www.login.east.wtf Open in urlscan Pro
85.13.139.31 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.login.east.wtf/
Submission: On August 03 via automatic, source certstream-suspicious (August 3rd 2024, 5:41:11 pm UTC) — Scanned from DE

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 8 HTTP transactions. The main IP is 85.13.139.31, located in Germany and belongs to NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE. The main domain is www.login.east.wtf.
TLS certificate: Issued by R3 on June 2nd 2024. Valid for: 3 months.

This is the only time www.login.east.wtf was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
4	85.13.139.31 85.13.139.31	34788 (NMM-AS D) (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68)
2	2001:67c:4e8:... 2001:67c:4e8:f004::9	62041 (TELEGRAM) (TELEGRAM)
1	2a00:1450:400... 2a00:1450:4001:80f::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82a::2003	15169 (GOOGLE) (GOOGLE)
8	4

4 85.13.139.31 (Germany)

ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE)
PTR: dd51028.kasserver.com

www.login.east.wtf	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:67c:4e8:f004::9 (Amsterdam, Netherlands)

ASN62041 (TELEGRAM, VG)

telegram.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
oauth.telegram.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	east.wtf www.login.east.wtf	71 KB
2	telegram.org telegram.org — Cisco Umbrella Rank: 6669 oauth.telegram.org — Cisco Umbrella Rank: 155007	6 KB
1	gstatic.com fonts.gstatic.com	13 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 110	712 B
8	4

	Domain	Requested by
4	www.login.east.wtf	www.login.east.wtf
1	oauth.telegram.org	telegram.org
1	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	www.login.east.wtf
1	telegram.org	www.login.east.wtf
8	5

This site contains no links.

Subject Issuer	Validity	Valid
login.east.wtf R3	`2024-06-02` - `2024-08-31`	3 months	crt.sh
*.telegram.org Go Daddy Secure Certificate Authority - G2	`2023-08-11` - `2024-09-11`	a year	crt.sh
upload.video.google.com WR2	`2024-07-30` - `2024-10-22`	3 months	crt.sh
*.gstatic.com WR2	`2024-07-30` - `2024-10-22`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://www.login.east.wtf/
Frame ID: 0EA99404D95598F59E402AC4B01B2893
Requests: 7 HTTP requests in this frame

Frame: https://oauth.telegram.org/embed/eastcon_bot?origin=https%3A%2F%2Fwww.login.east.wtf&return_to=https%3A%2F%2Fwww.login.east.wtf%2F&size=large&request_access=write
Frame ID: D62F70895A1EF1C8B173E0EEB8E32C31
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Telegram Login

Page Statistics

8
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

5
Subdomains

4
IPs

2
Countries

90 kB
Transfer

104 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.login.east.wtf/ 846 B
440 B 114ms
30ms Document
text/html 85.13.139.31
02742 Friedersdor...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.login.east.wtf/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 85.13.139.31 , Germany, ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE),
Reverse DNS: dd51028.kasserver.com
Software: Apache /
Resource Hash: 9db3f83bd37731df8d6ba354e4f404eea3ec8402f9dfb77f5265a0e1336cb24c

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-encoding: br
content-type: text/html
date: Sat, 03 Aug 2024 17:41:05 GMT
server: Apache
vary: Accept-Encoding,User-Agent

GET
H2 200 styles.css
www.login.east.wtf/ 887 B
434 B 30ms
29ms Stylesheet
text/css 85.13.139.31
02742 Friedersdor...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.login.east.wtf/styles.css
Requested by: Host: www.login.east.wtf
URL: https://www.login.east.wtf/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 85.13.139.31 , Germany, ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE),
Reverse DNS: dd51028.kasserver.com
Software: Apache /
Resource Hash: 9db5d8e6c87d045c494f62f4b605b74192427de296abc0e4909f0b1384b0fdbd

Request headers

Referer: https://www.login.east.wtf/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 03 Aug 2024 17:41:05 GMT
content-encoding: br
last-modified: Fri, 08 May 2020 20:34:39 GMT
server: Apache
etag: "377-5a528ed2a8876-br"
vary: Accept-Encoding,User-Agent
content-type: text/css
accept-ranges: bytes
content-length: 347

GET
H2 200 telegram-widget.js Show response
telegram.org/js/ 20 KB
6 KB 112ms
30ms Script
application/javascript 2001:67c:4e8:f004::9
TELEGRAM

General

Check archive.org

Show headers Download Go to

Full URL

https://telegram.org/js/telegram-widget.js?2

Requested by

Host: www.login.east.wtf
URL: https://www.login.east.wtf/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2001:67c:4e8:f004::9 Amsterdam, Netherlands, ASN62041 (TELEGRAM, VG),

Reverse DNS

Software

nginx/1.18.0 /

Resource Hash

0f6cdd09b3bbebf50c4e1679aff6f021f5e183a4ba2dea3a0801394599ff6afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.login.east.wtf/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 03 Aug 2024 17:41:05 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
last-modified: Mon, 03 Apr 2023 11:46:12 GMT
server: nginx/1.18.0
etag: W/"642abc84-4ff5"
content-type: application/javascript
cache-control: max-age=345600
expires: Wed, 07 Aug 2024 17:41:05 GMT

GET
H2 200 css
fonts.googleapis.com/ 386 B
712 B 80ms
29ms Stylesheet
text/css 2a00:1450:4001:80f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Numans

Requested by

Host: www.login.east.wtf
URL: https://www.login.east.wtf/styles.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

49be80d57e68ff28561f5a62345b0bcec6aa583fc80a3f0771f9e9e38cd3dfbf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.login.east.wtf/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 03 Aug 2024 17:41:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 03 Aug 2024 17:39:37 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 03 Aug 2024 17:41:05 GMT

GET
H2 200 Socom.jpg
www.login.east.wtf/Resources/ 70 KB
70 KB 56ms
55ms Image
image/jpeg 85.13.139.31
02742 Friedersdor...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.login.east.wtf/Resources/Socom.jpg
Requested by: Host: www.login.east.wtf
URL: https://www.login.east.wtf/styles.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 85.13.139.31 , Germany, ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE),
Reverse DNS: dd51028.kasserver.com
Software: Apache /
Resource Hash: f5d453e29cf16a57c81425c8e85a5b1986a6dfc23728340fb5b665177d01608e

Request headers

Referer: https://www.login.east.wtf/styles.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 03 Aug 2024 17:41:05 GMT
last-modified: Wed, 29 Jan 2020 15:11:11 GMT
server: Apache
accept-ranges: bytes
etag: "1178b-59d48c032e376"
content-length: 71563
content-type: image/jpeg

GET
H2 200 SlGRmQmGupYAfH84ZhIh.woff2
fonts.gstatic.com/s/numans/v15/ 12 KB
13 KB 67ms
20ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/numans/v15/SlGRmQmGupYAfH84ZhIh.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Numans

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

31e11d50402b8c5ef569ab58878f71b5d3cdf899d7ae3d79111bf1cef040acdf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.login.east.wtf
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 30 Jul 2024 17:04:24 GMT
x-content-type-options: nosniff
age: 347801
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12272
x-xss-protection: 0
last-modified: Mon, 09 May 2022 18:46:19 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 30 Jul 2025 17:04:24 GMT

GET
H2 200 eastcon_bot
oauth.telegram.org/embed/ Frame D62F 0
0 105ms
31ms Document
text/html 2001:67c:4e8:f004::9
TELEGRAM

General

Check archive.org

Show headers Download Go to

Full URL

https://oauth.telegram.org/embed/eastcon_bot?origin=https%3A%2F%2Fwww.login.east.wtf&return_to=https%3A%2F%2Fwww.login.east.wtf%2F&size=large&request_access=write

Requested by

Host: telegram.org
URL: https://telegram.org/js/telegram-widget.js?2

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2001:67c:4e8:f004::9 Amsterdam, Netherlands, ASN62041 (TELEGRAM, VG),

Reverse DNS

Software

nginx/1.18.0 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.login.east.wtf/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-length: 36
content-type: text/html; charset=UTF-8
date: Sat, 03 Aug 2024 17:41:05 GMT
server: nginx/1.18.0
strict-transport-security: max-age=31536000; includeSubDomains; preload

GET
H2 404 favicon.ico
www.login.east.wtf/ 196 B
246 B 29ms
29ms Other
text/html 85.13.139.31
02742 Friedersdor...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.login.east.wtf/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 85.13.139.31 , Germany, ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE),
Reverse DNS: dd51028.kasserver.com
Software: Apache /
Resource Hash: 80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880

Request headers

Referer: https://www.login.east.wtf/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 03 Aug 2024 17:41:05 GMT
server: Apache
content-length: 196
content-type: text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| __parseFunction object| Telegram

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			oauth.telegram.org/	1970-01-21 07:21:58	Name: stel_ssid Value: 5045f880d6a2493aef_10577876972431693867

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://www.login.east.wtf/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
oauth.telegram.org
telegram.org
www.login.east.wtf
2001:67c:4e8:f004::9
2a00:1450:4001:80f::200a
2a00:1450:4001:82a::2003
85.13.139.31
0f6cdd09b3bbebf50c4e1679aff6f021f5e183a4ba2dea3a0801394599ff6afd
31e11d50402b8c5ef569ab58878f71b5d3cdf899d7ae3d79111bf1cef040acdf
49be80d57e68ff28561f5a62345b0bcec6aa583fc80a3f0771f9e9e38cd3dfbf
80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880
9db3f83bd37731df8d6ba354e4f404eea3ec8402f9dfb77f5265a0e1336cb24c
9db5d8e6c87d045c494f62f4b605b74192427de296abc0e4909f0b1384b0fdbd
f5d453e29cf16a57c81425c8e85a5b1986a6dfc23728340fb5b665177d01608e

www.login.east.wtf Open in urlscan Pro 85.13.139.31 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

8 Requests

100 %HTTPS

75 %IPv6

4 Domains

5 Subdomains

4 IPs

2 Countries

90 kBTransfer

104 kBSize

1 Cookies

0 Outgoing links

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

www.login.east.wtf Open in urlscan Pro
85.13.139.31 Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

5
Subdomains

4
IPs

2
Countries

90 kB
Transfer

104 kB
Size

1
Cookies

8 HTTP transactions
0 data transactions