t.me-join.com
Open in
urlscan Pro
2606:4700:20::681a:661
Malicious Activity!
Public Scan
Submission: On March 31 via manual from UA — Scanned from DE
Summary
TLS certificate: Issued by E1 on February 19th 2024. Valid for: 3 months.
This is the only time t.me-join.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Telegram (Instant Messenger)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 10 | 2606:4700:20:... 2606:4700:20::681a:661 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 162.19.58.157 162.19.58.157 | 16276 (OVH) (OVH) | |
1 | 2001:67c:4e8:... 2001:67c:4e8:f004::9 | 62041 (TELEGRAM) (TELEGRAM) | |
10 | 3 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
me-join.com
2 redirects
t.me-join.com |
95 KB |
1 |
telegram.org
telegram.org — Cisco Umbrella Rank: 10592 |
15 KB |
1 |
ibb.co
i.ibb.co — Cisco Umbrella Rank: 11763 |
30 KB |
10 | 3 |
Domain | Requested by | |
---|---|---|
10 | t.me-join.com |
2 redirects
t.me-join.com
|
1 | telegram.org | |
1 | i.ibb.co |
t.me-join.com
|
10 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
me-join.com E1 |
2024-02-19 - 2024-05-19 |
3 months | crt.sh |
ibb.co R3 |
2024-02-07 - 2024-05-07 |
3 months | crt.sh |
*.telegram.org Go Daddy Secure Certificate Authority - G2 |
2023-08-11 - 2024-09-11 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://t.me-join.com/vysotskaya.l_ph
Frame ID: F7D1A40F20BAF3693A65A5E2E058EE3C
Requests: 6 HTTP requests in this frame
Frame:
https://t.me-join.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/dc6b543c1346/main.js
Frame ID: 6D14A726FA15DC8DA4735598E7F88357
Requests: 4 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 4- https://t.me-join.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
- https://t.me-join.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/dc6b543c1346/main.js
- https://t.me-join.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
- https://t.me-join.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/dc6b543c1346/main.js
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
Primary Request
vysotskaya.l_ph
t.me-join.com/ |
23 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1.jpg
i.ibb.co/YdKf71F/ |
30 KB 30 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
rocket-loader.min.js
t.me-join.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/ |
12 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
pattern.svg
t.me-join.com/smeans/files/ |
226 KB 69 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
c840961d9ed64faa904abe800c24a94d.min.js
t.me-join.com/smeans/files/ |
10 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
main.js
t.me-join.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/dc6b543c1346/ Frame 6D14 Redirect Chain
|
8 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
86ccd2b018cf6983
t.me-join.com/cdn-cgi/challenge-platform/h/g/jsd/r/ Frame 6D14 |
0 596 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
main.js
t.me-join.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/dc6b543c1346/ Frame 6D14 Redirect Chain
|
8 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
telegram.org/img/ |
15 KB 15 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
86ccd2b018cf6983
t.me-join.com/cdn-cgi/challenge-platform/h/g/jsd/r/ Frame 6D14 |
0 598 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Telegram (Instant Messenger)13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| onpagereveal object| __cfQR function| _0x39ed function| _0x2e96 object| TWallpaper function| _0x28efda function| _0x327b object| tme_bg function| _0x485e function| toggleTheme object| darkMedia boolean| __cfRLUnblockHandlers2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
t.me-join.com/ | Name: PHPSESSID Value: kvi3ucudtp3ua9p4cd734827tf |
|
.me-join.com/ | Name: cf_clearance Value: QMqQzX0TOtjwY1KwAuBtvmYGlTjawSDcEWpRnLYAlfY-1711851236-1.0.1.1-j9UAS5IwbUPIYYYjmXqXjft.2MqABk59asH.xeHgSxLtYRX4pql8iNoGNttfr0veufH6.F1y6LxPbVL_1mk5.g |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
i.ibb.co
t.me-join.com
telegram.org
162.19.58.157
2001:67c:4e8:f004::9
2606:4700:20::681a:661
118add53487c02aaf5b5ab9f69380fa06717deb10492e14aaa487e3c62806ad4
317208c3092a386a4573fd35aea21e7334e4db4350334a4146b2edbe072ebdc3
4ff54bc38c267dc3a8c95f6ed4590336baaec70433ef15d027ddca608c391e78
6a3274f1b91444c5e40bdd720a4a344c8eb174036750852409b0ffe21991a9d9
7a40919441db7d091baebcd1ca73b191126e6530a220e846f508e12409ea6de3
94796893ab48d97d3a9d5a64282908deb66e4658dbd65a6b37890d39947ae31a
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
cf241256ff194731c72ae97b290bbcca13a1fd7bac6ad2291668be0685c22ee0
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855