![](/screenshots/9d88ba4b-f9ac-43b3-a36a-c502630516f7.png)
hts45.vip
Open in
urlscan Pro
172.67.181.247
Malicious Activity!
Public Scan
Submission Tags: @phish_report
Submission: On June 23 via api from FI — Scanned from FI
Summary
TLS certificate: Issued by GTS CA 1P5 on May 22nd 2024. Valid for: 3 months.
This is the only time hts45.vip was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Telegram (Instant Messenger)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
17 | 172.67.181.247 172.67.181.247 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 163.181.131.215 163.181.131.215 | 24429 (TAOBAO Zh...) (TAOBAO Zhejiang Taobao Network Co.) | |
1 | 101.201.55.212 101.201.55.212 | 37963 (ALIBABA-C...) (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.) | |
28 | 4 |
ASN24429 (TAOBAO Zhejiang Taobao Network Co.,Ltd, CN)
res.openinstall.com |
ASN37963 (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,Ltd., CN)
web-d4cjii.opstatistics.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
17 |
hts45.vip
hts45.vip |
858 KB |
1 |
opstatistics.com
web-d4cjii.opstatistics.com |
446 B |
1 |
openinstall.com
res.openinstall.com |
19 KB |
28 | 3 |
Domain | Requested by | |
---|---|---|
17 | hts45.vip |
hts45.vip
|
1 | web-d4cjii.opstatistics.com |
res.openinstall.com
|
1 | res.openinstall.com |
hts45.vip
|
28 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
hts45.vip GTS CA 1P5 |
2024-05-22 - 2024-08-20 |
3 months | crt.sh |
*.openinstall.com RapidSSL Global TLS RSA4096 SHA256 2022 CA1 |
2024-05-10 - 2025-05-09 |
a year | crt.sh |
*.opstatistics.com RapidSSL Global TLS RSA4096 SHA256 2022 CA1 |
2024-05-09 - 2025-05-08 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://hts45.vip/
Frame ID: 4EF75E053BA80EF457C2996CD9CC1E1D
Requests: 23 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
28 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
Primary Request
/
hts45.vip/ |
12 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
main.0535ee29a03f18616097.css
hts45.vip/ |
398 KB 86 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
style-desktop.7ec8ed3b19fabb19d057.css
hts45.vip/ |
338 B 742 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
mtproto.worker.a04c39423ada106790f8.chunk.js
hts45.vip/ |
723 KB 198 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
85.c5a45a5b8327be101844.bundle.js
hts45.vip/ |
8 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
110.874d0e79405a58485218.bundle.js
hts45.vip/ |
25 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
main.7d4ff02df02a3cab3169.bundle.js
hts45.vip/ |
70 KB 28 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
openinstall-d4cjii.js
res.openinstall.com/ |
47 KB 19 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
mtproto.worker.a04c39423ada106790f8.chunk.js
hts45.vip/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
crypto.worker.03f3724c7d6f77434f7b.chunk.js
hts45.vip/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
crypto.worker.03f3724c7d6f77434f7b.chunk.js
hts45.vip/ |
24 KB 10 KB |
Fetch
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
init2
web-d4cjii.opstatistics.com/web/d4cjii/_/ |
304 B 446 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
hts45.vip/assets/img/ |
15 KB 4 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
104.bee5f0bbe29853cada3e.chunk.js
hts45.vip/ |
63 KB 21 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
301.a138ad85c3f7c5e382bf.chunk.js
hts45.vip/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
8.cf6e90ba29bab54a0fb4.chunk.js
hts45.vip/ |
24 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
npm.axios.68fcb0415dc68449c79d.chunk.js
hts45.vip/ |
28 KB 12 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
147.6f6c83fdc631d19a7e7c.chunk.js
hts45.vip/ |
35 KB 16 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
297.c801a325152b96edf3cb.chunk.js
hts45.vip/ |
1 MB 451 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
63.3f1eeefeb6cfe08536e3.chunk.js
hts45.vip/ |
9 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
submit
hts45.vip/apis/guest/ |
0 488 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
7601b3c1-f8c3-4a64-a85e-8b34b3f252a5
https://hts45.vip/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
b1a00aad-f483-4e12-8462-5bcbbf20688b
https://hts45.vip/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
16f239ef-6735-46b3-8b60-492e94931300
https://hts45.vip/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
508.68e12589c72e402241cc.chunk.js
hts45.vip/ |
5 KB 0 |
Other
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
508.68e12589c72e402241cc.chunk.js
hts45.vip/ |
5 KB 0 |
Other
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
508.68e12589c72e402241cc.chunk.js
hts45.vip/ |
5 KB 0 |
Other
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
508.68e12589c72e402241cc.chunk.js
hts45.vip/ |
5 KB 0 |
Other
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- hts45.vip
- URL
- https://hts45.vip/mtproto.worker.a04c39423ada106790f8.chunk.js
- Domain
- hts45.vip
- URL
- https://hts45.vip/crypto.worker.03f3724c7d6f77434f7b.chunk.js
- Domain
- hts45.vip
- URL
- blob:https://hts45.vip/7601b3c1-f8c3-4a64-a85e-8b34b3f252a5
- Domain
- hts45.vip
- URL
- blob:https://hts45.vip/b1a00aad-f483-4e12-8462-5bcbbf20688b
- Domain
- hts45.vip
- URL
- blob:https://hts45.vip/16f239ef-6735-46b3-8b60-492e94931300
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Telegram (Instant Messenger)60 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
undefined| event object| fence object| sharedStorage object| webpackChunktweb object| rootScope function| AppStorage object| stateStorage function| wrapUrl object| I18n object| webpWorkerController object| appStorage object| singleInstance object| webPushApiManager object| telegramMeWebManager object| opusDecodeController object| cryptoMessagePort object| mtprotoMessagePort object| serviceMessagePort object| apiManagerProxy object| themeController function| OpenInstall object| data function| putPreloader function| calcImageInBox object| mediaSizes function| dispatchHeavyAnimationEvent object| sequentialDom object| appDownloadManager object| appMediaPlaybackController object| appNavigationController object| liteMode object| customProperties object| windowSize function| formatDateAccordingToTodayNew function| fillTipDates function| getVisibleRect function| generatePathData function| p function| getRichValueWithCaret function| compareNodes function| placeCaretAtEnd function| PopupNewMedia function| SlicedArray function| ScrollSaver object| emoticonsDropdown object| appSidebarRight function| getStream function| getStreamCached object| groupCallController object| callsController object| appDialogsManager object| appSidebarLeft object| uiNotificationsManager object| appImManager object| syncedPlayers object| emojiRenderers function| wrapRichText object| animationIntersector object| lottieLoader object| pagesManager0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
8 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000 |
X-Content-Type-Options | nosniff |
X-Frame-Options | DENY |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
hts45.vip
res.openinstall.com
web-d4cjii.opstatistics.com
hts45.vip
101.201.55.212
163.181.131.215
172.67.181.247
053288d5e1e8fb9a7f2a48ef01a1433cc9d0ff82b1c453a1b1a1fbb45a9e9a60
0a38c01bd72e6b8ea645dfb686e78def74ae2266501ec4be5fa321dccfabdd0f
2ef14ddad3f4c61adf025a62fb966c8093a861c2a498d3c4d168cb2854a3fb1c
2fc5d8ff8861b1aea98267793e3228aba7184e96113cff361103a01187747c7a
322deb24d6d5efcf38e98818033dc373a21e67a4535703a0bae2772b13d9f5ce
35762c1a91e7892f95f8ff833671faef1bc972dbb5ab82ec6f7e48ea86c37540
4ef395700556d8fc517352a7280199ef3b994cf83918d88f7e04b0ba5450c61d
58cd70266868d7192eede7c2b13c66a6f0a2541d1b37a205230b0cdba8ac2b31
58f8c516fa0572d199656519969c60759352a469e769a9eb9df17286818ed1a0
76439e361832e5cc02496b3a55a563b5fad3993ec187cd6bb4de4b1d29e02c90
78c642a3f2d9ee2056ca21d3fdcea9ba486efd8fbcd7a61e2f4175a2a35ab9c4
7e1d4e2ce2c2a858bbbcaf1abee014609ed39919b8a08248140d121def64d095
7e2388ec283fe17472ef02829a93da550af8f3ad4a975f50a0110bff61afe523
8ce6001ed025f9a2a010f19a8bbdbfc68e8c7db58343679a8a49cbe2fff455b3
8f83c1b8597f84a4f55c9261d9df0808d6af3154340caeffe4db5c679e8dfdcf
b306f78e88be80d4519da9fae17ac1736a5227313378c4ddb9b1a9af4d4ecc28
d43f9ca12965d7b6f689862247667cf7731ec98456d594b027c790052dc42989
d7df1f14aa9d41a5922178f5651afd43651d89d2c42a8117edf7beb9a5019b5d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f30b69f0b995bc65cf3ea9b905514335cf813003b8162fd1e48d6c13470ac41a