| telegrmm.cc/assets/img/android-chrome-192x192.png?v=jw3mK7G9Ry |  103.209.129.119 | 200 OK | 9.0 kB |
URL GET HTTP/2telegrmm.cc/assets/img/android-chrome-192x192.png?v=jw3mK7G9Ry IP103.209.129.119:443
CertificateIssuerLet's Encrypt Subjecttelegyam.cc FingerprintE5:80:53:36:D3:D6:8E:ED:12:E7:78:BF:D5:E9:18:54:CC:A7:1B:4A ValidityWed, 17 Apr 2024 10:12:02 GMT - Tue, 16 Jul 2024 10:12:01 GMT
File typePNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced Hash87fecdadac0beb95f9b7c87b3b3236f0 822f92446c0033a32462aa21208efaef1f0d8c3c 25aa724658da8e71f5cc7c35ccbb43075866af5bed964edb09979caace667b0b
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | Telegram | | PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET /assets/img/android-chrome-192x192.png?v=jw3mK7G9Ry HTTP/1.1
Host: telegrmm.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://telegrmm.cc/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Thu, 25 Apr 2024 17:40:11 GMT
content-type: image/png
content-length: 9024
last-modified: Sun, 28 Jan 2024 09:29:02 GMT
etag: "65b61e5e-2340"
expires: Sat, 25 May 2024 17:40:11 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| telegrmm.cc/assets/img/favicon-16x16.png?v=jw3mK7G9Ry | 103.209.129.119 | 200 OK | 1.0 kB |
URL GET HTTP/2telegrmm.cc/assets/img/favicon-16x16.png?v=jw3mK7G9Ry IP103.209.129.119:443
CertificateIssuerLet's Encrypt Subjecttelegyam.cc FingerprintE5:80:53:36:D3:D6:8E:ED:12:E7:78:BF:D5:E9:18:54:CC:A7:1B:4A ValidityWed, 17 Apr 2024 10:12:02 GMT - Tue, 16 Jul 2024 10:12:01 GMT
File typePNG image data, 16 x 16, 8-bit colormap, non-interlaced Hashe3ce05eb00b3215df220efaf0fd06e21 d1533966f79dc2984c34317035f31cf3c91298c9 0d67b7e8ea46e3c959329a0e79a8c8b236187f452edc7049524245e4aa6bee21
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | Telegram | | PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET /assets/img/favicon-16x16.png?v=jw3mK7G9Ry HTTP/1.1
Host: telegrmm.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://telegrmm.cc/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Thu, 25 Apr 2024 17:40:11 GMT
content-type: image/png
content-length: 1012
last-modified: Sun, 28 Jan 2024 09:29:02 GMT
etag: "65b61e5e-3f4"
expires: Sat, 25 May 2024 17:40:11 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| telegrmm.cc/index-oCcwLZ8q.css | 103.209.129.119 | 200 OK | 106 kB |
URL GET HTTP/2telegrmm.cc/index-oCcwLZ8q.css IP103.209.129.119:443
CertificateIssuerLet's Encrypt Subjecttelegyam.cc FingerprintE5:80:53:36:D3:D6:8E:ED:12:E7:78:BF:D5:E9:18:54:CC:A7:1B:4A ValidityWed, 17 Apr 2024 10:12:02 GMT - Tue, 16 Jul 2024 10:12:01 GMT
File typegzip compressed data, from Unix Size106 kB (105764 bytes) Hash41b714d37830c9b1cd837742c4c5c2a5 5b923aca9f4c0ce22a4ff95d82cc862e98ccdcd5 8d2ab654bc1380183912a75c454fdc228026e31ff86cd6331739f83084fff60f
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | Telegram | | PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET /index-oCcwLZ8q.css HTTP/1.1
Host: telegrmm.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://telegrmm.cc/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Thu, 25 Apr 2024 17:40:08 GMT
content-type: text/css
last-modified: Wed, 21 Feb 2024 11:00:06 GMT
vary: Accept-Encoding
etag: W/"65d5d7b6-6b101"
expires: Fri, 26 Apr 2024 05:40:08 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| | 103.209.129.119 | 200 OK | 19 kB |
URL User Request GET HTTP/2IP103.209.129.119:443
CertificateIssuerLet's Encrypt Subjecttelegyam.cc FingerprintE5:80:53:36:D3:D6:8E:ED:12:E7:78:BF:D5:E9:18:54:CC:A7:1B:4A ValidityWed, 17 Apr 2024 10:12:02 GMT - Tue, 16 Jul 2024 10:12:01 GMT
File typegzip compressed data, from Unix Hash8161e35f3864297bda0e5fea478d8b37 ec2e8e01dab3b3089b93e516c43159bedfc1303e 41b88b9af3862454d938bd547b5f065c31afb99a5ab283d1c47addc83bbf3103
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | Telegram | | PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET / HTTP/1.1
Host: telegrmm.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Thu, 25 Apr 2024 17:40:07 GMT
content-type: text/html
last-modified: Wed, 21 Feb 2024 11:00:06 GMT
vary: Accept-Encoding
etag: W/"65d5d7b6-3523"
strict-transport-security: max-age=31536000
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| telegrmm.cc/index-xw5BGope.js | 103.209.129.119 | 200 OK | 59 kB |
URL GET HTTP/2telegrmm.cc/index-xw5BGope.js IP103.209.129.119:443
CertificateIssuerLet's Encrypt Subjecttelegyam.cc FingerprintE5:80:53:36:D3:D6:8E:ED:12:E7:78:BF:D5:E9:18:54:CC:A7:1B:4A ValidityWed, 17 Apr 2024 10:12:02 GMT - Tue, 16 Jul 2024 10:12:01 GMT
File typegzip compressed data, from Unix Hash1fe9c40e1ab40a7b41ceb7f0296268ed c5f32c4025737ef85e2161e9a6804ce9d7f8ed34 3402571d799df902a60d0cd507243595deb7277b74da26e3b7957b06d9885e2d
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | Telegram | | PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET /index-xw5BGope.js HTTP/1.1
Host: telegrmm.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://telegrmm.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Thu, 25 Apr 2024 17:40:08 GMT
content-type: application/javascript
last-modified: Wed, 21 Feb 2024 11:00:06 GMT
vary: Accept-Encoding
etag: W/"65d5d7b6-1eaef"
expires: Fri, 26 Apr 2024 05:40:08 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| venus.web.telegram.org/apiw1 |  149.154.167.99 | | 169 B |
URL venus.web.telegram.org/apiw1 IP149.154.167.99:0 ASN#62041 Telegram Messenger Inc
File typeHTML document, ASCII text, with CRLF line terminators Hashc2a982d42f89274763eef2a44fe01030 86e6d53f6478cdd0c05611093d9c55a953454af7 d8b55de3a4d5331f3b450a86bb907afe17dc964adca30f39d101a3d55a4a9d6a
POST /apiw1 HTTP/1.1
Host: venus.web.telegram.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://telegrmm.cc/
Content-Length: 0
Origin: https://telegrmm.cc
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 404 Not Found
server: nginx/1.18.0
date: Thu, 25 Apr 2024 17:40:16 GMT
content-type: text/html
content-length: 169
access-control-allow-origin: *
access-control-allow-methods: POST, OPTIONS
access-control-allow-headers: origin, content-type
access-control-max-age: 1728000
X-Firefox-Spdy: h2
|
|
| kws2.web.telegram.org/apiws | 149.154.167.99 | | 0 B |
URL kws2.web.telegram.org/apiws IP149.154.167.99:0 ASN#62041 Telegram Messenger Inc
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /apiws HTTP/1.1
Host: kws2.web.telegram.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: https://telegrmm.cc
Sec-WebSocket-Protocol: binary
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: x6giar22SzOb+zbbQKeJOw==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Server: nginx/1.18.0
Date: Thu, 25 Apr 2024 17:40:16 GMT
Connection: upgrade
Upgrade: websocket
Sec-WebSocket-Accept: p1nOvM7hYika3NVtJh7rUqFYTKw=
Sec-WebSocket-Protocol: binary
|
|
| telegrmm.cc/putPreloader-Te6eTPJ-.js | 103.209.129.119 | 200 OK | 699 B |
URL GET HTTP/2telegrmm.cc/putPreloader-Te6eTPJ-.js IP103.209.129.119:443
CertificateIssuerLet's Encrypt Subjecttelegyam.cc FingerprintE5:80:53:36:D3:D6:8E:ED:12:E7:78:BF:D5:E9:18:54:CC:A7:1B:4A ValidityWed, 17 Apr 2024 10:12:02 GMT - Tue, 16 Jul 2024 10:12:01 GMT
File typeASCII text, with very long lines (394) Hash08ae0c8388abd1d0fc04434390a33b75 dd7456611b51e63e8ecd2b99bf899baf07fa7461 6aa990beec1eb3b8d6bf2420046049fa8e250ee260ff5175d1cd14cf4e6b29ed
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | Telegram | | PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET /putPreloader-Te6eTPJ-.js HTTP/1.1
Host: telegrmm.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://telegrmm.cc/pageSignQR-uKY2b3U1.js
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Thu, 25 Apr 2024 17:40:16 GMT
content-type: application/javascript
content-length: 699
last-modified: Wed, 21 Feb 2024 11:00:06 GMT
etag: "65d5d7b6-2bb"
expires: Fri, 26 Apr 2024 05:40:16 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| telegrmm.cc/textToSvgURL-Z4O-nL1S.js | 103.209.129.119 | 200 OK | 357 B |
URL GET HTTP/2telegrmm.cc/textToSvgURL-Z4O-nL1S.js IP103.209.129.119:443
CertificateIssuerLet's Encrypt Subjecttelegyam.cc FingerprintE5:80:53:36:D3:D6:8E:ED:12:E7:78:BF:D5:E9:18:54:CC:A7:1B:4A ValidityWed, 17 Apr 2024 10:12:02 GMT - Tue, 16 Jul 2024 10:12:01 GMT
File typeASCII text, with very long lines (306) Hashcca1508d96dbfce74dcbaed756d04955 c539ff84caf27c4b22e498662644c07e6893c19a 36cb02e59322028c02c5365bd56cbd129b3eb2fb4aaec625160ca2dc9786a4bd
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | Telegram | | PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET /textToSvgURL-Z4O-nL1S.js HTTP/1.1
Host: telegrmm.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://telegrmm.cc/pageSignQR-uKY2b3U1.js
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Thu, 25 Apr 2024 17:40:16 GMT
content-type: application/javascript
content-length: 357
last-modified: Wed, 21 Feb 2024 11:00:06 GMT
etag: "65d5d7b6-165"
expires: Fri, 26 Apr 2024 05:40:16 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| telegrmm.cc/mtproto.worker-OoRqawEg.js | 103.209.129.119 | | 274 kB |
URL telegrmm.cc/mtproto.worker-OoRqawEg.js IP103.209.129.119:0
CertificateIssuerLet's Encrypt Subjecttelegyam.cc FingerprintE5:80:53:36:D3:D6:8E:ED:12:E7:78:BF:D5:E9:18:54:CC:A7:1B:4A ValidityWed, 17 Apr 2024 10:12:02 GMT - Tue, 16 Jul 2024 10:12:01 GMT
File typegzip compressed data, from Unix Size274 kB (274331 bytes) Hash8e588194f8f2a0c22c416efdfde5e662 0d10f1cdeb90eb6d9e9bd3030932c3f12cdc8de4 b88c19173e317948b8832597cb032fc0f563beb089ae255e3b46983abfaad579
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | Telegram | | PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET /mtproto.worker-OoRqawEg.js HTTP/1.1
Host: telegrmm.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://telegrmm.cc/
Sec-Fetch-Dest: sharedworker
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Thu, 25 Apr 2024 17:40:12 GMT
content-type: application/javascript
last-modified: Wed, 21 Feb 2024 11:00:06 GMT
vary: Accept-Encoding
etag: W/"65d5d7b6-e40bb"
expires: Fri, 26 Apr 2024 05:40:12 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| kws2.web.telegram.org/apiws | 149.154.167.99 | | 0 B |
URL kws2.web.telegram.org/apiws IP149.154.167.99:0 ASN#62041 Telegram Messenger Inc
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /apiws HTTP/1.1
Host: kws2.web.telegram.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: https://telegrmm.cc
Sec-WebSocket-Protocol: binary
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: xPjvKE8nFAwTPxlRkXgCUA==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Server: nginx/1.18.0
Date: Thu, 25 Apr 2024 17:40:16 GMT
Connection: upgrade
Upgrade: websocket
Sec-WebSocket-Accept: WjlpLG2cWfPpjlu3DZVQSxoQevc=
Sec-WebSocket-Protocol: binary
|
|
| kws2.web.telegram.org/apiws | 149.154.167.99 | | 0 B |
URL kws2.web.telegram.org/apiws IP149.154.167.99:0 ASN#62041 Telegram Messenger Inc
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /apiws HTTP/1.1
Host: kws2.web.telegram.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: https://telegrmm.cc
Sec-WebSocket-Protocol: binary
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: Tgrgz/wSgcBAF2okfn02eA==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Server: nginx/1.18.0
Date: Thu, 25 Apr 2024 17:40:16 GMT
Connection: upgrade
Upgrade: websocket
Sec-WebSocket-Accept: T5KCGfNZNIDgJdlm4cUytfsL/E0=
Sec-WebSocket-Protocol: binary
|
|
| telegrmm.cc/pageSignQR-uKY2b3U1.js | 103.209.129.119 | 200 OK | 26 kB |
URL GET HTTP/2telegrmm.cc/pageSignQR-uKY2b3U1.js IP103.209.129.119:443
CertificateIssuerLet's Encrypt Subjecttelegyam.cc FingerprintE5:80:53:36:D3:D6:8E:ED:12:E7:78:BF:D5:E9:18:54:CC:A7:1B:4A ValidityWed, 17 Apr 2024 10:12:02 GMT - Tue, 16 Jul 2024 10:12:01 GMT
File typegzip compressed data, from Unix Hash7faf2eceb68b1247d7656fa84cf16cdd 987f689d25c41d2efb72a442899148db363fcd7b 2fd5f9b9eed060c2a096dd752e0b7f13c89601bfe4b5259c74ebae11fd94b213
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | Telegram | | PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET /pageSignQR-uKY2b3U1.js HTTP/1.1
Host: telegrmm.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://telegrmm.cc/index-xw5BGope.js
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Thu, 25 Apr 2024 17:40:15 GMT
content-type: application/javascript
last-modified: Wed, 21 Feb 2024 11:00:06 GMT
vary: Accept-Encoding
etag: W/"65d5d7b6-1443"
expires: Fri, 26 Apr 2024 05:40:15 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| telegrmm.cc/assets/fonts/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2 | 103.209.129.119 | 200 OK | 11 kB |
URL GET HTTP/2telegrmm.cc/assets/fonts/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2 IP103.209.129.119:443
CertificateIssuerLet's Encrypt Subjecttelegyam.cc FingerprintE5:80:53:36:D3:D6:8E:ED:12:E7:78:BF:D5:E9:18:54:CC:A7:1B:4A ValidityWed, 17 Apr 2024 10:12:02 GMT - Tue, 16 Jul 2024 10:12:01 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 11056, version 1.0 Hash07db243db21ed0a6b4ff05ff429686b7 5d62925fdd7ed8e80f206d095ed093994f13d276 ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | Telegram | | PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET /assets/fonts/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2 HTTP/1.1
Host: telegrmm.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://telegrmm.cc/index-oCcwLZ8q.css
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Thu, 25 Apr 2024 17:40:18 GMT
content-type: font/woff2
content-length: 11056
last-modified: Sun, 28 Jan 2024 09:29:02 GMT
etag: "65b61e5e-2b30"
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| telegrmm.cc/assets/img/logo_padded.svg | 103.209.129.119 | 200 OK | 1.1 kB |
URL GET HTTP/2telegrmm.cc/assets/img/logo_padded.svg IP103.209.129.119:443
CertificateIssuerLet's Encrypt Subjecttelegyam.cc FingerprintE5:80:53:36:D3:D6:8E:ED:12:E7:78:BF:D5:E9:18:54:CC:A7:1B:4A ValidityWed, 17 Apr 2024 10:12:02 GMT - Tue, 16 Jul 2024 10:12:01 GMT
File typeSVG Scalable Vector Graphics image Hash256adedc8580ce9d3e5d41bb6467a8e2 b1dd7a21d38aeabac25762e7c0587f82fd40274a eeb79b0ae5da35d3433de6edeec3a0e3cce9c24f517dbad26ed97e852666c8f4
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | Telegram | | PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET /assets/img/logo_padded.svg HTTP/1.1
Host: telegrmm.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://telegrmm.cc/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Thu, 25 Apr 2024 17:40:18 GMT
content-type: image/svg+xml
content-length: 1069
last-modified: Sun, 28 Jan 2024 09:29:02 GMT
etag: "65b61e5e-42d"
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| telegrmm.cc/crypto.worker-kuW4GA2x.js | 103.209.129.119 | 200 OK | 69 kB |
URL GET HTTP/2telegrmm.cc/crypto.worker-kuW4GA2x.js IP103.209.129.119:443
CertificateIssuerLet's Encrypt Subjecttelegyam.cc FingerprintE5:80:53:36:D3:D6:8E:ED:12:E7:78:BF:D5:E9:18:54:CC:A7:1B:4A ValidityWed, 17 Apr 2024 10:12:02 GMT - Tue, 16 Jul 2024 10:12:01 GMT
File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators Hash754daad900a76865e1d717f3cfc90e0a 807c890f93f65170f48d00ee3431a3fa9a5f2f6f 3448a2e9768c829296b06f5fa179e539b09f734c6975c7b21e32e96b4e9d770e
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | Telegram | | PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET /crypto.worker-kuW4GA2x.js HTTP/1.1
Host: telegrmm.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://telegrmm.cc/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Thu, 25 Apr 2024 17:40:12 GMT
content-type: application/javascript
last-modified: Wed, 21 Feb 2024 11:00:06 GMT
vary: Accept-Encoding
etag: W/"65d5d7b6-10ce5"
expires: Fri, 26 Apr 2024 05:40:12 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| telegrmm.cc/countries-lRU-UavE.js | 103.209.129.119 | 200 OK | 24 kB |
URL GET HTTP/2telegrmm.cc/countries-lRU-UavE.js IP103.209.129.119:443
CertificateIssuerLet's Encrypt Subjecttelegyam.cc FingerprintE5:80:53:36:D3:D6:8E:ED:12:E7:78:BF:D5:E9:18:54:CC:A7:1B:4A ValidityWed, 17 Apr 2024 10:12:02 GMT - Tue, 16 Jul 2024 10:12:01 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | Telegram | | PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET /countries-lRU-UavE.js HTTP/1.1
Host: telegrmm.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://telegrmm.cc/index-xw5BGope.js
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Thu, 25 Apr 2024 17:40:12 GMT
content-type: application/javascript
last-modified: Wed, 21 Feb 2024 11:00:06 GMT
vary: Accept-Encoding
etag: W/"65d5d7b6-5e21"
expires: Fri, 26 Apr 2024 05:40:12 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| telegrmm.cc/_commonjsHelpers-5-cIlDoe.js | 103.209.129.119 | 200 OK | 290 B |
URL GET HTTP/2telegrmm.cc/_commonjsHelpers-5-cIlDoe.js IP103.209.129.119:443
CertificateIssuerLet's Encrypt Subjecttelegyam.cc FingerprintE5:80:53:36:D3:D6:8E:ED:12:E7:78:BF:D5:E9:18:54:CC:A7:1B:4A ValidityWed, 17 Apr 2024 10:12:02 GMT - Tue, 16 Jul 2024 10:12:01 GMT
File typeASCII text, with very long lines (302), with no line terminators Hash2c4d6d27d76dee6e31a5e78877faba51 6a2773032cf08261b695305eb75b6aa25fb91d77 0d9af4fa5be8e6567f6e919c636e66546d0e1394b45f8140456512ae5dc690b0
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | Telegram | | PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET /_commonjsHelpers-5-cIlDoe.js HTTP/1.1
Host: telegrmm.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://telegrmm.cc/qr-code-styling-ogpV7fl-.js
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Thu, 25 Apr 2024 17:40:17 GMT
content-type: application/javascript
content-length: 290
last-modified: Wed, 21 Feb 2024 11:00:06 GMT
etag: "65d5d7b6-122"
expires: Fri, 26 Apr 2024 05:40:17 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| telegrmm.cc/assets/fonts/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 | 103.209.129.119 | 200 OK | 11 kB |
URL GET HTTP/2telegrmm.cc/assets/fonts/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 IP103.209.129.119:443
CertificateIssuerLet's Encrypt Subjecttelegyam.cc FingerprintE5:80:53:36:D3:D6:8E:ED:12:E7:78:BF:D5:E9:18:54:CC:A7:1B:4A ValidityWed, 17 Apr 2024 10:12:02 GMT - Tue, 16 Jul 2024 10:12:01 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 11016, version 1.0 Hash15fa3062f8929bd3b05fdca5259db412 6ff06a34f68ad0324ddec1bbe4d453c959178b36 5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | Telegram | | PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET /assets/fonts/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 HTTP/1.1
Host: telegrmm.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://telegrmm.cc/index-oCcwLZ8q.css
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Thu, 25 Apr 2024 17:40:12 GMT
content-type: font/woff2
content-length: 11016
last-modified: Sun, 28 Jan 2024 09:29:02 GMT
etag: "65b61e5e-2b08"
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| telegrmm.cc/langSign-lcKrqmwM.js | 103.209.129.119 | 200 OK | 1.6 kB |
URL GET HTTP/2telegrmm.cc/langSign-lcKrqmwM.js IP103.209.129.119:443
CertificateIssuerLet's Encrypt Subjecttelegyam.cc FingerprintE5:80:53:36:D3:D6:8E:ED:12:E7:78:BF:D5:E9:18:54:CC:A7:1B:4A ValidityWed, 17 Apr 2024 10:12:02 GMT - Tue, 16 Jul 2024 10:12:01 GMT
File typeASCII text, with very long lines (1751), with no line terminators Hash6503e4eb7fe92e639f1398a512bdf9d5 8fe9788360af3dde5507e78d48aa5324a99c0216 fe461dd4a36a65359703e4ec0f5f2a6cfbf8bc2d73ef82a8a75b3df3f12379b8
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | Telegram | | PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET /langSign-lcKrqmwM.js HTTP/1.1
Host: telegrmm.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://telegrmm.cc/index-xw5BGope.js
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Thu, 25 Apr 2024 17:40:12 GMT
content-type: application/javascript
last-modified: Wed, 21 Feb 2024 11:00:06 GMT
vary: Accept-Encoding
etag: W/"65d5d7b6-66e"
expires: Fri, 26 Apr 2024 05:40:12 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| telegrmm.cc/button-4bbDDUlR.js | 103.209.129.119 | 200 OK | 8.6 kB |
URL GET HTTP/2telegrmm.cc/button-4bbDDUlR.js IP103.209.129.119:443
CertificateIssuerLet's Encrypt Subjecttelegyam.cc FingerprintE5:80:53:36:D3:D6:8E:ED:12:E7:78:BF:D5:E9:18:54:CC:A7:1B:4A ValidityWed, 17 Apr 2024 10:12:02 GMT - Tue, 16 Jul 2024 10:12:01 GMT
File typeASCII text, with very long lines (9319), with no line terminators Hash79a9425abc48364bd8d01f49c952b16d 03a0e8a16443ae54e4eaaf3d69da6b05ac29a075 90226ff900c336620383bb0276cf3335ce47dfa3b33bd0ff5ed3cf7651b25bd4
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | Telegram | | PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET /button-4bbDDUlR.js HTTP/1.1
Host: telegrmm.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://telegrmm.cc/pageSignQR-uKY2b3U1.js
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Thu, 25 Apr 2024 17:40:16 GMT
content-type: application/javascript
last-modified: Wed, 21 Feb 2024 11:00:06 GMT
vary: Accept-Encoding
etag: W/"65d5d7b6-21a3"
expires: Fri, 26 Apr 2024 05:40:16 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| telegrmm.cc/qr-code-styling-ogpV7fl-.js | 103.209.129.119 | 200 OK | 66 kB |
URL GET HTTP/2telegrmm.cc/qr-code-styling-ogpV7fl-.js IP103.209.129.119:443
CertificateIssuerLet's Encrypt Subjecttelegyam.cc FingerprintE5:80:53:36:D3:D6:8E:ED:12:E7:78:BF:D5:E9:18:54:CC:A7:1B:4A ValidityWed, 17 Apr 2024 10:12:02 GMT - Tue, 16 Jul 2024 10:12:01 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | Telegram | | PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET /qr-code-styling-ogpV7fl-.js HTTP/1.1
Host: telegrmm.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://telegrmm.cc/pageSignQR-uKY2b3U1.js
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Thu, 25 Apr 2024 17:40:17 GMT
content-type: application/javascript
last-modified: Wed, 21 Feb 2024 11:00:06 GMT
vary: Accept-Encoding
etag: W/"65d5d7b6-10254"
expires: Fri, 26 Apr 2024 05:40:17 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| telegrmm.cc/lang-5amZgLT1.js | 103.209.129.119 | 200 OK | 112 kB |
URL GET HTTP/2telegrmm.cc/lang-5amZgLT1.js IP103.209.129.119:443
CertificateIssuerLet's Encrypt Subjecttelegyam.cc FingerprintE5:80:53:36:D3:D6:8E:ED:12:E7:78:BF:D5:E9:18:54:CC:A7:1B:4A ValidityWed, 17 Apr 2024 10:12:02 GMT - Tue, 16 Jul 2024 10:12:01 GMT
Size112 kB (111542 bytes) Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | Telegram | | PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET /lang-5amZgLT1.js HTTP/1.1
Host: telegrmm.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://telegrmm.cc/index-xw5BGope.js
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Thu, 25 Apr 2024 17:40:12 GMT
content-type: application/javascript
last-modified: Wed, 21 Feb 2024 11:00:06 GMT
vary: Accept-Encoding
etag: W/"65d5d7b6-1b3b6"
expires: Fri, 26 Apr 2024 05:40:12 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| telegrmm.cc/page-sZyLUWey.js | 103.209.129.119 | 200 OK | 10 kB |
URL GET HTTP/2telegrmm.cc/page-sZyLUWey.js IP103.209.129.119:443
CertificateIssuerLet's Encrypt Subjecttelegyam.cc FingerprintE5:80:53:36:D3:D6:8E:ED:12:E7:78:BF:D5:E9:18:54:CC:A7:1B:4A ValidityWed, 17 Apr 2024 10:12:02 GMT - Tue, 16 Jul 2024 10:12:01 GMT
File typeASCII text, with very long lines (10188) Hash1fa64cad72997667a43ec209bc9241b9 5c3d28e02b947c7a099813f8bbc83506fdf4ce30 309ca7ef47c8232ddda1d407ec4a8c9624297e6da3bb7e02f8876109022d80c1
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | Telegram | | PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET /page-sZyLUWey.js HTTP/1.1
Host: telegrmm.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://telegrmm.cc/pageSignQR-uKY2b3U1.js
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Thu, 25 Apr 2024 17:40:16 GMT
content-type: application/javascript
last-modified: Wed, 21 Feb 2024 11:00:06 GMT
vary: Accept-Encoding
etag: W/"65d5d7b6-27f7"
expires: Fri, 26 Apr 2024 05:40:16 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
content-encoding: gzip
X-Firefox-Spdy: h2
|
|