![](/screenshots/2e42b629-1829-49a6-982d-f783ead6f423.png)
hot-vidio-viralmelayu.ip1-kd.com
Open in
urlscan Pro
2606:4700:3037::ac43:8a6a
Malicious Activity!
Public Scan
Submission: On January 25 via api from US — Scanned from US
Summary
This is the only time hot-vidio-viralmelayu.ip1-kd.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Telegram (Instant Messenger)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
6 | 2606:4700:303... 2606:4700:3037::ac43:8a6a | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a04:4e42:600... 2a04:4e42:600::649 | 54113 (FASTLY) (FASTLY) | |
7 | 3 |
ASN13335 (CLOUDFLARENET, US)
hot-vidio-viralmelayu.ip1-kd.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
ip1-kd.com
hot-vidio-viralmelayu.ip1-kd.com |
46 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 760 |
30 KB |
7 | 2 |
Domain | Requested by | |
---|---|---|
6 | hot-vidio-viralmelayu.ip1-kd.com |
hot-vidio-viralmelayu.ip1-kd.com
|
1 | code.jquery.com |
hot-vidio-viralmelayu.ip1-kd.com
|
7 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2023-07-11 - 2024-07-14 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
http://hot-vidio-viralmelayu.ip1-kd.com/join/
Frame ID: 2D3727E22CA1FBBA57F8E947B81F3E47
Requests: 8 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
hot-vidio-viralmelayu.ip1-kd.com/join/ |
7 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.3c9dcec00d5a12b9aa18.css
hot-vidio-viralmelayu.ip1-kd.com/join/lib/ |
81 KB 19 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
1f1f2-1f1fe.png
hot-vidio-viralmelayu.ip1-kd.com/join/lib/img-apple-160/ |
20 KB 20 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.5.1.min.js
code.jquery.com/ |
87 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
chat-bg-br.f34cc96fbfb048812820.png
hot-vidio-viralmelayu.ip1-kd.com/join/lib/ |
1 KB 1 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
chat-bg-pattern-light.ee148af944f6580293ae.png
hot-vidio-viralmelayu.ip1-kd.com/join/lib/ |
1 KB 1 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
telegram-logo.1b2bb5b107f046ea9325.svg
hot-vidio-viralmelayu.ip1-kd.com/join/lib/ |
932 B 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
244 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Telegram (Instant Messenger)10 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery object| flag object| backdrop object| backd object| inpHp object| btnnext function| set_item function| aktip function| loadd0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=63072000; includeSubDomains; preload |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
code.jquery.com
hot-vidio-viralmelayu.ip1-kd.com
2606:4700:3037::ac43:8a6a
2a04:4e42:600::649
6b9e73b25890fe9c309feff6ef849db08babba9c055b169c20815866d264f3ef
6c5b1e0817a7504af4900ccb7ea89256070d1fa4c9e773292a3774d04f647f82
9b25fe0a8ffd906e6afcb2b0cbe2ce64e16bd05c82a352903555c4e4e9cce2a4
a3e7b79bd9246592718746c638b735658b01250633aacd35dcc7dcff8a4546d8
ade1ddec66f6e98e30d8a56b01e7dd9d2c84a8f4dac51bc88d2ab5bc6e5d1a62
e6062c84dad8214905441068499eab28629a11de5dd651c0aed48f6481eaacba
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d