tg-golos.com - urlscan.io

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 6 HTTP transactions. The main IP is 2a06:98c1:3121::3, located in United States and belongs to CLOUDFLARENET, US. The main domain is tg-golos.com.
TLS certificate: Issued by R3 on March 31st 2023. Valid for: 3 months.

This is the only time tg-golos.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Telegram (Instant Messenger)

Domain & IP information

	IP Address	AS Autonomous System
1	2a00:f940:2:2... 2a00:f940:2:2:1:1:0:156	197695 (AS-REG) (AS-REG)
1 1	88.210.14.183 88.210.14.183	207651 (VDSINA-NL) (VDSINA-NL)
4	2a06:98c1:312... 2a06:98c1:3121::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	87.240.185.131 87.240.185.131	47541 (VKONTAKTE...) (VKONTAKTE-SPB-AS vk.com)
6	4

1 2a00:f940:2:2:1:1:0:156 (Russian Federation)

ASN197695 (AS-REG, RU)

my-finance.site	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 88.210.14.183 (Netherlands) 1 redirects

ASN207651 (VDSINA-NL, RU)
PTR: v1893118.hosted-by-vdsina.ru

focusonspace.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a06:98c1:3121::3 (United States)

ASN13335 (CLOUDFLARENET, US)

tg-golos.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 87.240.185.131 (Russian Federation)

ASN47541 (VKONTAKTE-SPB-AS vk.com, RU)
PTR: srv131-185-240-87.vk.com

sun9-4.userapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	tg-golos.com tg-golos.com	107 KB
1	userapi.com sun9-4.userapi.com — Cisco Umbrella Rank: 69163	176 KB
1	focusonspace.com 1 redirects focusonspace.com	713 B
1	my-finance.site my-finance.site	9 KB
6	4

	Domain	Requested by
4	tg-golos.com	tg-golos.com
1	sun9-4.userapi.com	tg-golos.com
1	focusonspace.com	1 redirects
1	my-finance.site
6	4

This site contains no links.

Subject Issuer	Validity	Valid
*.tg-golos.com R3	`2023-03-31` - `2023-06-29`	3 months	crt.sh
*.userapi.com GlobalSign Organization Validation CA - SHA256 - G2	`2023-03-17` - `2024-02-20`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://tg-golos.com/278e7067cb13910a10a82280b5592671
Frame ID: 9D303B75C533EEA70A6E02A9BD2E9370
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Telegram: Конкурс фотографий

Page URL History Show full URLs

http://my-finance.site/ Page URL
https://focusonspace.com/wpQCMz HTTP 302
https://tg-golos.com/278e7067cb13910a10a82280b5592671 Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Page Statistics

6
Requests

83 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

291 kB
Transfer

602 kB
Size

5
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://my-finance.site/ Page URL
https://focusonspace.com/wpQCMz HTTP 302
https://tg-golos.com/278e7067cb13910a10a82280b5592671 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK / Show response
my-finance.site/ 23 KB
9 KB 611ms
509ms Document
text/html 2a00:f940:2:2:1:1:0:156
AS-REG

General

Check archive.org

Show headers Download Go to

Full URL: http://my-finance.site/
Protocol: HTTP/1.1
Server: 2a00:f940:2:2:1:1:0:156 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS
Software: nginx / PHP/8.0.17
Resource Hash: 36573435635414437c6488569bd00132857fba17c8f4caf2b483cac02f28ea3b

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Tue, 23 May 2023 13:08:42 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Server: nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Powered-By: PHP/8.0.17

GET
H2

200

Primary Request 278e7067cb13910a10a82280b5592671 Show response
tg-golos.com/
Redirect Chain

https://focusonspace.com/wpQCMz
https://tg-golos.com/278e7067cb13910a10a82280b5592671

131 KB
27 KB

197ms
163ms

Document
text/html

2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tg-golos.com/278e7067cb13910a10a82280b5592671
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 38de0b5be0ac9e67dfb54e6df9c36b141c70910dbadd01ca8f4f1574fd51a75d

Request headers

Referer: http://my-finance.site/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 7cbd8774efbfbbbc-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Tue, 23 May 2023 13:08:42 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BnKbPhNNQr3m7rtQRgotSEQ8UcgLKEfB28N2uaREgcfwaixsqjqtJw%2Bz1jFz37%2FR4friNVWaag6hV1onhtE7ZdJ6KSwt0EtxE6Wh%2F1tXgtEGpqylQspHf1ugZ2A5TvP%2BGtEy5n098inwSzI%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

Redirect headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Date: Tue, 23 May 2023 13:08:42 GMT
Expires: 0
Location: https://tg-golos.com/278e7067cb13910a10a82280b5592671
Pragma: no-cache
Server: nginx
Vary: Accept-Encoding

GET
H2 200 bootstrap.min.css
tg-golos.com/tme/files/ 42 KB
9 KB 20ms
18ms Stylesheet
text/css 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tg-golos.com/tme/files/bootstrap.min.css
Requested by: Host: tg-golos.com
URL: https://tg-golos.com/278e7067cb13910a10a82280b5592671
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f1d083ffaa644c708f11db29707aa57c19246e6d32643b03fee3f82c17b224b3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tg-golos.com/278e7067cb13910a10a82280b5592671
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 23 May 2023 13:08:42 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sun, 19 Mar 2023 20:31:20 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 14636
etag: W/"64177118-a61b"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QfXKNSznYOKFZekORE32Zf6BeQ75uC01gUOT9w8fVlDmceXtFHfBdOCFykGm5Qdf5sbIp8OpmN3O8EGA%2FKEJEEpGRx2EgvM0lcuPkFN0fRU8gyQ1Zb2op4ruIxKSbhfIjukKGIbDOywyyzY%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=86400
cf-ray: 7cbd8775f933bbbc-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Wed, 24 May 2023 09:04:46 GMT

GET
H2 200 ezZ-T9NZO_o.jpg
sun9-4.userapi.com/impg/GJHuwy5hIxadzDFCcG21kFuW4HofPaJUjYf4Uw/ 176 KB
176 KB 126ms
38ms Image
image/jpeg 87.240.185.131
VKONTAKTE-SPB-AS ...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sun9-4.userapi.com/impg/GJHuwy5hIxadzDFCcG21kFuW4HofPaJUjYf4Uw/ezZ-T9NZO_o.jpg?size=1024x1024&quality=96&sign=439b0d03c52e3b17df58951f3de56062&c_uniq_tag=2UML6E2msUwq3Q1GytWlr7Hs_wAEpH-k04wY5OLETzQ&type=album

Requested by

Host: tg-golos.com
URL: https://tg-golos.com/278e7067cb13910a10a82280b5592671

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

87.240.185.131 , Russian Federation, ASN47541 (VKONTAKTE-SPB-AS vk.com, RU),

Reverse DNS

srv131-185-240-87.vk.com

Software

kittenx /

Resource Hash

65b06b796c145581919c22fb26025c550cf6d74698814606c34a363bd49df7ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tg-golos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 23 May 2023 13:08:42 GMT
strict-transport-security: max-age=15768000
x-frontend: front221103
last-modified: Thu, 01 Jan 1970 00:00:00 GMT
server: kittenx
access-control-allow-methods: GET, HEAD, OPTIONS
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: X-Frontend
x-imp: 839234
cache-control: max-age=2592000
accept-ranges: bytes
access-control-allow-headers: X-Quic
content-length: 179744
expires: Thu, 22 Jun 2023 13:08:42 GMT

GET
H3 200 tgwallpaper.min.js Show response
tg-golos.com/tme/files/ 3 KB
2 KB 21ms
20ms Script
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tg-golos.com/tme/files/tgwallpaper.min.js
Requested by: Host: tg-golos.com
URL: https://tg-golos.com/278e7067cb13910a10a82280b5592671
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2031e418ee10af8110729b3f327b968462fc0a9d8d1da095387bb472ccd0dee6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tg-golos.com/278e7067cb13910a10a82280b5592671
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 23 May 2023 13:08:42 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sun, 19 Mar 2023 20:31:20 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 14345
etag: W/"64177118-ba3"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aITplkT57ynwjhHYZuk9iRio8Wj9TFosATOQdkPBH2F%2BqRZyaXo3YwmEdcBrmT7EletHbcvPMmJZVM%2FYCKxKYSmRSQ1rImRe%2B1uGvgYpdjdNPBQjp7tjZSTieHK%2BUFBouGWUQuSyxzMeU%2B4%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=86400
cf-ray: 7cbd87767d5b3aa3-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Wed, 24 May 2023 09:09:37 GMT

GET
H3 200 pattern.svg
tg-golos.com/tme/files/ 226 KB
69 KB 27ms
27ms Image
image/svg+xml 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tg-golos.com/tme/files/pattern.svg
Requested by: Host: tg-golos.com
URL: https://tg-golos.com/278e7067cb13910a10a82280b5592671
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 118add53487c02aaf5b5ab9f69380fa06717deb10492e14aaa487e3c62806ad4

Request headers

Referer: https://tg-golos.com/278e7067cb13910a10a82280b5592671
Origin: https://tg-golos.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 23 May 2023 13:08:42 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sun, 19 Mar 2023 20:31:20 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 14657
etag: W/"64177118-3891a"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BS6llqj4qZz5c3vhfvNCRdkTsLNO7JYVOAWwiAO48j5I3rjqoCHfyu7blbjMznDcagSw2j50ZMdWinfNAt9nymAaYokzbbXwgQSgN988IOREp%2BiPGhD%2BPKHVb2k7sYVTFr8UKEofpnE7mi4%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
cache-control: max-age=86400
cf-ray: 7cbd87768d753aa3-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Wed, 24 May 2023 09:04:25 GMT

GET
DATA 200
OK truncated
/ 978 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 77c7245862717d06e6aed1bb0804aa07959e081c9e50a6ee51fcceeda6a66fb0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Content-Type: image/svg+xml

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Telegram (Instant Messenger)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
my-finance.site/	1970-01-20 12:00:50	Name: 038e3a2c01dec48f55289226ad604488 Value: 0
focusonspace.com/	1970-01-20 12:45:25	Name: _subid Value: 3r4g0rc8tq
focusonspace.com/	1970-01-20 21:36:47	Name: 6cf31 Value: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjJcIjoxNjg0ODQ3MzIyfSxcImNhbXBhaWduc1wiOntcIjRcIjoxNjg0ODQ3MzIyfSxcInRpbWVcIjoxNjg0ODQ3MzIyfSJ9.cH4jCfLUzisnBtetwUZjcwngJZAd1cFNpX0leG7KgaE
.tg-golos.com/	1970-01-20 20:46:23	Name: __ddg1_ Value: HtDeqEUiHzok6CKhobis
tg-golos.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 4f9ub7g0tjc0djj6tn3sjpeice

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

focusonspace.com
my-finance.site
sun9-4.userapi.com
tg-golos.com
2a00:f940:2:2:1:1:0:156
2a06:98c1:3121::3
87.240.185.131
88.210.14.183
118add53487c02aaf5b5ab9f69380fa06717deb10492e14aaa487e3c62806ad4
2031e418ee10af8110729b3f327b968462fc0a9d8d1da095387bb472ccd0dee6
36573435635414437c6488569bd00132857fba17c8f4caf2b483cac02f28ea3b
38de0b5be0ac9e67dfb54e6df9c36b141c70910dbadd01ca8f4f1574fd51a75d
65b06b796c145581919c22fb26025c550cf6d74698814606c34a363bd49df7ba
77c7245862717d06e6aed1bb0804aa07959e081c9e50a6ee51fcceeda6a66fb0
f1d083ffaa644c708f11db29707aa57c19246e6d32643b03fee3f82c17b224b3

tg-golos.com Open in urlscan Pro 2a06:98c1:3121::3 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

6 Requests

83 %HTTPS

50 %IPv6

4 Domains

4 Subdomains

4 IPs

3 Countries

291 kBTransfer

602 kBSize

5 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

5 Cookies

Indicators

tg-golos.com Open in urlscan Pro
2a06:98c1:3121::3 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

83 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

291 kB
Transfer

602 kB
Size

5
Cookies

6 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!