telega-golos.com - urlscan.io

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 6 HTTP transactions. The main IP is 2606:4700:3033::6815:3cc8, located in United States and belongs to CLOUDFLARENET, US. The main domain is telega-golos.com.
TLS certificate: Issued by GTS CA 1P5 on April 4th 2023. Valid for: 3 months.

This is the only time telega-golos.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Telegram (Instant Messenger)

Domain & IP information

	IP Address	AS Autonomous System
1	2a00:f940:2:2... 2a00:f940:2:2:1:3:0:233	197695 (AS-REG) (AS-REG)
1 1	46.151.30.174 46.151.30.174	207651 (VDSINA-NL) (VDSINA-NL)
4	2606:4700:303... 2606:4700:3033::6815:3cc8	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	87.240.185.131 87.240.185.131	47541 (VKONTAKTE...) (VKONTAKTE-SPB-AS vk.com)
6	4

1 2a00:f940:2:2:1:3:0:233 (Russian Federation)

ASN197695 (AS-REG, RU)

blacksprut.press	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 46.151.30.174 (Netherlands) 1 redirects

ASN207651 (VDSINA-NL, RU)
PTR: v1865526.hosted-by-vdsina.ru

rawdeo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700:3033::6815:3cc8 (United States)

ASN13335 (CLOUDFLARENET, US)

telega-golos.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 87.240.185.131 (Russian Federation)

ASN47541 (VKONTAKTE-SPB-AS vk.com, RU)
PTR: srv131-185-240-87.vk.com

sun9-4.userapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	telega-golos.com telega-golos.com	107 KB
1	userapi.com sun9-4.userapi.com — Cisco Umbrella Rank: 52752	176 KB
1	rawdeo.com 1 redirects rawdeo.com	717 B
1	blacksprut.press blacksprut.press	5 KB
6	4

	Domain	Requested by
4	telega-golos.com	telega-golos.com
1	sun9-4.userapi.com	telega-golos.com
1	rawdeo.com	1 redirects
1	blacksprut.press
6	4

This site contains no links.

Subject Issuer	Validity	Valid
*.telega-golos.com GTS CA 1P5	`2023-04-04` - `2023-07-03`	3 months	crt.sh
*.userapi.com GlobalSign Organization Validation CA - SHA256 - G2	`2023-03-17` - `2024-02-20`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://telega-golos.com/6b8a19fc48498e5d844e619a43219451
Frame ID: C3E3FDE91FBE1D6CE0712001004C5BB5
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Telegram: Конкурс фотографий

Page URL History Show full URLs

http://blacksprut.press/ Page URL
https://rawdeo.com/3c82n3 HTTP 302
https://telega-golos.com/6b8a19fc48498e5d844e619a43219451 Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Page Statistics

6
Requests

83 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

288 kB
Transfer

592 kB
Size

5
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://blacksprut.press/ Page URL
https://rawdeo.com/3c82n3 HTTP 302
https://telega-golos.com/6b8a19fc48498e5d844e619a43219451 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK / Show response
blacksprut.press/ 13 KB
5 KB 607ms
392ms Document
text/html 2a00:f940:2:2:1:3:0:233
AS-REG

General

Check archive.org

Show headers Download Go to

Full URL: http://blacksprut.press/
Protocol: HTTP/1.1
Server: 2a00:f940:2:2:1:3:0:233 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS
Software: nginx / PHP/8.0.17
Resource Hash: 61d7d2e977355b1365eb235104eea2bf318f62473772bfd06e9fc846b713c34e

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Tue, 16 May 2023 14:02:34 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Server: nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Powered-By: PHP/8.0.17

GET
H2

200

Primary Request 6b8a19fc48498e5d844e619a43219451 Show response
telega-golos.com/
Redirect Chain

https://rawdeo.com/3c82n3
https://telega-golos.com/6b8a19fc48498e5d844e619a43219451

131 KB
27 KB

198ms
165ms

Document
text/html

2606:4700:3033::6815:3cc8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://telega-golos.com/6b8a19fc48498e5d844e619a43219451
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::6815:3cc8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e61c3398ab01a3f7d60354e187e7709d029715a9faff779462a53dcd664f87cc

Request headers

Referer: http://blacksprut.press/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 7c8428cc389d9243-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Tue, 16 May 2023 14:02:36 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QjSqnt0Z3HgKQTXvfHDIIs0oCaRXsODDXOP5PcSdJt%2FL1tUPTVXcnfEn%2BO6Z25YsEJZpQ4xTu0FJf%2BJtwRNVESkkEpaqEli8mJ9qhBPMt278v%2FvxP%2BShGu%2BWc3HfIbiL5ep30Ee9T8G3YsR%2Fsyqj"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

Redirect headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Date: Tue, 16 May 2023 14:02:36 GMT
Expires: 0
Location: https://telega-golos.com/6b8a19fc48498e5d844e619a43219451
Pragma: no-cache
Server: nginx
Vary: Accept-Encoding

GET
H2 200 bootstrap.min.css
telega-golos.com/tme/files/ 42 KB
9 KB 16ms
15ms Stylesheet
text/css 2606:4700:3033::6815:3cc8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://telega-golos.com/tme/files/bootstrap.min.css
Requested by: Host: telega-golos.com
URL: https://telega-golos.com/6b8a19fc48498e5d844e619a43219451
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::6815:3cc8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f1d083ffaa644c708f11db29707aa57c19246e6d32643b03fee3f82c17b224b3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://telega-golos.com/6b8a19fc48498e5d844e619a43219451
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Tue, 16 May 2023 14:02:37 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sun, 19 Mar 2023 20:31:20 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 7348
etag: W/"64177118-a61b"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TjB4f%2FxoaVG02cBraG1QMF2wbb%2BUDTK%2FYkI7UwXhx5iwhVvznVpStZX%2BkHrgOfvU7TmLd0uwpz9bPkt48gLJ6s%2FBTsRTv3IwjnERaH8TN5KlfaqANGR2Xd%2BfqzBJdDSqaDyRqYrew9jQbnyxNh5P"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=86400
cf-ray: 7c8428cd499f9243-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Wed, 17 May 2023 12:00:09 GMT

GET
H3 200 pattern.svg
telega-golos.com/tme/files/ 226 KB
69 KB 88ms
88ms Image
image/svg+xml 2606:4700:3033::6815:3cc8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://telega-golos.com/tme/files/pattern.svg
Requested by: Host: telega-golos.com
URL: https://telega-golos.com/6b8a19fc48498e5d844e619a43219451
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:3cc8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 118add53487c02aaf5b5ab9f69380fa06717deb10492e14aaa487e3c62806ad4

Request headers

Referer: https://telega-golos.com/6b8a19fc48498e5d844e619a43219451
Origin: https://telega-golos.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Tue, 16 May 2023 14:02:37 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Sun, 19 Mar 2023 20:31:20 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"64177118-3891a"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DsIgSMNe0VjboejVxdnysLHzymy4Nalg%2FukiOTuV5qb6xCWOsczUWZiuhhgM5XoqlvDcQ049ARo5RGMClZJPzqzlrailNbdU3G9nlo2o6iDLsrSH1AEYnvKDgr2z9mBa83YP%2BYfEzgcwN7MNiSBz"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
cache-control: max-age=86400
cf-ray: 7c8428cd9f969205-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Wed, 17 May 2023 14:02:37 GMT

GET
H2 200 ezZ-T9NZO_o.jpg
sun9-4.userapi.com/impg/GJHuwy5hIxadzDFCcG21kFuW4HofPaJUjYf4Uw/ 176 KB
176 KB 189ms
41ms Image
image/jpeg 87.240.185.131
VKONTAKTE-SPB-AS ...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sun9-4.userapi.com/impg/GJHuwy5hIxadzDFCcG21kFuW4HofPaJUjYf4Uw/ezZ-T9NZO_o.jpg?size=1024x1024&quality=96&sign=439b0d03c52e3b17df58951f3de56062&c_uniq_tag=2UML6E2msUwq3Q1GytWlr7Hs_wAEpH-k04wY5OLETzQ&type=album

Requested by

Host: telega-golos.com
URL: https://telega-golos.com/6b8a19fc48498e5d844e619a43219451

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

87.240.185.131 , Russian Federation, ASN47541 (VKONTAKTE-SPB-AS vk.com, RU),

Reverse DNS

srv131-185-240-87.vk.com

Software

kittenx /

Resource Hash

65b06b796c145581919c22fb26025c550cf6d74698814606c34a363bd49df7ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://telega-golos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Tue, 16 May 2023 14:02:37 GMT
strict-transport-security: max-age=15768000
x-frontend: front221103
last-modified: Thu, 01 Jan 1970 00:00:00 GMT
server: kittenx
access-control-allow-methods: GET, HEAD, OPTIONS
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: X-Frontend
x-imp: 839234
cache-control: max-age=2592000
accept-ranges: bytes
access-control-allow-headers: X-Quic
content-length: 179744
expires: Thu, 15 Jun 2023 14:02:37 GMT

GET
H3 200 tgwallpaper.min.js Show response
telega-golos.com/tme/files/ 3 KB
2 KB 15ms
14ms Script
application/javascript 2606:4700:3033::6815:3cc8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://telega-golos.com/tme/files/tgwallpaper.min.js
Requested by: Host: telega-golos.com
URL: https://telega-golos.com/6b8a19fc48498e5d844e619a43219451
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:3cc8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2031e418ee10af8110729b3f327b968462fc0a9d8d1da095387bb472ccd0dee6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://telega-golos.com/6b8a19fc48498e5d844e619a43219451
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Tue, 16 May 2023 14:02:37 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sun, 19 Mar 2023 20:31:20 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 7348
etag: W/"64177118-ba3"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mtpz0JfSvW7w5szdbYAH6HpZQ6atU4CKRjZzuTx6v6xGQbUXb33I2HIzWBe%2FkUtswKdB4GtPwen4ycC%2FS4JEjOlfclWWV8996K1sP5j0M1tkZWbcAx4XP9ROQypnx2yGkuX1lUIfRRbsKIHWULVr"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=86400
cf-ray: 7c8428cd9fa29205-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Wed, 17 May 2023 12:00:09 GMT

GET
DATA 200
OK truncated
/ 978 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 77c7245862717d06e6aed1bb0804aa07959e081c9e50a6ee51fcceeda6a66fb0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/svg+xml

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Telegram (Instant Messenger)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
blacksprut.press/	1970-01-20 11:50:49	Name: 0a9e1de856338f20fa7e4f44a32a78be Value: 0
rawdeo.com/	1970-01-20 12:35:24	Name: _subid Value: 1ouoeeehl7
rawdeo.com/	1970-01-20 21:26:45	Name: c1eef Value: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjRcIjoxNjg0MjQ1NzU2fSxcImNhbXBhaWduc1wiOntcIjNcIjoxNjg0MjQ1NzU2fSxcInRpbWVcIjoxNjg0MjQ1NzU2fSJ9.pysleM7-M8HCnUzwFcc25yqEC7JHu-fVa-Ev8anY9ck
.telega-golos.com/	1970-01-20 20:36:21	Name: __ddg1_ Value: 3pWEZObzChePFB2rKHBt
telega-golos.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: l1q321qqmfimrl4gifc5jf3c3h

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

blacksprut.press
rawdeo.com
sun9-4.userapi.com
telega-golos.com
2606:4700:3033::6815:3cc8
2a00:f940:2:2:1:3:0:233
46.151.30.174
87.240.185.131
118add53487c02aaf5b5ab9f69380fa06717deb10492e14aaa487e3c62806ad4
2031e418ee10af8110729b3f327b968462fc0a9d8d1da095387bb472ccd0dee6
61d7d2e977355b1365eb235104eea2bf318f62473772bfd06e9fc846b713c34e
65b06b796c145581919c22fb26025c550cf6d74698814606c34a363bd49df7ba
77c7245862717d06e6aed1bb0804aa07959e081c9e50a6ee51fcceeda6a66fb0
e61c3398ab01a3f7d60354e187e7709d029715a9faff779462a53dcd664f87cc
f1d083ffaa644c708f11db29707aa57c19246e6d32643b03fee3f82c17b224b3

telega-golos.com Open in urlscan Pro 2606:4700:3033::6815:3cc8 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

6 Requests

83 %HTTPS

50 %IPv6

4 Domains

4 Subdomains

4 IPs

3 Countries

288 kBTransfer

592 kBSize

5 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

5 Cookies

Indicators

telega-golos.com Open in urlscan Pro
2606:4700:3033::6815:3cc8 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

83 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

288 kB
Transfer

592 kB
Size

5
Cookies

6 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!