instansetg1.ru Open in urlscan Pro
2606:4700:3037::6815:518a  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request f4a10f5257dfb14c0098bbf63f2f28e2 Show response instansetg1.ru/	23 KB 7 KB	1160ms 676ms	Document text/html	2606:4700:3037::6815:518a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://instansetg1.ru/f4a10f5257dfb14c0098bbf63f2f28e2 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::6815:518a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 994aeb3c8af74d956d0e1762731cee5b51614e5ba2d795edb96e098dc1d69dc4 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 accept-language en-US,en;q=0.9 sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers alt-svc h3=":443"; ma=86400 cache-control no-store, no-cache, must-revalidate cf-cache-status DYNAMIC cf-ray 86ea0f8e8e034bbb-BUF content-encoding br content-type text/html; charset=UTF-8 date Wed, 03 Apr 2024 15:23:36 GMT expires Thu, 19 Nov 1981 08:52:00 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} pragma no-cache report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2fwl1ipThoJgW9tUuxtudjbjEqFPLrgCnrznBt5mXqaEnX%2FF6JLRza0T69eYYB1qOA%2BsuAF6KyKAruQaoKgsRY1OqmRuZL3iXAaohlwpG7hE6KlObMUQjknxo4UoDdomj0s4KlBseuFqW35Pig%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding
GET H2	200	1644367455_1-abrakadabra-fun-p-pushkin-klipart-2.png abrakadabra.fun/uploads/posts/2022-02/thumbs/	203 KB 203 KB	492ms 120ms	Image image/png	145.239.217.69 OVH
General Check archive.org Show headers Download Go to Show image Full URL https://abrakadabra.fun/uploads/posts/2022-02/thumbs/1644367455_1-abrakadabra-fun-p-pushkin-klipart-2.png?9EHlWgG6aFBZjzS Requested by Host: instansetg1.ru URL: https://instansetg1.ru/f4a10f5257dfb14c0098bbf63f2f28e2 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 145.239.217.69 , France, ASN16276 (OVH, FR), Reverse DNS ip69.ip-145-239-217.eu Software nginx / Resource Hash 792334fdb13ebb2c5e7c1e6411ed5561026d40486fc58c56c5fb6331668e1092 Security Headers Name Value Strict-Transport-Security max-age=63072000 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://instansetg1.ru/ accept-language en-US,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 03 Apr 2024 15:23:37 GMT strict-transport-security max-age=63072000 last-modified Wed, 09 Feb 2022 00:43:26 GMT server nginx etag "62030e2e-32bf2" content-type image/png accept-ranges bytes content-length 207858
GET H3	200	c840961d9ed64faa904abe800c24a94d.min.js Show response instansetg1.ru/smeans/files/	10 KB 4 KB	289ms 288ms	Script application/javascript	172.67.189.158 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://instansetg1.ru/smeans/files/c840961d9ed64faa904abe800c24a94d.min.js?Lk1jZlRv2EVrxKb Requested by Host: instansetg1.ru URL: https://instansetg1.ru/f4a10f5257dfb14c0098bbf63f2f28e2 Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.189.158 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 94796893ab48d97d3a9d5a64282908deb66e4658dbd65a6b37890d39947ae31a Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://instansetg1.ru/f4a10f5257dfb14c0098bbf63f2f28e2 accept-language en-US,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 03 Apr 2024 15:23:37 GMT content-encoding br cf-cache-status MISS last-modified Tue, 22 Aug 2023 22:17:36 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"64e53400-28b6" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=r2Kn6WvJeuBTrI%2BOmJMvoZfyuKsIrwifAB8E2NNS7kqeeu0FhGf%2F0%2Flig%2BEsjJPggP5YWp2YA%2FyxEhYUbpiPekaJKpH3DoSr145DvAykTnUsc0dwoYSva5in3VZ9R7Fwow%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=86400 cf-ray 86ea0f92e877116b-ORD alt-svc h3=":443"; ma=86400 expires Thu, 04 Apr 2024 15:23:36 GMT
GET H3	200	pattern.svg instansetg1.ru/smeans/files/	226 KB 69 KB	618ms 613ms	Image image/svg+xml	172.67.189.158 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://instansetg1.ru/smeans/files/pattern.svg?ybtinmrg_ Requested by Host: instansetg1.ru URL: https://instansetg1.ru/f4a10f5257dfb14c0098bbf63f2f28e2 Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.189.158 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 118add53487c02aaf5b5ab9f69380fa06717deb10492e14aaa487e3c62806ad4 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://instansetg1.ru/f4a10f5257dfb14c0098bbf63f2f28e2 Origin https://instansetg1.ru accept-language en-US,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 03 Apr 2024 15:23:37 GMT content-encoding br cf-cache-status MISS last-modified Sun, 19 Mar 2023 20:31:20 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"64177118-3891a" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SlHNWrCUnjT6rwWp4A%2BR%2FCNJYU0lsZYkq05zTkkVrbgn0GwVm06YhLMFS%2Bcioqms7ZUopyEbyi066NJjmpdWjtehWsMs0k8uDD%2By2cTKNaZ%2BwBAbNgoyfzOryXGk1Que1A%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml cache-control max-age=86400 cf-ray 86ea0f940a9d116b-ORD alt-svc h3=":443"; ma=86400 expires Thu, 04 Apr 2024 15:23:37 GMT
GET DATA	200 OK	truncated /	978 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 77c7245862717d06e6aed1bb0804aa07959e081c9e50a6ee51fcceeda6a66fb0 Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	favicon.ico telegram.org/img/	15 KB 15 KB	382ms 111ms	Other image/x-icon	2001:67c:4e8:f004::9 TELEGRAM
General Check archive.org Show headers Download Go to Full URL https://telegram.org/img/favicon.ico?R0mkn2h4pFQ9YsK Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2001:67c:4e8:f004::9 Amsterdam, Netherlands, ASN62041 (TELEGRAM, VG), Reverse DNS Software nginx/1.18.0 / Resource Hash 4ff54bc38c267dc3a8c95f6ed4590336baaec70433ef15d027ddca608c391e78 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://instansetg1.ru/ accept-language en-US,en;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 03 Apr 2024 15:23:38 GMT strict-transport-security max-age=31536000; includeSubDomains; preload last-modified Thu, 21 Apr 2022 13:47:47 GMT server nginx/1.18.0 etag "62616083-3aee" content-type image/x-icon cache-control max-age=604800 accept-ranges bytes content-length 15086 expires Wed, 10 Apr 2024 15:23:38 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Telegram (Instant Messenger)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| _0x39ed function| _0x2e96 object| TWallpaper function| _0x28efda function| _0x327b object| tme_bg function| _0x485e function| toggleTheme object| darkMedia

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			instansetg1.ru/	1969-12-31 23:59:59	Name: PHPSESSID Value: 3s1m00p9ktq2gjfnju6lan4m1i

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

abrakadabra.fun
instansetg1.ru
telegram.org
145.239.217.69
172.67.189.158
2001:67c:4e8:f004::9
2606:4700:3037::6815:518a
118add53487c02aaf5b5ab9f69380fa06717deb10492e14aaa487e3c62806ad4
4ff54bc38c267dc3a8c95f6ed4590336baaec70433ef15d027ddca608c391e78
77c7245862717d06e6aed1bb0804aa07959e081c9e50a6ee51fcceeda6a66fb0
792334fdb13ebb2c5e7c1e6411ed5561026d40486fc58c56c5fb6331668e1092
94796893ab48d97d3a9d5a64282908deb66e4658dbd65a6b37890d39947ae31a
994aeb3c8af74d956d0e1762731cee5b51614e5ba2d795edb96e098dc1d69dc4