geniuspro.pro Open in urlscan Pro
91.195.13.3 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://geniuspro.pro/
Effective URL:
https://geniuspro.pro/
Submission: On August 19 via api (August 19th 2024, 2:15:50 pm UTC) from BY — Scanned from PL

Summary HTTP 15 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 15 HTTP transactions. The main IP is 91.195.13.3, located in Poland and belongs to HOST4BIZ-AS, PL. The main domain is geniuspro.pro.
TLS certificate: Issued by R11 on July 1st 2024. Valid for: 3 months.

This is the only time geniuspro.pro was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Telegram (Instant Messenger)

Domain & IP information

	IP Address	AS Autonomous System
11	91.195.13.3 91.195.13.3	61251 (HOST4BIZ-AS) (HOST4BIZ-AS)
2	157.240.253.1 157.240.253.1	32934 (FACEBOOK) (FACEBOOK)
2	157.240.253.35 157.240.253.35	32934 (FACEBOOK) (FACEBOOK)
15	4

11 91.195.13.3 (Poland)

ASN61251 (HOST4BIZ-AS, PL)
PTR: pl-sh3.host4.biz

geniuspro.pro	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 157.240.253.1 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-02-fra5.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 157.240.253.35 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
PTR: edge-star-mini-shv-02-fra5.facebook.com

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	geniuspro.pro geniuspro.pro	358 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 108	3 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 236	75 KB
15	3

	Domain	Requested by
11	geniuspro.pro	geniuspro.pro
2	www.facebook.com	geniuspro.pro
2	connect.facebook.net	geniuspro.pro connect.facebook.net
15	3

This site contains links to these domains. Also see Links.

Domain
telegram.org
t.me

Subject Issuer	Validity	Valid
geniuspro.pro R11	`2024-07-01` - `2024-09-29`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-05-28` - `2024-08-26`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://geniuspro.pro/
Frame ID: BC26107BD61785518DFF70C68250959D
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Telegram: Join Group Chat

Page URL History Show full URLs

http://geniuspro.pro/ HTTP 307
https://geniuspro.pro/ Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Page Statistics

15
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

436 kB
Transfer

785 kB
Size

1
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://telegram.org/

Search URL Search Domain Scan URL

URL: https://telegram.org/dl?tme=be9cac634d2f6008ae_7551107034251231833
Title: Download

Search URL Search Domain Scan URL

URL: https://t.me/andreykoca
Title: @andreykoca

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://geniuspro.pro/ HTTP 307
https://geniuspro.pro/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
geniuspro.pro/
Redirect Chain

http://geniuspro.pro/
https://geniuspro.pro/

14 KB
7 KB

462ms
37ms

Document
text/html

91.195.13.3
HOST4BIZ-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://geniuspro.pro/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 91.195.13.3 , Poland, ASN61251 (HOST4BIZ-AS, PL),
Reverse DNS: pl-sh3.host4.biz
Software: nginx / PleskLin
Resource Hash: 18e7e6f6bcdcea325be168d047aaa2341cf58a54717662fbd002c3e3181cb62d

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-encoding: br
content-type: text/html
date: Mon, 19 Aug 2024 14:15:45 GMT
etag: W/"669bf1a5-39a2"
last-modified: Sat, 20 Jul 2024 17:19:33 GMT
server: nginx
x-cache-status: MISS
x-powered-by: PleskLin

Redirect headers

Location: https://geniuspro.pro/
Non-Authoritative-Reason: HttpsUpgrades

GET
H2 200 font-roboto.css
geniuspro.pro/ 6 KB
718 B 40ms
39ms Stylesheet
text/css 91.195.13.3
HOST4BIZ-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://geniuspro.pro/font-roboto.css
Requested by: Host: geniuspro.pro
URL: https://geniuspro.pro/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 91.195.13.3 , Poland, ASN61251 (HOST4BIZ-AS, PL),
Reverse DNS: pl-sh3.host4.biz
Software: nginx / PleskLin
Resource Hash: 27780ccf89e3853f260323c142e835e76d72fb2846169c8425ff39565da7efac

Request headers

Referer: https://geniuspro.pro/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 19 Aug 2024 14:15:45 GMT
content-encoding: br
last-modified: Sat, 20 Jul 2024 17:19:33 GMT
server: nginx
etag: W/"669bf1a5-16c6"
x-cache-status: MISS
x-powered-by: PleskLin
content-type: text/css

GET
H2 200 bootstrap.min.css
geniuspro.pro/ 42 KB
7 KB 39ms
38ms Stylesheet
text/css 91.195.13.3
HOST4BIZ-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://geniuspro.pro/bootstrap.min.css
Requested by: Host: geniuspro.pro
URL: https://geniuspro.pro/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 91.195.13.3 , Poland, ASN61251 (HOST4BIZ-AS, PL),
Reverse DNS: pl-sh3.host4.biz
Software: nginx / PleskLin
Resource Hash: f1d083ffaa644c708f11db29707aa57c19246e6d32643b03fee3f82c17b224b3

Request headers

Referer: https://geniuspro.pro/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 19 Aug 2024 14:15:45 GMT
content-encoding: br
last-modified: Sat, 20 Jul 2024 17:19:32 GMT
server: nginx
etag: W/"669bf1a4-a61b"
x-cache-status: MISS
x-powered-by: PleskLin
content-type: text/css

GET
H2 200 telegram.css
geniuspro.pro/ 102 KB
17 KB 107ms
106ms Stylesheet
text/css 91.195.13.3
HOST4BIZ-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://geniuspro.pro/telegram.css
Requested by: Host: geniuspro.pro
URL: https://geniuspro.pro/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 91.195.13.3 , Poland, ASN61251 (HOST4BIZ-AS, PL),
Reverse DNS: pl-sh3.host4.biz
Software: nginx / PleskLin
Resource Hash: e18aa6e37c9c71a0c3b6ce62c7d8bf64b1c30d2dd0a9b3c6c0dae41ae4d77aa3

Request headers

Referer: https://geniuspro.pro/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 19 Aug 2024 14:15:45 GMT
content-encoding: br
last-modified: Sat, 20 Jul 2024 17:19:40 GMT
server: nginx
etag: W/"669bf1ac-19622"
x-cache-status: MISS
x-powered-by: PleskLin
content-type: text/css

GET
H2 200 WN5dJZjGyUVE-oP2ixZqidCutmtcQrunXl1r_QoxInMA2ulEbQc_OBtAx36nPJLZw8XYQVWaz6cM5QQ7ZbZ0eudUBFrYDs35kIAeSMK6pmorzr5mY82bnB_6.jpg
geniuspro.pro/ 49 KB
50 KB 65ms
64ms Image
image/jpeg 91.195.13.3
HOST4BIZ-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geniuspro.pro/WN5dJZjGyUVE-oP2ixZqidCutmtcQrunXl1r_QoxInMA2ulEbQc_OBtAx36nPJLZw8XYQVWaz6cM5QQ7ZbZ0eudUBFrYDs35kIAeSMK6pmorzr5mY82bnB_6.jpg
Requested by: Host: geniuspro.pro
URL: https://geniuspro.pro/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 91.195.13.3 , Poland, ASN61251 (HOST4BIZ-AS, PL),
Reverse DNS: pl-sh3.host4.biz
Software: nginx / PleskLin
Resource Hash: fa5725b3a54e285f3b0326746724f9571c13f605fff420fe2c4be7faa84e89da

Request headers

Referer: https://geniuspro.pro/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 19 Aug 2024 14:15:45 GMT
last-modified: Sat, 20 Jul 2024 17:19:40 GMT
server: nginx
etag: "669bf1ac-c551"
x-cache-status: MISS
x-powered-by: PleskLin
content-type: image/jpeg
accept-ranges: bytes
content-length: 50513

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 225 KB
60 KB 896ms
92ms Script
application/x-javascript 157.240.253.1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: geniuspro.pro
URL: https://geniuspro.pro/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.253.1 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra5.fbcdn.net

Software

Resource Hash

4d424af8e6254a3ee915b6efdec3f0ed3fcbdedc67c83025148c9758701cd2d4

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://geniuspro.pro/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Mon, 19 Aug 2024 14:15:46 GMT
document-policy: force-load-at-top
x-fb-server-load: 67
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 58865
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: GOOD; q=0.7, rtt=104, rtx=0, c=15, mss=1317, tbw=2800, tp=-1, tpl=-1, uplat=0, ullat=-1
pragma: public
x-fb-debug: Ej/ypQBX2XRNNCXfznaDTuWjYhFKWdplPmNCmelxKj5o8CYrzvR6u8hZvJVM1MjDEfc6KG4n30FqhDz3km8dMA==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), battery=(self), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 362627283ba793be440887b0e8b10d524a03a7b8f44f1a4ee2ed570c0066d76f

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 pattern.svg
geniuspro.pro/ 226 KB
227 KB 41ms
41ms Image
image/svg+xml 91.195.13.3
HOST4BIZ-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geniuspro.pro/pattern.svg
Requested by: Host: geniuspro.pro
URL: https://geniuspro.pro/telegram.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 91.195.13.3 , Poland, ASN61251 (HOST4BIZ-AS, PL),
Reverse DNS: pl-sh3.host4.biz
Software: nginx / PleskLin
Resource Hash: 118add53487c02aaf5b5ab9f69380fa06717deb10492e14aaa487e3c62806ad4

Request headers

Referer: https://geniuspro.pro/telegram.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 19 Aug 2024 14:15:45 GMT
last-modified: Sat, 20 Jul 2024 17:19:39 GMT
server: nginx
etag: "669bf1ab-3891a"
x-cache-status: MISS
x-powered-by: PleskLin
content-type: image/svg+xml
accept-ranges: bytes
content-length: 231706

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
geniuspro.pro/ 11 KB
11 KB 134ms
133ms Font
font/woff2 91.195.13.3
HOST4BIZ-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://geniuspro.pro/KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
Requested by: Host: geniuspro.pro
URL: https://geniuspro.pro/font-roboto.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 91.195.13.3 , Poland, ASN61251 (HOST4BIZ-AS, PL),
Reverse DNS: pl-sh3.host4.biz
Software: nginx / PleskLin
Resource Hash: 0f53e8b0a717ca4ce313eec62b90d41db62c2f4946259a65c93bf8e84c5b0c44

Request headers

Referer: https://geniuspro.pro/font-roboto.css
Origin: https://geniuspro.pro
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 19 Aug 2024 14:15:45 GMT
last-modified: Sat, 20 Jul 2024 17:19:36 GMT
server: nginx
etag: "669bf1a8-2b20"
x-cache-status: MISS
x-powered-by: PleskLin
content-type: font/woff2
accept-ranges: bytes
content-length: 11040

GET
H2 200 KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
geniuspro.pro/ 11 KB
11 KB 125ms
124ms Font
font/woff2 91.195.13.3
HOST4BIZ-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://geniuspro.pro/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
Requested by: Host: geniuspro.pro
URL: https://geniuspro.pro/font-roboto.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 91.195.13.3 , Poland, ASN61251 (HOST4BIZ-AS, PL),
Reverse DNS: pl-sh3.host4.biz
Software: nginx / PleskLin
Resource Hash: 796de064b8d80eba7ccacb8ba67d77fdbcdf4b385c844645d452c24537b3108f

Request headers

Referer: https://geniuspro.pro/font-roboto.css
Origin: https://geniuspro.pro
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 19 Aug 2024 14:15:45 GMT
last-modified: Sat, 20 Jul 2024 17:19:37 GMT
server: nginx
etag: "669bf1a9-2b14"
x-cache-status: MISS
x-powered-by: PleskLin
content-type: font/woff2
accept-ranges: bytes
content-length: 11028

GET
H2 200 KFOlCnqEu92Fr1MmWUlfABc4AMP6lbBP.woff2
geniuspro.pro/ 6 KB
7 KB 128ms
128ms Font
font/woff2 91.195.13.3
HOST4BIZ-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://geniuspro.pro/KFOlCnqEu92Fr1MmWUlfABc4AMP6lbBP.woff2
Requested by: Host: geniuspro.pro
URL: https://geniuspro.pro/font-roboto.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 91.195.13.3 , Poland, ASN61251 (HOST4BIZ-AS, PL),
Reverse DNS: pl-sh3.host4.biz
Software: nginx / PleskLin
Resource Hash: 2f662599cf4323a18b4f7da381a998a8873c0277fff2d866336f7ee943a102d6

Request headers

Referer: https://geniuspro.pro/font-roboto.css
Origin: https://geniuspro.pro
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 19 Aug 2024 14:15:45 GMT
last-modified: Sat, 20 Jul 2024 17:19:35 GMT
server: nginx
etag: "669bf1a7-19dc"
x-cache-status: MISS
x-powered-by: PleskLin
content-type: font/woff2
accept-ranges: bytes
content-length: 6620

GET
H2 200 KFOmCnqEu92Fr1Mu5mxKKTU1Kvnz.woff2
geniuspro.pro/ 6 KB
6 KB 126ms
125ms Font
font/woff2 91.195.13.3
HOST4BIZ-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://geniuspro.pro/KFOmCnqEu92Fr1Mu5mxKKTU1Kvnz.woff2
Requested by: Host: geniuspro.pro
URL: https://geniuspro.pro/font-roboto.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 91.195.13.3 , Poland, ASN61251 (HOST4BIZ-AS, PL),
Reverse DNS: pl-sh3.host4.biz
Software: nginx / PleskLin
Resource Hash: 41b5c3b25f4258190937deb900fa57a6db6d450ce7dd2af2259af760119a1c41

Request headers

Referer: https://geniuspro.pro/font-roboto.css
Origin: https://geniuspro.pro
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 19 Aug 2024 14:15:45 GMT
last-modified: Sat, 20 Jul 2024 17:19:38 GMT
server: nginx
etag: "669bf1aa-193c"
x-cache-status: MISS
x-powered-by: PleskLin
content-type: font/woff2
accept-ranges: bytes
content-length: 6460

GET
H2 200 833528668823049 Show response
connect.facebook.net/signals/config/ 70 KB
15 KB 157ms
156ms Script
application/x-javascript 157.240.253.1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/833528668823049?v=2.9.164&r=stable&domain=geniuspro.pro&hme=61ff4e692c87a9a2ce7b19822df2b04638e3ca38b23c1be6c0f1945ccadb2ad5&ex_m=69%2C118%2C104%2C108%2C60%2C4%2C97%2C68%2C16%2C94%2C86%2C50%2C53%2C167%2C170%2C182%2C178%2C179%2C181%2C29%2C98%2C52%2C75%2C180%2C162%2C165%2C175%2C176%2C183%2C127%2C40%2C34%2C139%2C15%2C49%2C189%2C188%2C129%2C18%2C39%2C1%2C42%2C64%2C65%2C66%2C70%2C90%2C17%2C14%2C93%2C89%2C88%2C105%2C51%2C107%2C38%2C106%2C30%2C91%2C26%2C163%2C166%2C136%2C28%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C56%2C61%2C63%2C73%2C99%2C27%2C74%2C9%2C8%2C78%2C47%2C21%2C101%2C100%2C102%2C95%2C10%2C20%2C3%2C19%2C83%2C55%2C81%2C33%2C72%2C0%2C92%2C32%2C80%2C85%2C46%2C45%2C84%2C37%2C5%2C87%2C79%2C43%2C35%2C82%2C2%2C36%2C62%2C41%2C103%2C44%2C77%2C67%2C109%2C59%2C58%2C31%2C96%2C57%2C54%2C48%2C76%2C71%2C24%2C110

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.253.1 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra5.fbcdn.net

Software

Resource Hash

95bc9f4e6a3d0aef15f3a94676257662159faffbd74edb536f5500cc49ce92f9

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src .fbcdn.net .facebook.net 'unsafe-inline' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://geniuspro.pro/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Mon, 19 Aug 2024 14:15:46 GMT
document-policy: force-load-at-top
x-fb-server-load: 49
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=43, rtx=0, c=61, mss=1317, tbw=64399, tp=-1, tpl=-1, uplat=110, ullat=0
pragma: public
x-fb-debug: AAhKH4QZhYIFaNJjMesI2Hw/r2bc0xR4jpfV5izYs2i0adfF92aVc6zL+4DXVHR6sTcz03gAi69L0bI6OmDJlg==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), battery=(self), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 0
274 B 437ms
45ms Image
text/plain 157.240.253.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=833528668823049&ev=PageView&dl=https%3A%2F%2Fgeniuspro.pro%2F&rl=&if=false&ts=1724076946805&sw=1600&sh=1200&v=2.9.164&r=stable&ec=0&o=4126&fbp=fb.1.1724076946802.598062276506988228&cs_est=true&ler=empty&cdl=API_unavailable&it=1724076946613&coo=false&rqm=GET

Requested by

Host: geniuspro.pro
URL: https://geniuspro.pro/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.253.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-02-fra5.facebook.com

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://geniuspro.pro/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-fb-connection-quality: EXCELLENT; q=0.9, rtt=42, rtx=0, c=10, mss=1317, tbw=2781, tp=-1, tpl=-1, uplat=0, ullat=0
strict-transport-security: max-age=31536000; includeSubDomains
date: Mon, 19 Aug 2024 14:15:47 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
3 KB 840ms
449ms Image
image/png 157.240.253.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=833528668823049&ev=PageView&dl=https%3A%2F%2Fgeniuspro.pro%2F&rl=&if=false&ts=1724076946805&sw=1600&sh=1200&v=2.9.164&r=stable&ec=0&o=4126&fbp=fb.1.1724076946802.598062276506988228&cs_est=true&ler=empty&cdl=API_unavailable&it=1724076946613&coo=false&rqm=FGET

Requested by

Host: geniuspro.pro
URL: https://geniuspro.pro/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.253.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-02-fra5.facebook.com

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://geniuspro.pro/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-encoding: zstd
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; preload
date: Mon, 19 Aug 2024 14:15:47 GMT
document-policy: force-load-at-top
x-fb-server-load: 45
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7404854103216068885", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=42, rtx=0, c=10, mss=1317, tbw=3099, tp=-1, tpl=-1, uplat=396, ullat=0
pragma: no-cache
x-fb-debug: UsBFrAz1vkNnb7Gf3pHBGM3I0vbGXMktjkzc83RceB4cuiaETvEdsWXEJjlFBlrJZDic06bfEHNpwUdx36iJ7A==
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7404854103216068885"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: image/png
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: private, no-store, no-cache, must-revalidate
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), battery=(self), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 favicon.ico
geniuspro.pro/ 15 KB
15 KB 40ms
39ms Other
image/vnd.microsoft.icon 91.195.13.3
HOST4BIZ-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://geniuspro.pro/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 91.195.13.3 , Poland, ASN61251 (HOST4BIZ-AS, PL),
Reverse DNS: pl-sh3.host4.biz
Software: nginx / PleskLin
Resource Hash: 4ff54bc38c267dc3a8c95f6ed4590336baaec70433ef15d027ddca608c391e78

Request headers

Referer: https://geniuspro.pro/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Mon, 19 Aug 2024 14:15:47 GMT
last-modified: Sat, 20 Jul 2024 17:19:32 GMT
server: nginx
etag: "669bf1a4-3aee"
x-cache-status: BYPASS
x-powered-by: PleskLin
content-type: image/vnd.microsoft.icon
accept-ranges: bytes
content-length: 15086

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Telegram (Instant Messenger)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| fbq function| _fbq

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.geniuspro.pro/	1970-01-21 01:04:12	Name: _fbp Value: fb.1.1724076946802.598062276506988228

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

connect.facebook.net
geniuspro.pro
www.facebook.com
157.240.253.1
157.240.253.35
91.195.13.3
0f53e8b0a717ca4ce313eec62b90d41db62c2f4946259a65c93bf8e84c5b0c44
118add53487c02aaf5b5ab9f69380fa06717deb10492e14aaa487e3c62806ad4
18e7e6f6bcdcea325be168d047aaa2341cf58a54717662fbd002c3e3181cb62d
27780ccf89e3853f260323c142e835e76d72fb2846169c8425ff39565da7efac
2f662599cf4323a18b4f7da381a998a8873c0277fff2d866336f7ee943a102d6
362627283ba793be440887b0e8b10d524a03a7b8f44f1a4ee2ed570c0066d76f
41b5c3b25f4258190937deb900fa57a6db6d450ce7dd2af2259af760119a1c41
4d424af8e6254a3ee915b6efdec3f0ed3fcbdedc67c83025148c9758701cd2d4
4ff54bc38c267dc3a8c95f6ed4590336baaec70433ef15d027ddca608c391e78
796de064b8d80eba7ccacb8ba67d77fdbcdf4b385c844645d452c24537b3108f
95bc9f4e6a3d0aef15f3a94676257662159faffbd74edb536f5500cc49ce92f9
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
e18aa6e37c9c71a0c3b6ce62c7d8bf64b1c30d2dd0a9b3c6c0dae41ae4d77aa3
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f1d083ffaa644c708f11db29707aa57c19246e6d32643b03fee3f82c17b224b3
fa5725b3a54e285f3b0326746724f9571c13f605fff420fe2c4be7faa84e89da

geniuspro.pro Open in urlscan Pro 91.195.13.3 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

15 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

4 IPs

2 Countries

436 kBTransfer

785 kBSize

1 Cookies

3 Outgoing links

Page URL History

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

1 Cookies

Indicators

geniuspro.pro Open in urlscan Pro
91.195.13.3 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

436 kB
Transfer

785 kB
Size

1
Cookies

15 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!