telegramreport.me
Open in
urlscan Pro
2606:4700:3033::6818:73ee
Malicious Activity!
Public Scan
Submission: On September 18 via api from US
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 26th 2020. Valid for: a year.
This is the only time telegramreport.me was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Telegram (Instant Messenger)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 10 | 2606:4700:303... 2606:4700:3033::6818:73ee | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2001:67c:4e8:... 2001:67c:4e8:1033:6:100:0:a | 62041 (TELEGRAM) (TELEGRAM) | |
2 | 2001:67c:4e8:... 2001:67c:4e8:1033:3:100:0:a | 62041 (TELEGRAM) (TELEGRAM) | |
13 | 3 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
telegramreport.me
1 redirects
telegramreport.me |
686 KB |
2 |
t.me
t.me |
980 B |
2 |
telegram.me
telegram.me |
980 B |
13 | 3 |
Domain | Requested by | |
---|---|---|
10 | telegramreport.me |
1 redirects
telegramreport.me
|
2 | t.me |
telegramreport.me
|
2 | telegram.me |
telegramreport.me
|
13 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
telegram.org |
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2020-07-26 - 2021-07-26 |
a year | crt.sh |
*.telegram.me Go Daddy Secure Certificate Authority - G2 |
2017-10-23 - 2020-11-17 |
3 years | crt.sh |
*.t.me Go Daddy Secure Certificate Authority - G2 |
2019-09-10 - 2021-12-05 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://telegramreport.me/active/
Frame ID: C39D91117805DC798A483CB79AD8735B
Requests: 13 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://telegramreport.me/active
HTTP 301
https://telegramreport.me/active/ Page URL
Detected technologies
CloudFlare (CDN) ExpandDetected patterns
- headers server /^cloudflare$/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title:
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://telegramreport.me/active
HTTP 301
https://telegramreport.me/active/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
13 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
telegramreport.me/active/ Redirect Chain
|
23 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.css
telegramreport.me/active/css/ |
190 KB 33 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
desktop.css
telegramreport.me/active/css/ |
44 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
WebResource.axd
telegramreport.me/active/ |
23 KB 4 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
WebResource.axd
telegramreport.me/active/ |
3 KB 842 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.js
telegramreport.me/active/js/ |
2 MB 616 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
_websync_
telegram.me/ |
4 B 490 B |
Script
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
_websync_
t.me/ |
4 B 490 B |
Script
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
General_2x.png
telegramreport.me/active/img/icons/ |
15 KB 15 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Telegram.svg
telegramreport.me/active/img/ |
5 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
en-us.json
telegramreport.me/active/js/locales/ |
1 KB 573 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
_websync_
telegram.me/ |
4 B 490 B |
Script
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
_websync_
t.me/ |
4 B 490 B |
Script
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Telegram (Instant Messenger)396 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| trustedTypes function| myFunction object| theForm function| __doPostBack function| WebForm_PostBackOptions function| WebForm_DoPostBackWithOptions object| __pendingCallbacks number| __synchronousCallBackIndex function| WebForm_DoCallback function| WebForm_CallbackComplete function| WebForm_ExecuteCallback function| WebForm_FillFirstAvailableSlot boolean| __nonMSDOMBrowser string| __theFormPostData object| __theFormPostCollection object| __callbackTextTypes function| WebForm_InitCallback function| WebForm_InitCallbackAddField function| WebForm_EncodeCallback object| __disabledControlArray function| WebForm_ReEnableControls function| WebForm_ReDisableControls function| WebForm_SimulateClick function| WebForm_FireDefaultButton function| WebForm_GetScrollX function| WebForm_GetScrollY function| WebForm_SaveScrollPositionSubmit function| WebForm_SaveScrollPositionOnSubmit function| WebForm_RestoreScrollPosition function| WebForm_TextBoxKeyHandler function| WebForm_TrimString function| WebForm_AppendToClassName function| WebForm_RemoveClassName function| WebForm_GetElementById function| WebForm_GetElementByTagName function| WebForm_GetElementsByTagName function| WebForm_GetElementDir function| WebForm_GetElementPosition function| WebForm_GetParentByTagName function| WebForm_SetElementHeight function| WebForm_SetElementWidth function| WebForm_SetElementX function| WebForm_SetElementY function| WebForm_FindFirstFocusableChild function| WebForm_AutoFocus function| WebForm_CanFocus function| WebForm_IsFocusableTag function| WebForm_IsInVisibleContainer function| displayIframe function| f function| BigInteger function| nbi function| am1 function| am2 function| am3 function| int2char function| intAt function| bnpCopyTo function| bnpFromInt function| nbv function| bnpFromString function| bnpClamp function| bnToString function| bnNegate function| bnAbs function| bnCompareTo function| nbits function| bnBitLength function| bnpDLShiftTo function| bnpDRShiftTo function| bnpLShiftTo function| bnpRShiftTo function| bnpSubTo function| bnpMultiplyTo function| bnpSquareTo function| bnpDivRemTo function| bnMod function| Classic function| cConvert function| cRevert function| cReduce function| cMulTo function| cSqrTo function| bnpInvDigit function| Montgomery function| montConvert function| montRevert function| montReduce function| montSqrTo function| montMulTo function| bnpIsEven function| bnpExp function| bnModPowInt function| bnClone function| bnIntValue function| bnByteValue function| bnShortValue function| bnpChunkSize function| bnSigNum function| bnpToRadix function| bnpFromRadix function| bnpFromNumber function| bnToByteArray function| bnEquals function| bnMin function| bnMax function| bnpBitwiseTo function| op_and function| bnAnd function| op_or function| bnOr function| op_xor function| bnXor function| op_andnot function| bnAndNot function| bnNot function| bnShiftLeft function| bnShiftRight function| lbit function| bnGetLowestSetBit function| cbit function| bnBitCount function| bnTestBit function| bnpChangeBit function| bnSetBit function| bnClearBit function| bnFlipBit function| bnpAddTo function| bnAdd function| bnSubtract function| bnMultiply function| bnSquare function| bnDivide function| bnRemainder function| bnDivideAndRemainder function| bnpDMultiply function| bnpDAddOffset function| NullExp function| nNop function| nMulTo function| nSqrTo function| bnPow function| bnpMultiplyLowerTo function| bnpMultiplyUpperTo function| Barrett function| barrettConvert function| barrettRevert function| barrettReduce function| barrettSqrTo function| barrettMulTo function| bnModPow function| bnGCD function| bnpModInt function| bnModInverse function| bnIsProbablePrime function| bnpMillerRabin function| rng_seed_int function| rng_seed_time function| rng_get_byte function| rng_get_bytes function| SecureRandom function| Arcfour function| ARC4init function| ARC4next function| prng_newstate function| findPrimes function| millerRabinInt function| millerRabin function| bitSize function| expand function| randTruePrime function| randProbPrime function| randProbPrimeRounds function| mod function| addInt function| mult function| powMod function| sub function| add function| inverseMod function| multMod function| randTruePrime_ function| randBigInt function| randBigInt_ function| GCD function| GCD_ function| inverseMod_ function| inverseModInt function| inverseModInt_ function| eGCD_ function| negative function| greaterShift function| greater function| divide_ function| carry_ function| modInt function| int2bigInt function| str2bigInt function| equalsInt function| equals function| isZero function| bigInt2str function| dup function| copy_ function| copyInt_ function| addInt_ function| rightShift_ function| halve_ function| leftShift_ function| multInt_ function| divInt_ function| linComb_ function| linCombShift_ function| addShift_ function| subShift_ function| sub_ function| add_ function| mult_ function| mod_ function| multMod_ function| squareMod_ function| trim function| powMod_ function| mont_ function| dT function| checkClick function| isInDOM function| checkDragEvent function| cancelEvent function| hasOnclick function| getScrollWidth function| onCtrlEnter function| setFieldSelection function| getFieldSelection function| getRichValue function| getRichValueWithCaret function| getRichElementValue function| setRichFocus function| getSelectedText function| scrollToNode function| onContentLoaded function| tsNow function| safeReplaceObject function| listMergeSorted function| listUniqSorted function| templateUrl function| encodeEntities function| calcImageInBox function| versionCompare function| bigint function| bigStringInt function| dHexDump function| bytesToHex function| bytesFromHex function| bytesToBase64 function| uint6ToBase64 function| base64ToBlob function| dataUrlToBlob function| blobConstruct function| blobSafeMimeType function| bytesCmp function| bytesXor function| bytesToWords function| bytesFromWords function| bytesFromBigInt function| bytesFromLeemonBigInt function| bytesToArrayBuffer function| convertToArrayBuffer function| convertToUint8Array function| convertToByteArray function| bytesFromArrayBuffer function| bufferConcat function| longToInts function| longToBytes function| longFromInts function| intToUint function| uintToInt function| sha1HashSync function| sha1BytesSync function| sha256HashSync function| rsaEncrypt function| addPadding function| aesEncryptSync function| aesDecryptSync function| gzipUncompress function| nextRandomInt function| pqPrimeFactorization function| pqPrimeBigInteger function| gcdLong function| pqPrimeLong function| pqPrimeLeemon function| bytesModPow function| TLSerialization function| TLDeserialization function| EmojiTooltip function| EmojiPanel function| MessageComposer function| Scroller number| dbits number| canary boolean| j_lm number| BI_FP string| BI_RM object| BI_RC number| rr number| vv object| lowprimes number| lplim undefined| rng_state object| rng_pool number| rng_pptr object| global object| t object| ua undefined| z number| rng_psize object| CryptoJS function| OGVDemuxerOgg function| OGVDecoderAudioOpus function| OGVDecoderAudioVorbis number| _logTimer object| extraModules function| setZeroTimeout function| $ function| jQuery object| Config object| ConfigStorage function| safeConfirm object| angular function| Rusha object| Zlib object| goog number| bpe number| mask number| radix string| digitsStr object| buff object| one object| ss object| s0 object| s1 object| s2 object| s3 object| s4 object| s5 object| s6 object| s7 object| T object| sa object| mr_x1 object| mr_r object| mr_a object| eg_v object| eg_u object| eg_A object| eg_B object| eg_C object| eg_D object| md_q1 object| md_q2 object| md_q3 object| md_r object| md_r1 object| md_r2 object| md_tt object| primes object| pows object| s_i object| s_i2 object| s_R object| s_rm object| s_q object| s_n1 object| s_a object| s_r2 object| s_n object| s_b object| s_d object| s_x1 object| s_x2 object| s_aa object| rpprb function| WebPDecoder function| OGVTimeRanges function| OGVMediaError string| prop object| OGVCompat object| OGVLoader function| OGVMediaType function| OGVPlayer string| OGVVersion object| ogvjs function| Recorder function| onAnimationFrameCallback object| SearchIndexManager object| EmojiHelper2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
telegramreport.me/ | Name: ASP.NET_SessionId Value: qa4xis5e2zty54oux2ti142o |
|
.telegramreport.me/ | Name: __cfduid Value: d0c5793fbf68f2458b52a48c5c94f3bc71600423957 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
t.me
telegram.me
telegramreport.me
2001:67c:4e8:1033:3:100:0:a
2001:67c:4e8:1033:6:100:0:a
2606:4700:3033::6818:73ee
0849c0703ac5c6cca6840c28a78bc48bc24af75e0e6931d7bd9028d43f13f0db
144524233f795d6a425b76f7ae5c0bb622b5f67e2e6ae73532ad526528ca07cf
40732e9dcfa704cf615e4691bb07aecfd1cc5e063220a46e4a7ff6560c77f5db
5eb7243e90922db22368be7aa6b88d3fb385a9441a90b1eabd6cc30251decd0a
ac6a23683a7faf217cd2309deceffc705619d724c1706f012db4a5deed5d27ee
b558906ae459f054b4dda2e56a7288262e151e7241204b080a86bd58cdfd6650
b58e860b39b9bca11c82a66f55cd8c962b46e84e4cdd3f9876c2a0cd2c74021d
b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b
bd24e2e781d27a24a5b689e340f6acfd17069cf48814d563160c8c9265382d77
dc1d54dab6ec8c00f70137927504e4f222c8395f10760b6beecfcfa94e08249f