martaclp.com Open in urlscan Pro
31.172.75.26 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://martaclp.com/
Submission: On May 01 via api (May 1st 2024, 11:24:17 pm UTC) from BE — Scanned from DE

Summary HTTP 11 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 11 HTTP transactions. The main IP is 31.172.75.26, located in Frankfurt am Main, Germany and belongs to DE-FIRSTCOLO firstcolo.net, DE. The main domain is martaclp.com.
TLS certificate: Issued by R3 on March 9th 2024. Valid for: 3 months.

This is the only time martaclp.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Telegram (Instant Messenger)

Domain & IP information

	IP Address	AS Autonomous System
10	31.172.75.26 31.172.75.26	44066 (DE-FIRSTC...) (DE-FIRSTCOLO firstcolo.net)
1	2a03:2880:f08... 2a03:2880:f084:d:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
11	3

10 31.172.75.26 (Frankfurt am Main, Germany)

ASN44066 (DE-FIRSTCOLO firstcolo.net, DE)
PTR: 225865.fornex.cloud

martaclp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f084:d:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	martaclp.com martaclp.com	421 KB
1	facebook.net connect.facebook.net — Cisco Umbrella Rank: 180	59 KB
11	2

	Domain	Requested by
10	martaclp.com	martaclp.com
1	connect.facebook.net	martaclp.com
11	2

This site contains links to these domains. Also see Links.

Domain
telegram.org

Subject Issuer	Validity	Valid
martaclp.com R3	`2024-03-09` - `2024-06-07`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-02-09` - `2024-05-09`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://martaclp.com/
Frame ID: 1A14D97F119470492AA519677EC954D8
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Telegram: Join Money Chat

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Page Statistics

11
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

480 kB
Transfer

773 kB
Size

0
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://telegram.org/

Search URL Search Domain Scan URL

URL: https://telegram.org/dl?tme=f204590f665e3bec2e_14673973381621792825
Title: Download

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
martaclp.com/ 11 KB
5 KB 99ms
73ms Document
text/html 31.172.75.26
DE-FIRSTCOLO firs...

General

Check archive.org

Show headers Download Go to

Full URL: https://martaclp.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 31.172.75.26 Frankfurt am Main, Germany, ASN44066 (DE-FIRSTCOLO firstcolo.net, DE),
Reverse DNS: 225865.fornex.cloud
Software: nginx / PHP/7.4.33
Resource Hash: ffc6f60f4103ae6ef8be3466c4059936d1571bf1cd3e623affa427ff83926c72

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=utf-8
Date: Wed, 01 May 2024 23:24:12 GMT
Expires: Wed, 01 May 2024 23:24:12 GMT
Server: nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Powered-By: PHP/7.4.33

GET
H/1.1 200
OK font-roboto.css
martaclp.com/lander/--------marta-----invers--ones----/css/ 6 KB
992 B 7ms
7ms Stylesheet
text/css 31.172.75.26
DE-FIRSTCOLO firs...

General

Check archive.org

Show headers Download Go to

Full URL: https://martaclp.com/lander/--------marta-----invers--ones----/css/font-roboto.css
Requested by: Host: martaclp.com
URL: https://martaclp.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 31.172.75.26 Frankfurt am Main, Germany, ASN44066 (DE-FIRSTCOLO firstcolo.net, DE),
Reverse DNS: 225865.fornex.cloud
Software: nginx /
Resource Hash: 7dc681d034591a7547af531a6c9d5a757a37179f9d9796db25a990a510e51182

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://martaclp.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 01 May 2024 23:24:12 GMT
Content-Encoding: gzip
Last-Modified: Sun, 10 Sep 2023 17:53:09 GMT
Server: nginx
ETag: W/"64fe0285-1783"
Transfer-Encoding: chunked
Content-Type: text/css
Access-Control-Allow-Origin: *
Cache-Control: max-age=864000
Connection: keep-alive
Expires: Sat, 11 May 2024 23:24:12 GMT

GET
H/1.1 200
OK bootstrap.min.css
martaclp.com/lander/--------marta-----invers--ones----/css/ 42 KB
8 KB 17ms
9ms Stylesheet
text/css 31.172.75.26
DE-FIRSTCOLO firs...

General

Check archive.org

Show headers Download Go to

Full URL: https://martaclp.com/lander/--------marta-----invers--ones----/css/bootstrap.min.css
Requested by: Host: martaclp.com
URL: https://martaclp.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 31.172.75.26 Frankfurt am Main, Germany, ASN44066 (DE-FIRSTCOLO firstcolo.net, DE),
Reverse DNS: 225865.fornex.cloud
Software: nginx /
Resource Hash: f1d083ffaa644c708f11db29707aa57c19246e6d32643b03fee3f82c17b224b3

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://martaclp.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 01 May 2024 23:24:12 GMT
Content-Encoding: gzip
Last-Modified: Sun, 10 Sep 2023 17:53:09 GMT
Server: nginx
ETag: W/"64fe0285-a61b"
Transfer-Encoding: chunked
Content-Type: text/css
Access-Control-Allow-Origin: *
Cache-Control: max-age=864000
Connection: keep-alive
Expires: Sat, 11 May 2024 23:24:12 GMT

GET
H/1.1 200
OK telegram.css
martaclp.com/lander/--------marta-----invers--ones----/css/ 112 KB
22 KB 35ms
22ms Stylesheet
text/css 31.172.75.26
DE-FIRSTCOLO firs...

General

Check archive.org

Show headers Download Go to

Full URL: https://martaclp.com/lander/--------marta-----invers--ones----/css/telegram.css
Requested by: Host: martaclp.com
URL: https://martaclp.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 31.172.75.26 Frankfurt am Main, Germany, ASN44066 (DE-FIRSTCOLO firstcolo.net, DE),
Reverse DNS: 225865.fornex.cloud
Software: nginx /
Resource Hash: d27deae9de98b48733ce2327b9137464559a8050dbbbacb3e1bb6bd28073fb7f

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://martaclp.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 01 May 2024 23:24:12 GMT
Content-Encoding: gzip
Last-Modified: Sun, 10 Sep 2023 17:53:09 GMT
Server: nginx
ETag: W/"64fe0285-1c126"
Transfer-Encoding: chunked
Content-Type: text/css
Access-Control-Allow-Origin: *
Cache-Control: max-age=864000
Connection: keep-alive
Expires: Sat, 11 May 2024 23:24:12 GMT

GET
H/1.1 200
OK Qf7CdSdJLFF0Q-4P_LKq
martaclp.com/lander/--------marta-----invers--ones----/ 117 KB
118 KB 36ms
22ms Image
application/octet-stream 31.172.75.26
DE-FIRSTCOLO firs...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://martaclp.com/lander/--------marta-----invers--ones----/Qf7CdSdJLFF0Q-4P_LKq

Requested by

Host: martaclp.com
URL: https://martaclp.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

31.172.75.26 Frankfurt am Main, Germany, ASN44066 (DE-FIRSTCOLO firstcolo.net, DE),

Reverse DNS

225865.fornex.cloud

Software

nginx /

Resource Hash

9f3829a0af13c51d9de04f9a7e28b9002b8c87da974b1e3ef56aad72e65abf00

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://martaclp.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 01 May 2024 23:24:12 GMT
X-Content-Type-Options: nosniff
Last-Modified: Sun, 10 Sep 2023 17:53:09 GMT
Server: nginx
ETag: "64fe0285-1d505"
Content-Type: application/octet-stream
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 120069

GET
H/1.1 200
OK tgwallpaper.min.js Show response
martaclp.com/lander/--------marta-----invers--ones----/js/ 3 KB
3 KB 20ms
7ms Script
application/javascript 31.172.75.26
DE-FIRSTCOLO firs...

General

Check archive.org

Show headers Download Go to

Full URL: https://martaclp.com/lander/--------marta-----invers--ones----/js/tgwallpaper.min.js
Requested by: Host: martaclp.com
URL: https://martaclp.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 31.172.75.26 Frankfurt am Main, Germany, ASN44066 (DE-FIRSTCOLO firstcolo.net, DE),
Reverse DNS: 225865.fornex.cloud
Software: nginx /
Resource Hash: 2031e418ee10af8110729b3f327b968462fc0a9d8d1da095387bb472ccd0dee6

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://martaclp.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 01 May 2024 23:24:12 GMT
Last-Modified: Sun, 10 Sep 2023 17:53:09 GMT
Server: nginx
ETag: "64fe0285-ba3"
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=864000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2979
Expires: Sat, 11 May 2024 23:24:12 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 218 KB
59 KB 29ms
8ms Script
application/x-javascript 2a03:2880:f084:d:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: martaclp.com
URL: https://martaclp.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

cd3521e9b79712590c50523ef00789c637324afa1c8987bf5b773c5d3a66fb3d

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://martaclp.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Wed, 01 May 2024 23:24:12 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 57849
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-ua-compatible: IE=edge
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=5, rtx=0, c=12, mss=1294, tbw=2777, tp=-1, tpl=-1, uplat=0, ullat=-1
pragma: private
x-fb-debug: abI8U6AbE/CFU9REiJJsQB+5uI15H9vaf+YjHm++9VoRva2WDa8qLswarpSElP3ovJ0FVKsE2yVzPt27bub3oQ==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
cache-control: private
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK pattern.svg
martaclp.com/lander/--------marta-----invers--ones----/fonts/ 226 KB
227 KB 7ms
7ms Image
image/svg+xml 31.172.75.26
DE-FIRSTCOLO firs...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://martaclp.com/lander/--------marta-----invers--ones----/fonts/pattern.svg
Requested by: Host: martaclp.com
URL: https://martaclp.com/lander/--------marta-----invers--ones----/css/telegram.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 31.172.75.26 Frankfurt am Main, Germany, ASN44066 (DE-FIRSTCOLO firstcolo.net, DE),
Reverse DNS: 225865.fornex.cloud
Software: nginx /
Resource Hash: 118add53487c02aaf5b5ab9f69380fa06717deb10492e14aaa487e3c62806ad4

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://martaclp.com/lander/--------marta-----invers--ones----/css/telegram.css
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 01 May 2024 23:24:12 GMT
Last-Modified: Sun, 10 Sep 2023 17:53:09 GMT
Server: nginx
ETag: "64fe0285-3891a"
Content-Type: image/svg+xml
Access-Control-Allow-Origin: *
Cache-Control: max-age=864000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 231706
Expires: Sat, 11 May 2024 23:24:12 GMT

GET
DATA 200
OK truncated
/ 978 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 77c7245862717d06e6aed1bb0804aa07959e081c9e50a6ee51fcceeda6a66fb0

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H/1.1 200
OK KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
martaclp.com/lander/--------marta-----invers--ones----/fonts/ 11 KB
11 KB 7ms
7ms Font
font/woff2 31.172.75.26
DE-FIRSTCOLO firs...

General

Check archive.org

Show headers Download Go to

Full URL: https://martaclp.com/lander/--------marta-----invers--ones----/fonts/KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
Requested by: Host: martaclp.com
URL: https://martaclp.com/lander/--------marta-----invers--ones----/css/font-roboto.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 31.172.75.26 Frankfurt am Main, Germany, ASN44066 (DE-FIRSTCOLO firstcolo.net, DE),
Reverse DNS: 225865.fornex.cloud
Software: nginx /
Resource Hash: 0f53e8b0a717ca4ce313eec62b90d41db62c2f4946259a65c93bf8e84c5b0c44

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://martaclp.com/lander/--------marta-----invers--ones----/css/font-roboto.css
Origin: https://martaclp.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 01 May 2024 23:24:13 GMT
Last-Modified: Sun, 10 Sep 2023 17:53:09 GMT
Server: nginx
ETag: "64fe0285-2b20"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=864000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 11040
Expires: Sat, 11 May 2024 23:24:13 GMT

GET
H/1.1 200
OK KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
martaclp.com/lander/--------marta-----invers--ones----/fonts/ 11 KB
11 KB 8ms
8ms Font
font/woff2 31.172.75.26
DE-FIRSTCOLO firs...

General

Check archive.org

Show headers Download Go to

Full URL: https://martaclp.com/lander/--------marta-----invers--ones----/fonts/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
Requested by: Host: martaclp.com
URL: https://martaclp.com/lander/--------marta-----invers--ones----/css/font-roboto.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 31.172.75.26 Frankfurt am Main, Germany, ASN44066 (DE-FIRSTCOLO firstcolo.net, DE),
Reverse DNS: 225865.fornex.cloud
Software: nginx /
Resource Hash: 796de064b8d80eba7ccacb8ba67d77fdbcdf4b385c844645d452c24537b3108f

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://martaclp.com/lander/--------marta-----invers--ones----/css/font-roboto.css
Origin: https://martaclp.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 01 May 2024 23:24:13 GMT
Last-Modified: Sun, 10 Sep 2023 17:53:09 GMT
Server: nginx
ETag: "64fe0285-2b14"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=864000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 11028
Expires: Sat, 11 May 2024 23:24:13 GMT

GET
H/1.1 200
OK favicon.ico
martaclp.com/lander/--------marta-----invers--ones----/ 15 KB
15 KB 7ms
7ms Other
image/x-icon 31.172.75.26
DE-FIRSTCOLO firs...

General

Check archive.org

Show headers Download Go to

Full URL: https://martaclp.com/lander/--------marta-----invers--ones----/favicon.ico
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 31.172.75.26 Frankfurt am Main, Germany, ASN44066 (DE-FIRSTCOLO firstcolo.net, DE),
Reverse DNS: 225865.fornex.cloud
Software: nginx /
Resource Hash: 4ff54bc38c267dc3a8c95f6ed4590336baaec70433ef15d027ddca608c391e78

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://martaclp.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 01 May 2024 23:24:13 GMT
Last-Modified: Sun, 10 Sep 2023 17:53:09 GMT
Server: nginx
ETag: "64fe0285-3aee"
Content-Type: image/x-icon
Access-Control-Allow-Origin: *
Cache-Control: max-age=864000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 15086
Expires: Sat, 11 May 2024 23:24:13 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Telegram (Instant Messenger)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

connect.facebook.net
martaclp.com
2a03:2880:f084:d:face:b00c:0:3
31.172.75.26
0f53e8b0a717ca4ce313eec62b90d41db62c2f4946259a65c93bf8e84c5b0c44
118add53487c02aaf5b5ab9f69380fa06717deb10492e14aaa487e3c62806ad4
2031e418ee10af8110729b3f327b968462fc0a9d8d1da095387bb472ccd0dee6
4ff54bc38c267dc3a8c95f6ed4590336baaec70433ef15d027ddca608c391e78
77c7245862717d06e6aed1bb0804aa07959e081c9e50a6ee51fcceeda6a66fb0
796de064b8d80eba7ccacb8ba67d77fdbcdf4b385c844645d452c24537b3108f
7dc681d034591a7547af531a6c9d5a757a37179f9d9796db25a990a510e51182
9f3829a0af13c51d9de04f9a7e28b9002b8c87da974b1e3ef56aad72e65abf00
cd3521e9b79712590c50523ef00789c637324afa1c8987bf5b773c5d3a66fb3d
d27deae9de98b48733ce2327b9137464559a8050dbbbacb3e1bb6bd28073fb7f
f1d083ffaa644c708f11db29707aa57c19246e6d32643b03fee3f82c17b224b3
ffc6f60f4103ae6ef8be3466c4059936d1571bf1cd3e623affa427ff83926c72

martaclp.com Open in urlscan Pro 31.172.75.26 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

11 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

3 IPs

1 Countries

480 kBTransfer

773 kBSize

0 Cookies

2 Outgoing links

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

0 Cookies

Indicators

martaclp.com Open in urlscan Pro
31.172.75.26 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

480 kB
Transfer

773 kB
Size

0
Cookies

11 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!