![](/screenshots/e0bec5e0-d0b4-4685-9739-44d8b90842dd.png)
web.tel.onl
Open in
urlscan Pro
116.203.203.206
Malicious Activity!
Public Scan
Effective URL: https://web.tel.onl/
Submission: On December 14 via manual from ES — Scanned from NL
Summary
TLS certificate: Issued by R3 on November 10th 2023. Valid for: 3 months.
This is the only time web.tel.onl was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Telegram (Instant Messenger)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 16 | 116.203.203.206 116.203.203.206 | 24940 (HETZNER-AS) (HETZNER-AS) | |
20 | 2 |
ASN24940 (HETZNER-AS, DE)
PTR: static.206.203.203.116.clients.your-server.de
web.tel.onl |
Apex Domain Subdomains |
Transfer | |
---|---|---|
16 |
tel.onl
1 redirects
web.tel.onl — Cisco Umbrella Rank: 546156 |
264 KB |
20 | 1 |
Domain | Requested by | |
---|---|---|
16 | web.tel.onl |
1 redirects
web.tel.onl
|
20 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
tel.onl R3 |
2023-11-10 - 2024-02-08 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://web.tel.onl/
Frame ID: 3A6F3DC1F2CFF286F160FAA4048D5F2B
Requests: 16 HTTP requests in this frame
Screenshot
![](/screenshots/e0bec5e0-d0b4-4685-9739-44d8b90842dd.png)
Page Title
Web Telegram Online (unofficial)Page URL History Show full URLs
-
http://web.tel.onl/
HTTP 302
https://web.tel.onl/ Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://web.tel.onl/
HTTP 302
https://web.tel.onl/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
20 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
web.tel.onl/ Redirect Chain
|
13 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
index-f4e92301.js
web.tel.onl/ |
110 KB 39 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
index-8b22cd26.css
web.tel.onl/ |
391 KB 67 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
mtproto.worker-b71e55e0.js
web.tel.onl/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
crypto.worker-b2b2021e.js
web.tel.onl/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
crypto.worker-b2b2021e.js
web.tel.onl/ |
67 KB 24 KB |
Fetch
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
lang-58d82c93.js
web.tel.onl/ |
81 KB 24 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
langSign-66e8939d.js
web.tel.onl/ |
2 KB 1 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
countries-5301fc59.js
web.tel.onl/ |
24 KB 4 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pageSignQR-a2873400.js
web.tel.onl/ |
5 KB 3 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
05119190-99ec-4878-9fc6-8d744e59aa8e
https://web.tel.onl/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
ee267d68-6949-4a4c-b60c-85cf92c1b51f
https://web.tel.onl/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
8a4a061b-223b-4fcd-a28b-8120eaefdc62
https://web.tel.onl/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
page-6a985230.js
web.tel.onl/ |
9 KB 4 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
button-739e70db.js
web.tel.onl/ |
5 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
putPreloader-e61b0194.js
web.tel.onl/ |
649 B 742 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
textToSvgURL-c6ebb454.js
web.tel.onl/ |
357 B 584 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
qr-code-styling-c40cd486.js
web.tel.onl/ |
65 KB 17 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
tgico.ttf
web.tel.onl/assets/fonts/ |
72 KB 72 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo_padded.svg
web.tel.onl/assets/img/ |
1 KB 961 B |
Fetch
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- web.tel.onl
- URL
- https://web.tel.onl/mtproto.worker-b71e55e0.js
- Domain
- web.tel.onl
- URL
- https://web.tel.onl/crypto.worker-b2b2021e.js
- Domain
- web.tel.onl
- URL
- blob:https://web.tel.onl/05119190-99ec-4878-9fc6-8d744e59aa8e
- Domain
- web.tel.onl
- URL
- blob:https://web.tel.onl/ee267d68-6949-4a4c-b60c-85cf92c1b51f
- Domain
- web.tel.onl
- URL
- blob:https://web.tel.onl/8a4a061b-223b-4fcd-a28b-8120eaefdc62
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Telegram (Instant Messenger)29 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture object| rootScope function| deferredPromise function| AppStorage object| stateStorage function| wrapUrl object| I18n object| webpWorkerController object| appStorage object| singleInstance object| webPushApiManager object| telegramMeWebManager object| opusDecodeController object| cryptoMessagePort object| mtprotoMessagePort object| serviceMessagePort object| apiManagerProxy function| calcImageInBox object| mediaSizes object| customProperties object| themeController object| overlayCounter function| formatDateAccordingToTodayNew function| fillTipDates object| sequentialDom object| liteMode function| dispatchHeavyAnimationEvent object| pagesManager function| putPreloader0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
web.tel.onl
web.tel.onl
116.203.203.206
0627363c7467338ccb76fa2563598f61dcfad02ada5d9dba0d7ac953cfc91eb4
1ae10327a0711e48ef737f5abe220526e8dbf2c903d9452b80fa7146d7d1f9a7
3b185fdfa80ad537ff5b4199a556133be4e8d9713f73ee4ed90b6a832fb765af
48d812700c5555c6823724cb0ce93936e5067175e37a41b6f3edd1ceecea2bfc
58fafa3a075d804360271b6b081e9c3c46ba344659ef3cb10d5561afc1147448
62ba5e078c4aaa3ff5c8c24cb8216de89afaa7dd10bfd364a0396913bbd34663
67f6e8e0af9549b4975dd3eee7d8ae5fba129148d6fdc7467a1fed240ffa42cc
6b6ca656eee01a4fb50781e670bd16e303732146c98753e5acbcebff36cdf98c
7285632faf1a90db84b6da17536028924fd77630408e7ba20172637dd2b7fe32
76f51bf44f7fec231fddaaca6a5b2edee1ac7aea1ea3b3f09b474a642b96bb14
7b4921656e143af35794b7fc9d4d23580fa232ffcf179bc8569317e424032d80
7ca2ac966e872c9d7205ece63ec3c54fe97313bbe8c742d698d2abfc053d6926
8b22cd26d813ac2867dfad1109cafe307c2687be83545e3ae876712e4669208a
8d7de7365f91bfc24c7ba8fd0545c1eacc58c93a35df2b9224dcbeaaf4ec850e
bece811c1de9858d809e9da4f7890ddf5939896cfe44c6e13a1133d9523f6dc5
eeb79b0ae5da35d3433de6edeec3a0e3cce9c24f517dbad26ed97e852666c8f4