urlscan.io logo urlscan.io
SecurityTrails logo

telegram-team.com Open in urlscan Pro
172.67.197.58  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://telegram-team.com/
Effective URL: https://telegram-team.com/noverification
Submission: On August 17 via automatic, source certstream-suspicious — Scanned from CA
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 5 HTTP transactions. The main IP is 172.67.197.58, located in United States and belongs to CLOUDFLARENET, US. The main domain is telegram-team.com.
TLS certificate: Issued by WE1 on August 16th 2024. Valid for: 3 months.
This is the only time telegram-team.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Community Verdicts: Malicious — 1 votes Show Verdicts

Domain & IP information

IP Address AS Autonomous System
1 6 172.67.197.58 13335 (CLOUDFLAR...)
5 1
Apex Domain
Subdomains		 Transfer
6 telegram-team.com
telegram-team.com
84 KB
5 1
Domain Requested by
6 telegram-team.com 1 redirects telegram-team.com
5 1

This site contains no links.

Subject Issuer Validity Valid
telegram-team.com
WE1		 2024-08-16 -
2024-11-14		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://telegram-team.com/noverification
Frame ID: CEC5D95D5518E2FD524B162DAB4ADBAC
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Telegram Web

Page URL History Show full URLs

  1. https://telegram-team.com/ HTTP 302
    https://telegram-team.com/noverification Page URL

Page Statistics

5
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

83 kB
Transfer

383 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://telegram-team.com/ HTTP 302
    https://telegram-team.com/noverification Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request noverification
telegram-team.com/
Redirect Chain
  • https://telegram-team.com/
  • https://telegram-team.com/noverification
1 KB
844 B 		Document
General
Check archive.org
Download Go to
Full URL
https://telegram-team.com/noverification
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.197.58 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b9d8a9a26f910d54dd580ed1c5a157b4270fe9cee7c50734eadac7a0949b8efe

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8b4b5a65a947a247-YYZ
content-encoding
br
content-type
text/html; charset=utf-8
date
Sat, 17 Aug 2024 17:23:38 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hexCGFZuC5z5eeWxoQAjsdEljuru1cctLkejFomHj%2F5pdZdZnyp5UxuWHpsDHPqlcXzvhR7k69el85mzJKdymevYvBC7ade%2BiihVG4QN%2B5HNt9Ne7JGsZcKjDZ%2BUNtkGkCy2aA%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare

Redirect headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8b4b5a63e807a247-YYZ
content-type
text/html; charset=utf-8
date
Sat, 17 Aug 2024 17:23:38 GMT
location
/noverification
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=34%2FvHXW5rNKGmPUumAi9TGbm8s42xkXfhxaMHb%2BI2fWxCn9UbTD78WCFuDH3u9oBC%2F6USE5VFEKZW5B7vzeJiIxvmbNbK%2Bmp%2FJc%2FTBUswNTcTsxhPYs2g10yK2tykOJh8nSHdw%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
style.css
telegram-team.com/static/css/ 		6 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://telegram-team.com/static/css/style.css
Requested by
Host: telegram-team.com
URL: https://telegram-team.com/noverification
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.197.58 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6b4c588529c0e9148b10d6cb844a83e4a3885d2cd8695dd9ed2af95b8585d108

Request headers

Referer
https://telegram-team.com/noverification
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Sat, 17 Aug 2024 17:23:39 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Tue, 19 Mar 2024 10:04:26 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"65f9632a-1931"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rIMezxzkUyLb9b5PXUzmK0Yw0ulZ99HcPJU7%2Flug%2BZLi%2BRNbgns6%2BgfG2kn8TLi61Ny%2F00gxpLrAajQHDYOQGNrUGiYw59ipLeVPNoiuUrtucde4aXJUQTEIl4iNV1PkNRIaiw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
8b4b5a67693254a3-YYZ
alt-svc
h3=":443"; ma=86400
lottie.min.js
telegram-team.com/static/js/ 		256 KB
65 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://telegram-team.com/static/js/lottie.min.js
Requested by
Host: telegram-team.com
URL: https://telegram-team.com/noverification
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.197.58 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
af984a30689e85c3e3d3a6fc27db32c77b60032f792c8e4c4583595881c4d49e

Request headers

Referer
https://telegram-team.com/noverification
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Sat, 17 Aug 2024 17:23:39 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Tue, 19 Mar 2024 10:04:29 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"65f9632d-3ff9b"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2vkOFgwJTgCLVOtuvP9DFW2%2FNZLcG3IdxIEEX4bOoZ%2F5CPs3PwLGLR%2FUB9F1Ord8piuokV5tmxsSE9hTfvfh3x2s298Qq3i8jbjnNiGCYm60qHaHuRBSGG%2By0eVMXRtAVa6sAQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
8b4b5a67693354a3-YYZ
alt-svc
h3=":443"; ma=86400
confirm.json
telegram-team.com/static/lottie/ 		118 KB
13 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://telegram-team.com/static/lottie/confirm.json
Requested by
Host: telegram-team.com
URL: https://telegram-team.com/static/js/lottie.min.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.197.58 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e023fcf874618fd9faf073cfd7d66428021f7b8349821fc6e8d58f027cc87416

Request headers

Referer
https://telegram-team.com/noverification
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Sat, 17 Aug 2024 17:23:39 GMT
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Tue, 19 Mar 2024 10:04:30 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"65f9632e-1d688"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YhxxRanyzhqSs75EbU3FtyA0Bzjbg%2Be9aHs80yAW1q7f0O%2FgeMiFGV9BxL0%2BGFNIsgma4Dpl7376AFsmzUUWt6Kq15yvIe6pND6lzPAL6YF7yA%2BJkZVAgV8VBh0j7zYjnI%2FgvA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/json
cf-ray
8b4b5a6cbc2354a3-YYZ
alt-svc
h3=":443"; ma=86400
favicon-32x32.png
telegram-team.com/static/images/ 		2 KB
2 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://telegram-team.com/static/images/favicon-32x32.png
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.197.58 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8e18aee6e70418e31cb2bb69f441ef33083586dd3a5c5d1d335562b840a9ac87

Request headers

Referer
https://telegram-team.com/noverification
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Sat, 17 Aug 2024 17:23:39 GMT
cf-cache-status
MISS
last-modified
Tue, 19 Mar 2024 10:04:27 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"65f9632b-708"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ztegFH00ohx8ikrD%2FX72FP%2BsoFGbxYwgEMSD88XVfhWVGJCsxxeDOGxq2njsNXcGWE0ZeWHPsxj%2FNb0QfNYmHjrlsF11ycc0tX%2B4ezPvj2wI%2FKw4z8q1m0kBvszJA3gsU8OQiw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
8b4b5a6cdc3654a3-YYZ
alt-svc
h3=":443"; ma=86400
content-length
1800

Verdicts & Comments Add Verdict or Comment

Malicious page.domain
Submitted on September 29th 2024, 2:57:53 pm UTC — From Netherlands

Threats: Phishing
Brands: Telegram US
Comment: Сайт выдает себя за телеграмм с целью кражи аккаунта

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| lottie object| bodymovin object| animation

0 Cookies