B3F3 |
42 B 328 B |
Document
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
close2.png
xtgem.com/images/ |
564 B 862 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
TK3_WkUHHAIjg75cFRf3bXL8LICs1_FvsUZiZQ.woff2
fonts.gstatic.com/s/oswald/v53/ |
12 KB 13 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rules-p-0cfM8Oh7M9bVQ.js
rules.quantcount.com/ Redirect Chain
|
160 B 642 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pixel;r=1728317766;rf=0;a=p-0cfM8Oh7M9bVQ;url=http%3A%2F%2Fsyber07.wap.sh%2FCukupdisiniatautdksamasekaliok32;uht=2;fpan=1;fpa=P0-204638451-1693067828679;pbc=;ns=0;ce=1;qjs=1;qv=c818c8ec-20230509111...
pixel.quantserve.com/ |
35 B 372 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
SpyBermuda2
t.me/ |
9 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-roboto.css
telegram.org/css/ |
6 KB 894 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
telegram.org/css/ |
42 KB 10 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
telegram.css
telegram.org/css/ |
112 KB 29 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tgwallpaper.min.js
telegram.org/js/ |
3 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pattern.svg
telegram.org/img/tgme/ |
226 KB 81 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
523 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
telegram.org/fonts/Roboto/ |
11 KB 11 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
telegram.org/fonts/Roboto/ |
11 KB 11 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
tg://resolve?domain=SpyBermuda2
tg://resolve?domain=SpyBermuda2 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- resolve
- URL
- tg://resolve?domain=SpyBermuda2
Verdicts & Comments Add Verdict or Comment
9 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture object| TWallpaper string| protoUrl undefined| iframeContEl undefined| iframeEl undefined| pageHidden object| tme_bg function| toggleTheme object| darkMedia6 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.wap.sh/ | Name: _xta_uid Value: 517ede1a1103c27522b8a0fad0dbce47 |
|
.wap.sh/ | Name: _xta_vid Value: 98ec6905d59aeb6f0fc530915161f939-1693067828 |
|
syber07.wap.sh/ | Name: Value: test |
|
.quantserve.com/ | Name: mc Value: 64ea2a35-19d27-b85cd-56c9e |
|
.wap.sh/ | Name: __qca Value: P0-204638451-1693067828679 |
|
t.me/ | Name: stel_ssid Value: 6bdee8f338684b0d95_8626278333669663945 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cif.images.xtstatic.com
d.thumbs.xtstatic.com
edge.quantserve.com
enif.images.xtstatic.com
fonts.googleapis.com
fonts.gstatic.com
pixel.quantserve.com
resolve
rules.quantcount.com
syber07.wap.sh
t.me
telegram.org
tiny.cc
xtgem.com
resolve
141.94.172.213
157.245.113.153
2001:67c:4e8:f004::9
2600:9000:20c3:3e00:6:44e3:f8c0:93a1
2600:9000:20c3:8400:6:44e3:f8c0:93a1
2620:116:800d:21:93ca:31d8:d86e:38f6
2620:116:800d:21:b314:a0ef:ab7c:d546
2a00:1450:4001:81c::200a
2a00:1450:4001:828::2003
54.36.158.42
01e8c64b761cce7a14c9a7f82d4fa2162138e5e6e556350df4730498ea6417bf
0f53e8b0a717ca4ce313eec62b90d41db62c2f4946259a65c93bf8e84c5b0c44
118add53487c02aaf5b5ab9f69380fa06717deb10492e14aaa487e3c62806ad4
18b098f659ecd7962db64b4f3869dc90397b7af9586db5b69e9978e381b0c94f
2031e418ee10af8110729b3f327b968462fc0a9d8d1da095387bb472ccd0dee6
24df88e7e15c4b0b11eccc139235e04384513c803b5221485375b7acee755bac
377cd278f18658918b0c5a00250b9c5694c23df8bbae400ef416d3d1f2c749c7
7178064828016867b23db8d0fd14285d2652c7d1016d04b57d49fd1167f0d6b9
796de064b8d80eba7ccacb8ba67d77fdbcdf4b385c844645d452c24537b3108f
82c663d5ca778ebb05d1137afa6b72a05cfebe14e3c372ac4fd54e814e02be82
84b97b3fa8847b64c6d3833561e4b3146530577171e85ad226578a087db70974
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
acd326a9263ee8c4cbc757fed46333732a0e3f8f48d398cbd4f8e36a09fdaf76
b118e75d35566e9a39095c388a218a6de3e5f0ced9c9bfd5be136f9ba1531890
bc5dcb35fc074321d66b9d7809e286e4afe72c7b08d1e799672126c92150ecd3
c22b7a7ac4c482b8883b3319b1368efbab6890a2b2a87060af153d274f12960b
e23decabee8464b650d1d0241283ba0c469806e14a2199efc5bb41771cb673c1
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f1d083ffaa644c708f11db29707aa57c19246e6d32643b03fee3f82c17b224b3
f6dd7e6f89a3ef0348f8c2ce4ed63e6108d6f13adba337b7f69878530050ae1d