afravirr.com Open in urlscan Pro
89.35.125.34 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://afravirr.com/
Submission: On June 19 via api (June 19th 2024, 3:28:14 am UTC) from BE — Scanned from DE

Summary HTTP 13 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 5 IPs in 4 countries across 4 domains to perform 13 HTTP transactions. The main IP is 89.35.125.34, located in Karaganda, Kazakhstan and belongs to HOSTER-KRG Hoster.KZ - Karaganda, KZ. The main domain is afravirr.com.
TLS certificate: Issued by R11 on June 13th 2024. Valid for: 3 months.

This is the only time afravirr.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Telegram (Instant Messenger)

Domain & IP information

	IP Address	AS Autonomous System
10	89.35.125.34 89.35.125.34	200532 (HOSTER-KR...) (HOSTER-KRG Hoster.KZ - Karaganda)
1	2a04:4e42:600... 2a04:4e42:600::649	54113 (FASTLY) (FASTLY)
1	2a03:2880:f08... 2a03:2880:f084:105:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	2001:67c:4e8:... 2001:67c:4e8:f004::9	62041 (TELEGRAM) (TELEGRAM)
13	5

10 89.35.125.34 (Karaganda, Kazakhstan)

ASN200532 (HOSTER-KRG Hoster.KZ - Karaganda, KZ)
PTR: cloud-3.hoster.kz

afravirr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:600::649 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f084:105:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:67c:4e8:f004::9 (Amsterdam, Netherlands)

ASN62041 (TELEGRAM, VG)

telegram.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	afravirr.com afravirr.com	242 KB
1	telegram.org telegram.org — Cisco Umbrella Rank: 8503	1 KB
1	facebook.net connect.facebook.net — Cisco Umbrella Rank: 205	59 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 814	24 KB
13	4

	Domain	Requested by
10	afravirr.com	afravirr.com
1	telegram.org
1	connect.facebook.net	afravirr.com
1	code.jquery.com	afravirr.com
13	4

This site contains links to these domains. Also see Links.

Domain
telegram.org

Subject Issuer	Validity	Valid
afravirr.com R11	`2024-06-13` - `2024-09-11`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2023-07-11` - `2024-07-14`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-03-28` - `2024-06-26`	3 months	crt.sh
*.telegram.org Go Daddy Secure Certificate Authority - G2	`2023-08-11` - `2024-09-11`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://afravirr.com/
Frame ID: 122FA378697758F60415072F1CE2EAD9
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Telegram: Join Group Chat

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

13
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

5
IPs

4
Countries

327 kB
Transfer

830 kB
Size

0
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://telegram.org/

Search URL Search Domain Scan URL

URL: https://telegram.org/apps
Title: Download

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
afravirr.com/ 8 KB
4 KB 931ms
117ms Document
text/html 89.35.125.34
Karaganda

General

Check archive.org

Show headers Download Go to

Full URL: https://afravirr.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 89.35.125.34 Karaganda, Kazakhstan, ASN200532 (HOSTER-KRG Hoster.KZ - Karaganda, KZ),
Reverse DNS: cloud-3.hoster.kz
Software: nginx / PleskLin
Resource Hash: 2427b8d123e53f4b59865e9205d0f6cef7687b4136595fc0738955860baaeceb

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: br
content-type: text/html; charset=UTF-8
date: Wed, 19 Jun 2024 03:28:08 GMT
etag: W/"666a7eeb-21bb"
last-modified: Thu, 13 Jun 2024 05:08:59 GMT
server: nginx
x-powered-by: PleskLin

GET
H2 200 jquery-3.4.1.slim.min.js Show response
code.jquery.com/ 69 KB
24 KB 231ms
38ms Script
application/javascript 2a04:4e42:600::649
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.4.1.slim.min.js
Requested by: Host: afravirr.com
URL: https://afravirr.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:600::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: a5ab2a00a0439854f8787a0dda775dea5377ef4905886505c938941d6854ee4f

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://afravirr.com/
Origin: https://afravirr.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 19 Jun 2024 03:28:09 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 23863889
x-cache: HIT, HIT
content-length: 24328
x-served-by: cache-lga13626-LGA, cache-cph2320052-CPH
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
x-timer: S1718767689.147029,VS0,VE0
etag: W/"28feccc0-1157d"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=604800
accept-ranges: bytes
x-cache-hits: 55, 11580

GET
H2 200 font-roboto_1.css
afravirr.com/css/ 6 KB
713 B 120ms
117ms Stylesheet
text/css 89.35.125.34
Karaganda

General

Check archive.org

Show headers Download Go to

Full URL: https://afravirr.com/css/font-roboto_1.css
Requested by: Host: afravirr.com
URL: https://afravirr.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 89.35.125.34 Karaganda, Kazakhstan, ASN200532 (HOSTER-KRG Hoster.KZ - Karaganda, KZ),
Reverse DNS: cloud-3.hoster.kz
Software: nginx / PleskLin
Resource Hash: 84b97b3fa8847b64c6d3833561e4b3146530577171e85ad226578a087db70974

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://afravirr.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 19 Jun 2024 03:28:09 GMT
content-encoding: br
last-modified: Sat, 18 May 2024 14:23:43 GMT
server: nginx
etag: W/"6648b9ef-1816"
x-powered-by: PleskLin
content-type: text/css

GET
H2 200 bootstrap.min_3.css
afravirr.com/css/ 42 KB
7 KB 348ms
344ms Stylesheet
text/css 89.35.125.34
Karaganda

General

Check archive.org

Show headers Download Go to

Full URL: https://afravirr.com/css/bootstrap.min_3.css
Requested by: Host: afravirr.com
URL: https://afravirr.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 89.35.125.34 Karaganda, Kazakhstan, ASN200532 (HOSTER-KRG Hoster.KZ - Karaganda, KZ),
Reverse DNS: cloud-3.hoster.kz
Software: nginx / PleskLin
Resource Hash: f1d083ffaa644c708f11db29707aa57c19246e6d32643b03fee3f82c17b224b3

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://afravirr.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 19 Jun 2024 03:28:09 GMT
content-encoding: br
last-modified: Sat, 18 May 2024 14:23:43 GMT
server: nginx
etag: W/"6648b9ef-a61b"
x-powered-by: PleskLin
content-type: text/css

GET
H2 200 telegram_232.css
afravirr.com/css/ 115 KB
21 KB 347ms
344ms Stylesheet
text/css 89.35.125.34
Karaganda

General

Check archive.org

Show headers Download Go to

Full URL: https://afravirr.com/css/telegram_232.css
Requested by: Host: afravirr.com
URL: https://afravirr.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 89.35.125.34 Karaganda, Kazakhstan, ASN200532 (HOSTER-KRG Hoster.KZ - Karaganda, KZ),
Reverse DNS: cloud-3.hoster.kz
Software: nginx / PleskLin
Resource Hash: be0338dd57a301c314a15f12b93fbbfc3ab9878e576c3c9ef37aab94252db198

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://afravirr.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 19 Jun 2024 03:28:09 GMT
content-encoding: br
last-modified: Sat, 18 May 2024 14:23:43 GMT
server: nginx
etag: W/"6648b9ef-1ca52"
x-powered-by: PleskLin
content-type: text/css

GET
H2 200 img1.jpg
afravirr.com/file/ 138 KB
139 KB 233ms
230ms Image
image/jpeg 89.35.125.34
Karaganda

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://afravirr.com/file/img1.jpg
Requested by: Host: afravirr.com
URL: https://afravirr.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 89.35.125.34 Karaganda, Kazakhstan, ASN200532 (HOSTER-KRG Hoster.KZ - Karaganda, KZ),
Reverse DNS: cloud-3.hoster.kz
Software: nginx / PleskLin
Resource Hash: 42b657c98f1a25056f6b9054b6c2706a14a14555cb86cea987554179869fac3d

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://afravirr.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 19 Jun 2024 03:28:09 GMT
content-encoding: gzip
last-modified: Sat, 18 May 2024 14:32:29 GMT
server: nginx
etag: W/"6648bbfd-228ef"
x-powered-by: PleskLin
content-type: image/jpeg

GET
H2 200 tgwallpaper.min_3.js Show response
afravirr.com/js/ 3 KB
1 KB 347ms
345ms Script
application/javascript 89.35.125.34
Karaganda

General

Check archive.org

Show headers Download Go to

Full URL: https://afravirr.com/js/tgwallpaper.min_3.js
Requested by: Host: afravirr.com
URL: https://afravirr.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 89.35.125.34 Karaganda, Kazakhstan, ASN200532 (HOSTER-KRG Hoster.KZ - Karaganda, KZ),
Reverse DNS: cloud-3.hoster.kz
Software: nginx / PleskLin
Resource Hash: 2031e418ee10af8110729b3f327b968462fc0a9d8d1da095387bb472ccd0dee6

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://afravirr.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 19 Jun 2024 03:28:09 GMT
content-encoding: br
last-modified: Sat, 18 May 2024 14:23:54 GMT
server: nginx
etag: W/"6648b9fa-ba3"
x-powered-by: PleskLin
content-type: application/javascript

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 219 KB
59 KB 122ms
38ms Script
application/x-javascript 2a03:2880:f084:105:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: afravirr.com
URL: https://afravirr.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f084:105:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

0313b0d078dfe6c7ab517c11404b0c01458469006fbf1a0d4d4c5e90517e54f8

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src .fbcdn.net .facebook.net 'unsafe-inline' blob: data: 'self' 'unsafe-eval';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://afravirr.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' blob: data: 'self' 'unsafe-eval';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Wed, 19 Jun 2024 03:28:09 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 58024
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=36, rtx=0, c=12, mss=1297, tbw=2777, tp=-1, tpl=-1, uplat=0, ullat=-1
pragma: public
x-fb-debug: EuaRGvGqUP8LyRjq6FPjq4nSYydDfhw9wU+yGGanQN/C3HsgLAqYr66CtOOvMETzjXdnZwhTRSjaPWw4t05Ujg==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), battery=(self), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 pattern.svg
afravirr.com/img/tgme/ 225 KB
69 KB 125ms
125ms Image
image/svg+xml 89.35.125.34
Karaganda

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://afravirr.com/img/tgme/pattern.svg
Requested by: Host: afravirr.com
URL: https://afravirr.com/css/telegram_232.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 89.35.125.34 Karaganda, Kazakhstan, ASN200532 (HOSTER-KRG Hoster.KZ - Karaganda, KZ),
Reverse DNS: cloud-3.hoster.kz
Software: nginx / PleskLin
Resource Hash: daa086b24cbd2610eb3261446100ff513a4526c5b2bce41e758629f5cd8a6a20

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://afravirr.com/css/telegram_232.css
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 19 Jun 2024 03:28:09 GMT
content-encoding: gzip
last-modified: Sat, 18 May 2024 14:23:53 GMT
server: nginx
etag: W/"6648b9f9-385d7"
x-powered-by: PleskLin
content-type: image/svg+xml

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: af86ce9fb560cdb3607305c8b8bd77c424063f168c1efc76b37aab46332f741d

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 404 KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
afravirr.com/fonts/Roboto/ 0
0 137ms
136ms Font
text/html 89.35.125.34
Karaganda

General

Check archive.org

Show headers Download Go to

Full URL: https://afravirr.com/fonts/Roboto/KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
Requested by: Host: afravirr.com
URL: https://afravirr.com/css/font-roboto_1.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 89.35.125.34 Karaganda, Kazakhstan, ASN200532 (HOSTER-KRG Hoster.KZ - Karaganda, KZ),
Reverse DNS: cloud-3.hoster.kz
Software: nginx /
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://afravirr.com/css/font-roboto_1.css
Origin: https://afravirr.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 19 Jun 2024 03:28:09 GMT
content-encoding: br
last-modified: Sat, 18 May 2024 14:05:06 GMT
server: nginx
etag: W/"328-618baf490e171"
content-type: text/html; charset=UTF-8

GET
H2 404 KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
afravirr.com/fonts/Roboto/ 0
0 136ms
136ms Font
text/html 89.35.125.34
Karaganda

General

Check archive.org

Show headers Download Go to

Full URL: https://afravirr.com/fonts/Roboto/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
Requested by: Host: afravirr.com
URL: https://afravirr.com/css/font-roboto_1.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 89.35.125.34 Karaganda, Kazakhstan, ASN200532 (HOSTER-KRG Hoster.KZ - Karaganda, KZ),
Reverse DNS: cloud-3.hoster.kz
Software: nginx /
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://afravirr.com/css/font-roboto_1.css
Origin: https://afravirr.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 19 Jun 2024 03:28:09 GMT
content-encoding: br
last-modified: Sat, 18 May 2024 14:05:06 GMT
server: nginx
etag: W/"328-618baf490e171"
content-type: text/html; charset=UTF-8

GET
H2 404 favicon.ico
afravirr.com/ 808 B
511 B 118ms
117ms Other
text/html 89.35.125.34
Karaganda

General

Check archive.org

Show headers Download Go to

Full URL: https://afravirr.com/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 89.35.125.34 Karaganda, Kazakhstan, ASN200532 (HOSTER-KRG Hoster.KZ - Karaganda, KZ),
Reverse DNS: cloud-3.hoster.kz
Software: nginx /
Resource Hash: b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://afravirr.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 19 Jun 2024 03:28:09 GMT
content-encoding: br
last-modified: Sat, 18 May 2024 14:05:06 GMT
server: nginx
etag: W/"328-618baf490e171"
content-type: text/html; charset=UTF-8

GET
H2 200 website_icon.svg
telegram.org/img/ 2 KB
1 KB 153ms
45ms Other
image/svg+xml 2001:67c:4e8:f004::9
TELEGRAM

General

Check archive.org

Show headers Download Go to

Full URL: https://telegram.org/img/website_icon.svg?4
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2001:67c:4e8:f004::9 Amsterdam, Netherlands, ASN62041 (TELEGRAM, VG),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: 0019255c610cb0843c524d7995905fa5201651fcc393846bee8414f0610097f5

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://afravirr.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 19 Jun 2024 03:28:09 GMT
content-encoding: gzip
last-modified: Mon, 20 Jul 2020 20:41:37 GMT
server: nginx/1.18.0
etag: W/"5f160181-768"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=345600
expires: Sun, 23 Jun 2024 03:28:09 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Telegram (Instant Messenger)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://afravirr.com/fonts/Roboto/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://afravirr.com/fonts/Roboto/KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://afravirr.com/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

afravirr.com
code.jquery.com
connect.facebook.net
telegram.org
2001:67c:4e8:f004::9
2a03:2880:f084:105:face:b00c:0:3
2a04:4e42:600::649
89.35.125.34
0019255c610cb0843c524d7995905fa5201651fcc393846bee8414f0610097f5
0313b0d078dfe6c7ab517c11404b0c01458469006fbf1a0d4d4c5e90517e54f8
2031e418ee10af8110729b3f327b968462fc0a9d8d1da095387bb472ccd0dee6
2427b8d123e53f4b59865e9205d0f6cef7687b4136595fc0738955860baaeceb
42b657c98f1a25056f6b9054b6c2706a14a14555cb86cea987554179869fac3d
84b97b3fa8847b64c6d3833561e4b3146530577171e85ad226578a087db70974
a5ab2a00a0439854f8787a0dda775dea5377ef4905886505c938941d6854ee4f
af86ce9fb560cdb3607305c8b8bd77c424063f168c1efc76b37aab46332f741d
b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187
be0338dd57a301c314a15f12b93fbbfc3ab9878e576c3c9ef37aab94252db198
daa086b24cbd2610eb3261446100ff513a4526c5b2bce41e758629f5cd8a6a20
f1d083ffaa644c708f11db29707aa57c19246e6d32643b03fee3f82c17b224b3

afravirr.com Open in urlscan Pro 89.35.125.34 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

75 %IPv6

4 Domains

4 Subdomains

5 IPs

4 Countries

327 kBTransfer

830 kBSize

0 Cookies

2 Outgoing links

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

13 JavaScript Global Variables

0 Cookies

3 Console Messages

Indicators

afravirr.com Open in urlscan Pro
89.35.125.34 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

5
IPs

4
Countries

327 kB
Transfer

830 kB
Size

0
Cookies

13 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!