www.telegram-auth.su
Open in
urlscan Pro
46.226.167.170
Malicious Activity!
Public Scan
Effective URL: https://www.telegram-auth.su/
Submission: On May 29 via automatic, source openphish — Scanned from FR
Summary
TLS certificate: Issued by R3 on May 28th 2024. Valid for: 3 months.
This is the only time www.telegram-auth.su was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Telegram (Instant Messenger)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
15 | 46.226.167.170 46.226.167.170 | 210644 (AEZA-AS) (AEZA-AS) | |
1 | 2a04:4e42:400... 2a04:4e42:400::649 | 54113 (FASTLY) (FASTLY) | |
1 | 172.67.74.152 172.67.74.152 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
23 | 4 |
ASN210644 (AEZA-AS, GB)
PTR: scary-territory.aeza.network
www.telegram-auth.su |
Apex Domain Subdomains |
Transfer | |
---|---|---|
15 |
telegram-auth.su
www.telegram-auth.su |
999 KB |
1 |
ipify.org
api.ipify.org — Cisco Umbrella Rank: 2924 |
155 B |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 776 |
30 KB |
23 | 3 |
Domain | Requested by | |
---|---|---|
15 | www.telegram-auth.su |
www.telegram-auth.su
|
1 | api.ipify.org |
code.jquery.com
|
1 | code.jquery.com |
www.telegram-auth.su
|
23 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
telegram-auth.su R3 |
2024-05-28 - 2024-08-26 |
3 months | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2023-07-11 - 2024-07-14 |
a year | crt.sh |
ipify.org GTS CA 1P5 |
2024-05-19 - 2024-08-17 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.telegram-auth.su/
Frame ID: 07E57B01DF3AC6270323C738E64B6F33
Requests: 24 HTTP requests in this frame
Screenshot
Page Title
Telegram WebPage URL History Show full URLs
-
http://www.telegram-auth.su/
HTTP 307
https://www.telegram-auth.su/ Page URL
Detected technologies
jQuery (JavaScript Libraries) ExpandDetected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://www.telegram-auth.su/
HTTP 307
https://www.telegram-auth.su/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
23 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
www.telegram-auth.su/ Redirect Chain
|
22 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.f71896c2c50d07adcf73.css
www.telegram-auth.su/ |
352 KB 352 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style-desktop.9d7b485ed526720a3aad.css
www.telegram-auth.su/ |
355 B 601 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.712f415c3a05b4382935.bundle.js
www.telegram-auth.su/ |
12 KB 12 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.6.0.min.js
code.jquery.com/ |
87 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
24.4d8c06f2db954418f16d.chunk.js
www.telegram-auth.su/ |
734 B 994 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
20.59cd546d102ae15542e6.chunk.js
www.telegram-auth.su/ |
4 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
0.e0afbd5895b2c8eb71c6.chunk.js
www.telegram-auth.su/ |
16 KB 16 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
22.a20a1ec6ea627171c353.chunk.js
www.telegram-auth.su/ |
8 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
1.501f1b99f6befd50ee5e.chunk.js
www.telegram-auth.su/ |
133 KB 133 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
28.6667bb68e660e626d453.chunk.js
www.telegram-auth.su/ |
663 B 923 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
api.ipify.org/ |
22 B 155 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mtproto.worker.b9472a3acd835ec21780.bundle.worker.js
www.telegram-auth.su/ |
390 KB 391 KB |
Other
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
favicon-32x32.png
www.telegram-auth.su/assets/img/ |
2 KB 2 KB |
Other
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
8.ea3cd7974ebbd0d0029d.chunk.js
www.telegram-auth.su/ |
45 KB 46 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
9.6eaa4e06851092205efd.chunk.js
www.telegram-auth.su/ |
2 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
27.f4a134d00776769d844a.chunk.js
www.telegram-auth.su/ |
22 KB 22 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
2.74a3da7f5452b44843ff.chunk.js
www.telegram-auth.su/ |
32 KB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
3.783454d94e8eb002e387.chunk.js
www.telegram-auth.su/ |
10 KB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
21.49b949da4f2493f6b111.chunk.js
www.telegram-auth.su/ |
6 KB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
npm.qr-code-styling.6d4087c107d121ea4739.chunk.js
www.telegram-auth.su/ |
41 KB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
17.fae79d657f42f1745c9f.chunk.js
www.telegram-auth.su/ |
8 KB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo_padded.svg
www.telegram-auth.su/assets/img/ |
1 KB 0 |
Fetch
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Telegram (Instant Messenger)102 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
string| ラ string| ロ string| セ string| ゐ string| レ string| ど string| バ string| ゅ string| め string| プ string| ぞ object| ㄑ string| ネ string| ゼ string| ぽ string| ム string| リ string| マ string| へ string| ヹ string| オ string| ォ string| ィ string| ヽ number| ボ string| ヸ string| ぴ string| ㄈ string| ㄩ string| で object| ゛ string| ぎ string| イ string| に string| ダ string| っ string| エ string| た string| ワ string| ヲ string| の function| ま function| ゕ string| ヷ string| ヶ string| ㄐ string| ナ string| ㄥ string| ヱ string| ぶ string| ら string| ド function| ヘ string| や string| ふ string| ㄠ string| ヾ string| く string| ㄧ string| ニ string| ㄟ string| ビ string| い string| な string| り string| テ string| ヂ string| ッ string| ゔ string| ゥ string| ヮ string| ぼ string| ゖ string| ㄫ string| ャ string| ず object| webpackJsonp function| $ function| jQuery object| rootScope object| stateStorage object| appStorage object| appStateManager object| webpWorkerController object| singleInstance object| webPushApiManager function| formatDateAccordingToTodayNew function| fillTipDates object| telegramMeWebManager object| apiManagerProxy function| calcImageInBox object| mediaSizes object| Config object| RichTextProcessor object| I18n object| animationIntersector object| lottieLoader object| pagesManager object| serverTimeManager object| sequentialDom object| appNavigationController function| putPreloader0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
api.ipify.org
code.jquery.com
www.telegram-auth.su
172.67.74.152
2a04:4e42:400::649
46.226.167.170
12773258b323211434281b615f20a20bd1a8dbfd2020b31af21f2e2ea63cf645
14f1cbd1cf8a460bf60aa7c762a883206fc2fd8570cc3eab7c2e4277c269f7cf
3236854bc6dc13d16225b0e509cbae369eb17abf82c167550916359191e7ce08
37da34257150a87a8664ee354a6cf3e49071c45dfaa8c6abc112f47fc169313b
3a0e296e9ba8899e31e18cc344123fbaf4e0d1a23bcc3baf7dc5b86f9bed5999
3d734fe0a9440686391136eac7453b024f7760f741d5c401e002f30674ea1c21
4512ad0ba1cbed020c46fe6c05b3392e55598226602c706f0618a4886dd8c2c6
455d79310dc2eda66880ed612cca38ee76928c4198fc2a0f7b02421efbc06841
45fb1125d51eb92ef1d3f13f526f641627b71bb4ed6703cd4651fd9d9eb4805a
477fea83b74198e505971d04ef8fddfb6406c7487fc56249b749852f6f0ea3a6
5132a77aea047b16ecaa1086176d8ac7571f6bfb8016e44c64e9dbb3730617f5
5311ec5186b9caffcef519f9c671bc57ccf36bc0e2b2bc67bb77c49d297ee876
652a6577b9f1287199fdf91de1ad503de5f524e6449e121c9c51db96e35e94da
786f521d44d68e6cb99c9d4c21f5d324731f46f96b5b3c8f9d388e73a9e6cfa3
8e18aee6e70418e31cb2bb69f441ef33083586dd3a5c5d1d335562b840a9ac87
9fceeff30b695887206127e6c3f1e024e213c208a3b5072f6e60b1053ddf7471
c7335f843f4f1b00a53996bf9d84c7558d701867fe2488a1cf1a369ae642dce2
e7039ec68cf3da381b04c73b975ef28aa5b57733bb2e1da2de8f1bc9e75c7362
e74fa311cd450c6220775f6dca7a869ff3329e1aaf30960e0f20d033d978a2e5
eeb79b0ae5da35d3433de6edeec3a0e3cce9c24f517dbad26ed97e852666c8f4
f80bf3de091711d079fb8a52bf5239afb4dd5927d12234735b11e67e1e89e0cc
f90da47e2c01a9a1d27d356948ba3853039120978d5809a124f573bb8cb1b95d
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e