![](/screenshots/4a6035f9-a256-4517-ba7b-da88eb5edc39.png)
black-catherine-38.tiiny.site
Open in
urlscan Pro
2600:9000:20ed:1a00:19:266d:4200:93a1
Malicious Activity!
Public Scan
Effective URL: https://black-catherine-38.tiiny.site/
Submission: On November 21 via automatic, source openphish — Scanned from US
Summary
TLS certificate: Issued by Amazon RSA 2048 M01 on February 10th 2023. Valid for: a year.
This is the only time black-catherine-38.tiiny.site was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Telegram (Instant Messenger)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 2 | 69.61.26.123 69.61.26.123 | 22653 (GLOBALCOM...) (GLOBALCOMPASS) | |
1 | 2607:f8b0:400... 2607:f8b0:4004:c08::9d | 15169 (GOOGLE) (GOOGLE) | |
2 | 2607:f8b0:400... 2607:f8b0:4004:c08::61 | 15169 (GOOGLE) (GOOGLE) | |
3 | 2607:f8b0:400... 2607:f8b0:4004:c17::9b | 15169 (GOOGLE) (GOOGLE) | |
3 | 2607:f8b0:400... 2607:f8b0:4004:c06::8b | 15169 (GOOGLE) (GOOGLE) | |
1 | 2607:f8b0:400... 2607:f8b0:4004:c07::84 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2600:9000:20e... 2600:9000:20ed:1a00:19:266d:4200:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
5 | 2001:67c:4e8:... 2001:67c:4e8:f004::9 | 62041 (TELEGRAM) (TELEGRAM) | |
2 | 13.224.214.70 13.224.214.70 | 16509 (AMAZON-02) (AMAZON-02) | |
2 | 3.10.126.206 3.10.126.206 | 16509 (AMAZON-02) (AMAZON-02) | |
1 2 | 2a02:4780:b:1... 2a02:4780:b:1043:0:2294:cbc4:2 | 47583 (AS-HOSTINGER) (AS-HOSTINGER) | |
23 | 12 |
ASN15169 (GOOGLE, US)
securepubads.g.doubleclick.net |
ASN15169 (GOOGLE, US)
fecb2cb7ac0c8453944a92a5211e85b7.safeframe.googlesyndication.com |
ASN16509 (AMAZON-02, US)
black-catherine-38.tiiny.site |
ASN16509 (AMAZON-02, US)
PTR: server-13-224-214-70.phl50.r.cloudfront.net
tiiny.host |
ASN16509 (AMAZON-02, US)
PTR: ec2-3-10-126-206.eu-west-2.compute.amazonaws.com
analytics.tiiny.site |
ASN47583 (AS-HOSTINGER, CY)
www.top4top.me | |
a.top4top.me |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
telegram.org
telegram.org — Cisco Umbrella Rank: 11259 |
122 KB |
3 |
tiiny.site
black-catherine-38.tiiny.site analytics.tiiny.site |
7 KB |
3 |
google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 27 |
21 KB |
3 |
doubleclick.net
securepubads.g.doubleclick.net — Cisco Umbrella Rank: 196 |
137 KB |
2 |
top4top.me
1 redirects
www.top4top.me a.top4top.me |
50 KB |
2 |
tiiny.host
tiiny.host |
16 KB |
2 |
googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 35 |
146 KB |
2 |
cutt.us
1 redirects
cutt.us |
2 KB |
1 |
googlesyndication.com
fecb2cb7ac0c8453944a92a5211e85b7.safeframe.googlesyndication.com pagead2.googlesyndication.com Failed |
3 KB |
1 |
googletagservices.com
www.googletagservices.com — Cisco Umbrella Rank: 212 |
30 KB |
23 | 10 |
Domain | Requested by | |
---|---|---|
5 | telegram.org |
black-catherine-38.tiiny.site
telegram.org |
3 | www.google-analytics.com |
www.googletagmanager.com
www.google-analytics.com |
3 | securepubads.g.doubleclick.net |
www.googletagservices.com
securepubads.g.doubleclick.net |
2 | analytics.tiiny.site |
black-catherine-38.tiiny.site
analytics.tiiny.site |
2 | tiiny.host |
black-catherine-38.tiiny.site
|
2 | www.googletagmanager.com |
cutt.us
www.googletagmanager.com |
2 | cutt.us | 1 redirects |
1 | a.top4top.me |
black-catherine-38.tiiny.site
|
1 | www.top4top.me | 1 redirects |
1 | black-catherine-38.tiiny.site |
cutt.us
|
1 | fecb2cb7ac0c8453944a92a5211e85b7.safeframe.googlesyndication.com |
securepubads.g.doubleclick.net
|
1 | www.googletagservices.com |
cutt.us
|
0 | pagead2.googlesyndication.com Failed |
securepubads.g.doubleclick.net
|
23 | 13 |
This site contains links to these domains. Also see Links.
Domain |
---|
tiiny.host |
t.me |
Subject Issuer | Validity | Valid | |
---|---|---|---|
cutt.us R3 |
2023-10-01 - 2023-12-30 |
3 months | crt.sh |
*.g.doubleclick.net GTS CA 1C3 |
2023-10-23 - 2024-01-15 |
3 months | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2023-10-23 - 2024-01-15 |
3 months | crt.sh |
*.tiiny.site Amazon RSA 2048 M01 |
2023-02-10 - 2024-03-10 |
a year | crt.sh |
*.telegram.org Go Daddy Secure Certificate Authority - G2 |
2023-08-11 - 2024-09-11 |
a year | crt.sh |
tiiny.host Amazon RSA 2048 M01 |
2023-04-10 - 2024-05-08 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://black-catherine-38.tiiny.site/
Frame ID: 128D17AC8E1CA2439E40B744BEBBE8CD
Requests: 22 HTTP requests in this frame
Frame:
https://fecb2cb7ac0c8453944a92a5211e85b7.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: ECBE83EDFC66FAE6052CB68249262C86
Requests: 1 HTTP requests in this frame
Screenshot
![](/screenshots/4a6035f9-a256-4517-ba7b-da88eb5edc39.png)
Page Title
Telegram: Join Group ChatPage URL History Show full URLs
-
http://cutt.us/porn-pool?fbclid=IwAR2JLCYqOmUiR2KRjbc8vkdRR9ebjzwusdNR2PgsS27WT61dST87OQf2KgE
HTTP 301
https://cutt.us/porn-pool?fbclid=IwAR2JLCYqOmUiR2KRjbc8vkdRR9ebjzwusdNR2PgsS27WT61dST87OQf2KgE Page URL
- https://black-catherine-38.tiiny.site/ Page URL
Detected technologies
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Detected patterns
- googletagservices\.com/tag/js/gpt(?:_mobile)?\.js
Detected patterns
- googlesyndication\.com/
Detected patterns
- google-analytics\.com/(?:ga|urchin|analytics)\.js
![](/vendor/wappa/icons/Google Tag Manager.png)
Detected patterns
- googletagmanager\.com/gtag/js
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://cutt.us/porn-pool?fbclid=IwAR2JLCYqOmUiR2KRjbc8vkdRR9ebjzwusdNR2PgsS27WT61dST87OQf2KgE
HTTP 301
https://cutt.us/porn-pool?fbclid=IwAR2JLCYqOmUiR2KRjbc8vkdRR9ebjzwusdNR2PgsS27WT61dST87OQf2KgE Page URL
- https://black-catherine-38.tiiny.site/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://cutt.us/porn-pool?fbclid=IwAR2JLCYqOmUiR2KRjbc8vkdRR9ebjzwusdNR2PgsS27WT61dST87OQf2KgE HTTP 301
- https://cutt.us/porn-pool?fbclid=IwAR2JLCYqOmUiR2KRjbc8vkdRR9ebjzwusdNR2PgsS27WT61dST87OQf2KgE
- https://www.top4top.me/do.php?imgf=top4top_mefff2c2955c041.jpg HTTP 301
- https://a.top4top.me/uploads/top4top_mefff2c2955c041.jpg
23 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
porn-pool
cutt.us/ Redirect Chain
|
3 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gpt.js
www.googletagservices.com/tag/js/ |
98 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
186 KB 67 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pubads_impl.js
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311130101/ |
430 KB 135 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ppub_config
securepubads.g.doubleclick.net/pagead/ |
40 B 583 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
222 KB 79 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
52 KB 21 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
www.google-analytics.com/g/ |
0 156 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
www.google-analytics.com/j/ |
1 B 91 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ads
securepubads.g.doubleclick.net/gampad/ |
762 B 777 B |
Fetch
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
container.html
fecb2cb7ac0c8453944a92a5211e85b7.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame ECBE |
6 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
black-catherine-38.tiiny.site/ |
5 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
sodar
pagead2.googlesyndication.com/getconfig/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-roboto.css
telegram.org/css/ |
6 KB 894 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
telegram.org/css/ |
42 KB 10 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
telegram.css
telegram.org/css/ |
112 KB 29 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ad-script.js
tiiny.host/ |
981 B 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
plausible.js
analytics.tiiny.site/js/ |
1 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
top4top_mefff2c2955c041.jpg
a.top4top.me/uploads/ Redirect Chain
|
49 KB 49 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tgwallpaper.min.js
telegram.org/js/ |
3 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pattern.svg
telegram.org/img/tgme/ |
226 KB 81 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
event
analytics.tiiny.site/api/ |
2 B 363 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ad.png
tiiny.host/assets/img/ |
14 KB 15 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- pagead2.googlesyndication.com
- URL
- https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202311130101&st=env
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Telegram (Instant Messenger)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture object| TWallpaper function| plausible7 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.cutt.us/ | Name: _ga_ZBQ2JYBBZ5 Value: GS1.1.1700536225.1.0.1700536225.0.0.0 |
|
.cutt.us/ | Name: _ga Value: GA1.2.1735303001.1700536226 |
|
.cutt.us/ | Name: _gid Value: GA1.2.1895029231.1700536226 |
|
.cutt.us/ | Name: _gat_gtag_UA_31510493_1 Value: 1 |
|
.doubleclick.net/ | Name: test_cookie Value: CheckForPermission |
|
.cutt.us/ | Name: __gads Value: ID=8612206046b9d716:T=1700536225:RT=1700536225:S=ALNI_Mb-Bl08gkB9rcMqyomkPr6NMiMDEQ |
|
.cutt.us/ | Name: __gpi Value: UID=00000da30b5a3e0f:T=1700536225:RT=1700536225:S=ALNI_Mab-Li6VCStngqRI7eyRHYIz_wJVQ |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000; includeSubdomains; |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
a.top4top.me
analytics.tiiny.site
black-catherine-38.tiiny.site
cutt.us
fecb2cb7ac0c8453944a92a5211e85b7.safeframe.googlesyndication.com
pagead2.googlesyndication.com
securepubads.g.doubleclick.net
telegram.org
tiiny.host
www.google-analytics.com
www.googletagmanager.com
www.googletagservices.com
www.top4top.me
pagead2.googlesyndication.com
13.224.214.70
2001:67c:4e8:f004::9
2600:9000:20ed:1a00:19:266d:4200:93a1
2607:f8b0:4004:c06::8b
2607:f8b0:4004:c07::84
2607:f8b0:4004:c08::61
2607:f8b0:4004:c08::9d
2607:f8b0:4004:c17::9b
2a02:4780:b:1043:0:2294:cbc4:2
3.10.126.206
69.61.26.123
118add53487c02aaf5b5ab9f69380fa06717deb10492e14aaa487e3c62806ad4
2031e418ee10af8110729b3f327b968462fc0a9d8d1da095387bb472ccd0dee6
246dc777e722a99301034c2a4c4cd8c94dfe14d8ad71952b5c4794e122f00198
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
3489953f74f37b2505d58bdaeeaad952d0eaaf77b4f59d5a8ed6fd18d4ebc996
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
54a1804d44aa9e15874c2ccb3917decb5ad82118dac7cc1af466ab449dc7b7d9
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
7aa30c62438ded3d1a4f6cacf5c773b7cdc23b6642b499c10ed233d3fb711a21
7eec3429c76cb48e5fd457c5afb71b7cf34bc4298d53023bae8aea715443b4a9
84b97b3fa8847b64c6d3833561e4b3146530577171e85ad226578a087db70974
87960e7994f9fc5f6d2fc8c0b93be02f4b9b7cdca0dd9c726f5806d8e9092068
8c5694a85ad609965155188c7995aeca3f28ee6eaa00d2225380fb5a63c69c8e
a62574a226521160282d55fa0e3e6bed6f79486df00cce16e5878c74d7c7024c
acd326a9263ee8c4cbc757fed46333732a0e3f8f48d398cbd4f8e36a09fdaf76
ae784a79cba674c9c0679ed64c8cf5b8733b0dcd130a465e696a73b7e1b4000a
b22ed9a407a3b036f7b8e3416bbc3a2b1be6d4ff728eed123f17219d25d2d586
d0f489933768164814297a949d026f57f0ee4120eb45f0553b253ce6772a23a5
d430f4ee3052d1be7f2aca302e6899c63bc6e8b135d9248597ec6672e4d052a3
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f1d083ffaa644c708f11db29707aa57c19246e6d32643b03fee3f82c17b224b3