Report - telegsmz.work/

Report Overview

Submitted URL
telegsmz.work/
IP
103.140.127.123
ASN
#55933 Cloudie Limited
Submitted
2024-04-18 20:16:28
Access
public
Website Title
Telegram Web
Final URL
telegsmz.work/
Tags
telegram phishing
urlquery detections
Phishing - Telegram

Detections

urlquery
16
Network Intrusion Detection
18
Threat Detection Systems
34

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
telegsmz.work	unknown	unknown	No data	No data	6.0 kB	569 kB	103.140.127.123
fonts.gstatic.com	unknown	2008-02-11	2014-09-09	2024-04-18	522 B	15 kB	216.58.207.227
www.cloudflare.com	6775	2009-02-17	2012-05-22	2024-04-18	459 B	4.3 kB	104.16.124.96
ipinfo.io	8136	2013-04-23	2013-12-16	2024-04-18	458 B	727 B	34.117.186.192

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2024-04-18 20:16:03	medium	Client IP	103.140.127.123	ET INFO HTTP Request to Suspicious *.work Domain
2024-04-18 20:16:04	medium	Client IP	103.140.127.123	ET INFO HTTP Request to Suspicious *.work Domain
2024-04-18 20:16:04	medium	Client IP	103.140.127.123	ET INFO HTTP Request to Suspicious *.work Domain
2024-04-18 20:16:04	medium	Client IP	103.140.127.123	ET INFO HTTP Request to Suspicious *.work Domain
2024-04-18 20:16:04	medium	Client IP	103.140.127.123	ET INFO HTTP Request to Suspicious *.work Domain
2024-04-18 20:16:04	medium	Client IP	103.140.127.123	ET INFO HTTP Request to Suspicious *.work Domain
2024-04-18 20:16:04	medium	Client IP	103.140.127.123	ET INFO HTTP Request to Suspicious *.work Domain
2024-04-18 20:16:05	medium	Client IP	103.140.127.123	ET INFO HTTP Request to Suspicious *.work Domain
2024-04-18 20:16:05	medium	Client IP	103.140.127.123	ET INFO HTTP Request to Suspicious *.work Domain
2024-04-18 20:16:05	medium	Client IP	103.140.127.123	ET INFO HTTP Request to Suspicious *.work Domain
2024-04-18 20:16:05	medium	Client IP	103.140.127.123	ET INFO HTTP Request to Suspicious *.work Domain
2024-04-18 20:16:05	medium	Client IP	103.140.127.123	ET INFO HTTP Request to Suspicious *.work Domain
2024-04-18 20:16:05	medium	Client IP	103.140.127.123	ET INFO HTTP Request to Suspicious *.work Domain
2024-04-18 20:16:05	medium	Client IP	103.140.127.123	ET INFO HTTP Request to Suspicious *.work Domain
2024-04-18 20:16:06	medium	Client IP	103.140.127.123	ET INFO HTTP Request to Suspicious *.work Domain
2024-04-18 20:16:06	medium	Client IP	103.140.127.123	ET INFO HTTP Request to Suspicious *.work Domain
2024-04-18 20:16:06	medium	Client IP	34.117.186.192	ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
2024-04-18 20:16:06	medium	Client IP	103.140.127.123	ET INFO HTTP Request to Suspicious *.work Domain

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2024-04-18	medium	telegsmz.work/	Telegram
2024-04-18	medium	telegsmz.work/	Telegram
2024-04-18	medium	telegsmz.work/	Telegram
2024-04-18	medium	telegsmz.work/	Telegram
2024-04-18	medium	telegsmz.work/	Telegram
2024-04-18	medium	telegsmz.work/	Telegram
2024-04-18	medium	telegsmz.work/	Telegram
2024-04-18	medium	telegsmz.work/	Telegram
2024-04-18	medium	telegsmz.work/	Telegram
2024-04-18	medium	telegsmz.work/	Telegram
2024-04-18	medium	telegsmz.work/	Telegram
2024-04-18	medium	telegsmz.work/	Telegram
2024-04-18	medium	telegsmz.work/	Telegram
2024-04-18	medium	telegsmz.work/	Telegram
2024-04-18	medium	telegsmz.work/	Telegram
2024-04-18	medium	telegsmz.work/	Telegram
2024-04-18	medium	telegsmz.work/	Telegram

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (7)

	URL	Size	First Seen	Last Seen
	telegsmz.work/assets/js/jquery-3.5.1.min.js	168 kB	2023-05-09	2024-05-01
Pretty URL telegsmz.work/assets/js/jquery-3.5.1.min.js IP 103.140.127.123 ASN #55933 Cloudie Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-05-09 05:29:38 Last Seen2024-05-01 08:10:15 Times Seen1922 Hash cbe069d8a96235f23c787ed23fe5860c f9760aa86067bdcd205c7db86cd8048ccd5dba71 8008e8bb3f40911b2bb78dc86ed60ff87bcd063a712bb7b269ceeb3f0be8a7f8 Loading...

	unknown	16 B	2023-04-10	2024-05-02
Pretty Introduced by eventHandler Embedded in HTML false Observations First Seen2023-04-10 15:57:29 Last Seen2024-05-02 00:41:06 Times Seen34082 Hash 7c3c3ddeb80438dcbb3d081d2d00e152 5a4016732ee72ec77b4f6ab17047bcea6d2ea34d 321b4f657afbf8ba49518e6ab4cbad07ea967d0b4c68f71c7deed05ed09c1187 Loading...

	telegsmz.work/main.7b574a882822896f.js	817 kB	2024-03-08	2024-04-26
Pretty URL telegsmz.work/main.7b574a882822896f.js IP 103.140.127.123 ASN #55933 Cloudie Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2024-03-08 07:10:09 Last Seen2024-04-26 08:08:10 Times Seen32 Hash fb7f0cbdb7539b56eb9d0a5d0c8fbf09 ae1b19471508298819a32df9b420607c67c4e5bb 87a3a74131809e00fbd284b989d63da86a3b16756f38c3b89b72d24557cb2f6a Loading...

	telegsmz.work/assets/layui-v2.6.8/layui/layui.js	530 kB	2023-05-09	2024-05-01
Pretty URL telegsmz.work/assets/layui-v2.6.8/layui/layui.js IP 103.140.127.123 ASN #55933 Cloudie Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-05-09 05:29:38 Last Seen2024-05-01 08:10:15 Times Seen1903 Hash c2c8dd4c98816096d648f76f68344815 3b79b4e7c862d97b1eb5f0bcf87dce5aa445ddb3 c530fb9c66eef94ef5905c4cf3a9548eddca3155dc3dbb942840f251b94eebf4 Loading...

	telegsmz.work/assets/download/filename.js	65 B	2023-06-28	2024-05-01
Pretty URL telegsmz.work/assets/download/filename.js IP 103.140.127.123 ASN #55933 Cloudie Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-06-28 23:35:04 Last Seen2024-05-01 08:10:15 Times Seen1488 Hash a6d1304541fda1e265432a0993951251 ef07ff3c0a0e18efcf3313179a573a34e0ef43b2 f4754b61ec80001793e16fc47508a87579cf153abef66be058e706c2c65ec2b6 Loading...

	telegsmz.work/runtime.d0a0d8313f8d1e00.js	920 B	2023-07-02	2024-05-01
Pretty URL telegsmz.work/runtime.d0a0d8313f8d1e00.js IP 103.140.127.123 ASN #55933 Cloudie Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-07-02 13:06:22 Last Seen2024-05-01 08:10:15 Times Seen1030 Hash 605959eb10832f7eb0568dba9cce07cc 1464546ef446dc40ff30e234baff327cebd87542 b77f40ebf5ebb6e9771cf3af13c44e7de72650b59d3dbff7d3e2b2395fe78f88 Loading...

	telegsmz.work/polyfills.9225875df2b05e64.js	38 kB	2023-05-09	2024-05-01
Pretty URL telegsmz.work/polyfills.9225875df2b05e64.js IP 103.140.127.123 ASN #55933 Cloudie Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-05-09 05:29:38 Last Seen2024-05-01 08:10:15 Times Seen1914 Hash d9e615229bebe9d2ffca657bf396b5a0 1610b7036eafbc4507aeba3fc0769381fb6fc51d a110fdb5148ce482e99821228f6653fce4142cf45540b0816c3e1af012c86fe2 Loading...

HTTP Transactions (20)

URL IP Response Size

telegsmz.work/

103.140.127.123

200 OK

32 kB

URL User Request GET HTTP/1.1
telegsmz.work/
IP
103.140.127.123:80
ASN
#55933 Cloudie Limited

File type
HTML document, Unicode text, UTF-8 text, with very long lines (62711)
Size
32 kB (31950 bytes)
Hash
4c6f23c16e801fe29d1e74a74ca87cf2
dd3cb04d5035899a0d65821111e440d528ae9bd2
c15d6557ca6fe1063b4f79257084dec5ed1d3de829a56091404ff245840231ea

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Telegram

NIDS	Severity	Alert
suricata	medium	ET INFO HTTP Request to Suspicious *.work Domain

HTTP Headers

GET / HTTP/1.1
Host: telegsmz.work
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/html
Content-Encoding: gzip
Last-Modified: Fri, 12 Apr 2024 04:09:52 GMT
Accept-Ranges: bytes
ETag: "0e899448f8cda1:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Date: Thu, 18 Apr 2024 20:16:03 GMT
Content-Length: 31950

telegsmz.work/assets/js/jquery-3.5.1.min.js

103.140.127.123

200 OK

41 kB

URL GET HTTP/1.1
telegsmz.work/assets/js/jquery-3.5.1.min.js
IP
103.140.127.123:80
ASN
#55933 Cloudie Limited

Requested by
http://telegsmz.work/

File type
JavaScript source, ASCII text
Size
41 kB (40582 bytes)
Hash
cbe069d8a96235f23c787ed23fe5860c
f9760aa86067bdcd205c7db86cd8048ccd5dba71
8008e8bb3f40911b2bb78dc86ed60ff87bcd063a712bb7b269ceeb3f0be8a7f8

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Telegram
OpenPhish	phishing	Telegram

NIDS	Severity	Alert
suricata	medium	ET INFO HTTP Request to Suspicious *.work Domain

HTTP Headers

GET /assets/js/jquery-3.5.1.min.js HTTP/1.1
Host: telegsmz.work
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://telegsmz.work/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript
Content-Encoding: gzip
Last-Modified: Thu, 29 Feb 2024 15:02:01 GMT
Accept-Ranges: bytes
ETag: "803a8a3f206bda1:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Date: Thu, 18 Apr 2024 20:16:03 GMT
Content-Length: 40582

telegsmz.work/assets/download/filename.js

103.140.127.123

200 OK

191 B

URL GET HTTP/1.1
telegsmz.work/assets/download/filename.js
IP
103.140.127.123:80
ASN
#55933 Cloudie Limited

Requested by
http://telegsmz.work/

File type
JavaScript source, Unicode text, UTF-8 text
Size
191 B (191 bytes)
Hash
a6d1304541fda1e265432a0993951251
ef07ff3c0a0e18efcf3313179a573a34e0ef43b2
f4754b61ec80001793e16fc47508a87579cf153abef66be058e706c2c65ec2b6

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Telegram
OpenPhish	phishing	Telegram

NIDS	Severity	Alert
suricata	medium	ET INFO HTTP Request to Suspicious *.work Domain

HTTP Headers

GET /assets/download/filename.js HTTP/1.1
Host: telegsmz.work
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://telegsmz.work/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript
Content-Encoding: gzip
Last-Modified: Thu, 29 Feb 2024 15:00:15 GMT
Accept-Ranges: bytes
ETag: "4eaae50206bda1:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Date: Thu, 18 Apr 2024 20:16:03 GMT
Content-Length: 191

telegsmz.work/runtime.d0a0d8313f8d1e00.js

103.140.127.123

200 OK

772 B

URL GET HTTP/1.1
telegsmz.work/runtime.d0a0d8313f8d1e00.js
IP
103.140.127.123:80
ASN
#55933 Cloudie Limited

Requested by
http://telegsmz.work/

File type
JavaScript source, ASCII text, with very long lines (920), with no line terminators
Size
772 B (772 bytes)
Hash
605959eb10832f7eb0568dba9cce07cc
1464546ef446dc40ff30e234baff327cebd87542
b77f40ebf5ebb6e9771cf3af13c44e7de72650b59d3dbff7d3e2b2395fe78f88

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Telegram
OpenPhish	phishing	Telegram

NIDS	Severity	Alert
suricata	medium	ET INFO HTTP Request to Suspicious *.work Domain

HTTP Headers

GET /runtime.d0a0d8313f8d1e00.js HTTP/1.1
Host: telegsmz.work
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://telegsmz.work/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript
Content-Encoding: gzip
Last-Modified: Fri, 12 Apr 2024 04:09:53 GMT
Accept-Ranges: bytes
ETag: "5a4753458f8cda1:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Date: Thu, 18 Apr 2024 20:16:03 GMT
Content-Length: 772

telegsmz.work/polyfills.9225875df2b05e64.js

103.140.127.123

200 OK

13 kB

URL GET HTTP/1.1
telegsmz.work/polyfills.9225875df2b05e64.js
IP
103.140.127.123:80
ASN
#55933 Cloudie Limited

Requested by
http://telegsmz.work/

File type
JavaScript source, ASCII text, with very long lines (37755), with no line terminators
Size
13 kB (13209 bytes)
Hash
d9e615229bebe9d2ffca657bf396b5a0
1610b7036eafbc4507aeba3fc0769381fb6fc51d
a110fdb5148ce482e99821228f6653fce4142cf45540b0816c3e1af012c86fe2

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Telegram
OpenPhish	phishing	Telegram

NIDS	Severity	Alert
suricata	medium	ET INFO HTTP Request to Suspicious *.work Domain

HTTP Headers

GET /polyfills.9225875df2b05e64.js HTTP/1.1
Host: telegsmz.work
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://telegsmz.work/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript
Content-Encoding: gzip
Last-Modified: Fri, 12 Apr 2024 04:09:53 GMT
Accept-Ranges: bytes
ETag: "807e32458f8cda1:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Date: Thu, 18 Apr 2024 20:16:03 GMT
Content-Length: 13209

telegsmz.work/assets/layui-v2.6.8/layui/layui.js

103.140.127.123

200 OK

120 kB

URL GET HTTP/1.1
telegsmz.work/assets/layui-v2.6.8/layui/layui.js
IP
103.140.127.123:80
ASN
#55933 Cloudie Limited

Requested by
http://telegsmz.work/

File type
JavaScript source, ASCII text
Size
120 kB (120092 bytes)
Hash
c2c8dd4c98816096d648f76f68344815
3b79b4e7c862d97b1eb5f0bcf87dce5aa445ddb3
c530fb9c66eef94ef5905c4cf3a9548eddca3155dc3dbb942840f251b94eebf4

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Telegram
OpenPhish	phishing	Telegram

NIDS	Severity	Alert
suricata	medium	ET INFO HTTP Request to Suspicious *.work Domain

HTTP Headers

GET /assets/layui-v2.6.8/layui/layui.js HTTP/1.1
Host: telegsmz.work
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://telegsmz.work/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript
Content-Encoding: gzip
Last-Modified: Thu, 29 Feb 2024 15:02:07 GMT
Accept-Ranges: bytes
ETag: "80c11d43206bda1:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Date: Thu, 18 Apr 2024 20:16:03 GMT
Content-Length: 120092

fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXiWtFCc.woff2

216.58.207.227

200 OK

14 kB

URL GET HTTP/2
fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXiWtFCc.woff2
IP
216.58.207.227:443
ASN
#15169 GOOGLE

Requested by
http://telegsmz.work/
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint8F:81:43:71:C4:F3:8C:FA:6D:EC:B4:5E:1F:58:71:AA:48:42:0E:E9
ValidityMon, 04 Mar 2024 07:16:39 GMT - Mon, 27 May 2024 07:16:38 GMT

File type
Web Open Font Format (Version 2), TrueType, length 13980, version 1.0
Size
14 kB (13980 bytes)
Hash
b7d6b48d8d12946dc808ff39aed6c460
3f18028a04b3fb39bb1cc33dce401d04e9207970
d4ae5188a65370ecfe28f42293bbee8297cfd5712c6aadfdb270d48f2bcd88b0

HTTP Headers

GET /s/lato/v24/S6uyw4BMUTPHjx4wXiWtFCc.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://telegsmz.work
DNT: 1
Connection: keep-alive
Referer: http://telegsmz.work/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 13980
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 18 Apr 2024 02:55:49 GMT
expires: Fri, 18 Apr 2025 02:55:49 GMT
cache-control: public, max-age=31536000
age: 62416
last-modified: Tue, 02 May 2023 15:17:19 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

telegsmz.work/assets/css/font-awesome.min.css

103.140.127.123

200 OK

6.2 kB

URL GET HTTP/1.1
telegsmz.work/assets/css/font-awesome.min.css
IP
103.140.127.123:80
ASN
#55933 Cloudie Limited

Requested by
http://telegsmz.work/

File type
troff or preprocessor input, ASCII text
Size
6.2 kB (6202 bytes)
Hash
33ab425205ede257e17e9f9f67a1f2d7
9ac3caa06c9a19a3bfb9c4d971eb2b8bc0938304
c908df9056bdf49233996dab5a0f031ea61b608654aad6cf63828ded87f91a22

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Telegram
OpenPhish	phishing	Telegram

NIDS	Severity	Alert
suricata	medium	ET INFO HTTP Request to Suspicious *.work Domain

HTTP Headers

GET /assets/css/font-awesome.min.css HTTP/1.1
Host: telegsmz.work
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://telegsmz.work/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/css
Content-Encoding: gzip
Last-Modified: Thu, 29 Feb 2024 15:00:15 GMT
Accept-Ranges: bytes
ETag: "d750b60206bda1:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Date: Thu, 18 Apr 2024 20:16:04 GMT
Content-Length: 6202

telegsmz.work/assets/layui-v2.6.8/layui/css/modules/laydate/default/laydate.css?v=5.3.1

103.140.127.123

200 OK

2.3 kB

URL GET HTTP/1.1
telegsmz.work/assets/layui-v2.6.8/layui/css/modules/laydate/default/laydate.css?v=5.3.1
IP
103.140.127.123:80
ASN
#55933 Cloudie Limited

Requested by
http://telegsmz.work/

File type
ASCII text
Size
2.3 kB (2346 bytes)
Hash
a777c30898587521ccd07c5b429e4c02
8e9884271e67213a37cc531d783381ca7e855efa
505127fe93cdcdd4cf04ac4e8a34a115800d00182b454f3b629e445e04723fab

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Telegram
OpenPhish	phishing	Telegram

NIDS	Severity	Alert
suricata	medium	ET INFO HTTP Request to Suspicious *.work Domain

HTTP Headers

GET /assets/layui-v2.6.8/layui/css/modules/laydate/default/laydate.css?v=5.3.1 HTTP/1.1
Host: telegsmz.work
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://telegsmz.work/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/css
Content-Encoding: gzip
Last-Modified: Thu, 29 Feb 2024 15:02:09 GMT
Accept-Ranges: bytes
ETag: "ade3e144206bda1:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Date: Thu, 18 Apr 2024 20:16:04 GMT
Content-Length: 2346

telegsmz.work/assets/layui-v2.6.8/layui/css/modules/layer/default/layer.css?v=3.5.1

103.140.127.123

200 OK

4.2 kB

URL GET HTTP/1.1
telegsmz.work/assets/layui-v2.6.8/layui/css/modules/layer/default/layer.css?v=3.5.1
IP
103.140.127.123:80
ASN
#55933 Cloudie Limited

Requested by
http://telegsmz.work/

File type
ASCII text
Size
4.2 kB (4168 bytes)
Hash
a0a9391332fa52fb7965cb162e37487b
3c6ee7cb8979ee47cbf7c85b951efc39ec0979f5
25fc17aba4a3d31222673cb72097329ea347739ed335f130eff384af2c18ea60

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Telegram
OpenPhish	phishing	Telegram

NIDS	Severity	Alert
suricata	medium	ET INFO HTTP Request to Suspicious *.work Domain

HTTP Headers

GET /assets/layui-v2.6.8/layui/css/modules/layer/default/layer.css?v=3.5.1 HTTP/1.1
Host: telegsmz.work
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://telegsmz.work/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/css
Content-Encoding: gzip
Last-Modified: Thu, 29 Feb 2024 15:02:10 GMT
Accept-Ranges: bytes
ETag: "12267445206bda1:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Date: Thu, 18 Apr 2024 20:16:04 GMT
Content-Length: 4168

telegsmz.work/assets/layui-v2.6.8/layui/css/modules/code.css?v=2

103.140.127.123

200 OK

678 B

URL GET HTTP/1.1
telegsmz.work/assets/layui-v2.6.8/layui/css/modules/code.css?v=2
IP
103.140.127.123:80
ASN
#55933 Cloudie Limited

Requested by
http://telegsmz.work/

File type
ASCII text
Size
678 B (678 bytes)
Hash
2c6ced625980e19b9ce7415d11dfb677
11f84a0810c88250a66a053921c640fd5f798067
743be0166f043b1e6227f3a53ae1e69827e049d5cba27687ae33fbe4b021aead

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Telegram
OpenPhish	phishing	Telegram

NIDS	Severity	Alert
suricata	medium	ET INFO HTTP Request to Suspicious *.work Domain

HTTP Headers

GET /assets/layui-v2.6.8/layui/css/modules/code.css?v=2 HTTP/1.1
Host: telegsmz.work
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://telegsmz.work/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/css
Content-Encoding: gzip
Last-Modified: Thu, 29 Feb 2024 15:02:09 GMT
Accept-Ranges: bytes
ETag: "972cb144206bda1:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Date: Thu, 18 Apr 2024 20:16:04 GMT
Content-Length: 678

telegsmz.work/main.7b574a882822896f.js

103.140.127.123

200 OK

217 kB

URL GET HTTP/1.1
telegsmz.work/main.7b574a882822896f.js
IP
103.140.127.123:80
ASN
#55933 Cloudie Limited

Requested by
http://telegsmz.work/

File type
JavaScript source, ASCII text, with very long lines (65536), with no line terminators
Size
217 kB (216839 bytes)
Hash
fb7f0cbdb7539b56eb9d0a5d0c8fbf09
ae1b19471508298819a32df9b420607c67c4e5bb
87a3a74131809e00fbd284b989d63da86a3b16756f38c3b89b72d24557cb2f6a

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Telegram

NIDS	Severity	Alert
suricata	medium	ET INFO HTTP Request to Suspicious *.work Domain

HTTP Headers

GET /main.7b574a882822896f.js HTTP/1.1
Host: telegsmz.work
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://telegsmz.work/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript
Content-Encoding: gzip
Last-Modified: Fri, 12 Apr 2024 04:09:52 GMT
Accept-Ranges: bytes
ETag: "0e899448f8cda1:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Date: Thu, 18 Apr 2024 20:16:03 GMT
Content-Length: 216839

telegsmz.work/assets/layui-v2.6.8/layui/css/layui.css

103.140.127.123

200 OK

22 kB

URL GET HTTP/1.1
telegsmz.work/assets/layui-v2.6.8/layui/css/layui.css
IP
103.140.127.123:80
ASN
#55933 Cloudie Limited

Requested by
http://telegsmz.work/

File type
ASCII text
Size
22 kB (22362 bytes)
Hash
fbf5fcf853079a9f486f7e5bb5899fb7
eb59ff5dc9cbb843259cab198af6e366d40cf8f8
8e04484b0071d1bbbfac2183a329b6f88432c455474978d52fd7bab4bf89a658

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Telegram
OpenPhish	phishing	Telegram

NIDS	Severity	Alert
suricata	medium	ET INFO HTTP Request to Suspicious *.work Domain

HTTP Headers

GET /assets/layui-v2.6.8/layui/css/layui.css HTTP/1.1
Host: telegsmz.work
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://telegsmz.work/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/css
Content-Encoding: gzip
Last-Modified: Thu, 29 Feb 2024 15:02:07 GMT
Accept-Ranges: bytes
ETag: "b9f28b43206bda1:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Date: Thu, 18 Apr 2024 20:16:04 GMT
Content-Length: 22362

telegsmz.work/assets/css/bootstrap.min.css

103.140.127.123

200 OK

41 kB

URL GET HTTP/1.1
telegsmz.work/assets/css/bootstrap.min.css
IP
103.140.127.123:80
ASN
#55933 Cloudie Limited

Requested by
http://telegsmz.work/

File type
ASCII text, with very long lines (335)
Size
41 kB (40984 bytes)
Hash
6ab84cbbd44a52f4fd48f1fa5b4178ac
ef1070e3ee88a7056a5c74173c77c4c4982bc05a
6842b2619cc388e31500b22f62403f658d6c15ad74c3d255c15473fd7cbc9a5b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Telegram
OpenPhish	phishing	Telegram

NIDS	Severity	Alert
suricata	medium	ET INFO HTTP Request to Suspicious *.work Domain

HTTP Headers

GET /assets/css/bootstrap.min.css HTTP/1.1
Host: telegsmz.work
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://telegsmz.work/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/css
Content-Encoding: gzip
Last-Modified: Thu, 29 Feb 2024 15:00:15 GMT
Accept-Ranges: bytes
ETag: "973f840206bda1:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Date: Thu, 18 Apr 2024 20:16:04 GMT
Content-Length: 40984

telegsmz.work/styles.e2974b719a0acf9b.css

103.140.127.123

200 OK

38 kB

URL GET HTTP/1.1
telegsmz.work/styles.e2974b719a0acf9b.css
IP
103.140.127.123:80
ASN
#55933 Cloudie Limited

Requested by
http://telegsmz.work/

File type
ASCII text, with very long lines (62185)
Size
38 kB (38255 bytes)
Hash
7979cf7a21187bdc639adca62183e908
2a8732d80fafa18d32a69092e0781d083bcb25d9
3d5b133530265db10112be8bc46eb7764530cecc02d76ea3808c502d8bae7d1a

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Telegram
OpenPhish	phishing	Telegram

NIDS	Severity	Alert
suricata	medium	ET INFO HTTP Request to Suspicious *.work Domain

HTTP Headers

GET /styles.e2974b719a0acf9b.css HTTP/1.1
Host: telegsmz.work
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://telegsmz.work/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/css
Content-Encoding: gzip
Last-Modified: Fri, 12 Apr 2024 04:09:53 GMT
Accept-Ranges: bytes
ETag: "4ee36f458f8cda1:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Date: Thu, 18 Apr 2024 20:16:04 GMT
Content-Length: 38255

telegsmz.work/assets/images/logo.jpg

103.140.127.123

200 OK

6.3 kB

URL GET HTTP/1.1
telegsmz.work/assets/images/logo.jpg
IP
103.140.127.123:80
ASN
#55933 Cloudie Limited

Requested by
http://telegsmz.work/

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 96x96, segment length 16, baseline, precision 8, 128x128, components 3
Size
6.3 kB (6328 bytes)
Hash
b6804a49a117cb8b5eb86cd489a93a36
3304eb19bfd257989d94d5217196c129c3244696
2a1f3de21a6685e08138c0d562de525d765ef14999b143085e678fc4d7517a4d

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Telegram
OpenPhish	phishing	Telegram

NIDS	Severity	Alert
suricata	medium	ET INFO HTTP Request to Suspicious *.work Domain

HTTP Headers

GET /assets/images/logo.jpg HTTP/1.1
Host: telegsmz.work
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://telegsmz.work/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: image/jpeg
Last-Modified: Thu, 29 Feb 2024 15:01:50 GMT
Accept-Ranges: bytes
ETag: "0cc3839206bda1:0"
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Date: Thu, 18 Apr 2024 20:16:05 GMT
Content-Length: 6328

www.cloudflare.com/cdn-cgi/trace

104.16.124.96

200 OK

4.0 kB

URL GET HTTP/2
www.cloudflare.com/cdn-cgi/trace
IP
104.16.124.96:443
ASN
#13335 CLOUDFLARENET

Requested by
http://telegsmz.work/
Certificate
IssuerLet's Encrypt
Subjectwww.cloudflare.com
FingerprintA8:2D:6E:C5:D3:33:52:26:3D:04:2B:56:87:7C:AB:2D:B4:90:16:9D
ValidityFri, 05 Apr 2024 17:10:16 GMT - Thu, 04 Jul 2024 17:10:15 GMT

File type
gzip compressed data, from Unix
Size
4.0 kB (3987 bytes)
Hash
873bd4dc50521a4c1d4d44579cb34d14
09438dbd388c4c689c37759bed0e68ce9ddc8de8
1950147573d926676f8931d64ad0ad18f58e2d5e4ecd7fe20fa7d057219eb49e

HTTP Headers

GET /cdn-cgi/trace HTTP/1.1
Host: www.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://telegsmz.work
DNT: 1
Connection: keep-alive
Referer: http://telegsmz.work/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 18 Apr 2024 20:16:05 GMT
content-type: text/plain
access-control-allow-origin: *
server: cloudflare
cf-ray: 876754a57db9b500-OSL
x-frame-options: DENY
x-content-type-options: nosniff
expires: Thu, 01 Jan 1970 00:00:01 GMT
cache-control: no-cache
content-encoding: gzip
X-Firefox-Spdy: h2

telegsmz.work/favicon.ico

103.140.127.123

200 OK

15 kB

URL GET HTTP/1.1
telegsmz.work/favicon.ico
IP
103.140.127.123:80
ASN
#55933 Cloudie Limited

Requested by
http://telegsmz.work/

File type
MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
Size
15 kB (15086 bytes)
Hash
4c7161b2ff1db8e15c7e47f8639c5f86
30260efcdaf269977cf3e8a2280a9c6d4c93b583
7e2388ec283fe17472ef02829a93da550af8f3ad4a975f50a0110bff61afe523

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Telegram
OpenPhish	phishing	Telegram

NIDS	Severity	Alert
suricata	medium	ET INFO HTTP Request to Suspicious *.work Domain

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: telegsmz.work
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://telegsmz.work/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: image/x-icon
Last-Modified: Fri, 12 Apr 2024 04:09:52 GMT
Accept-Ranges: bytes
ETag: "25bbb2448f8cda1:0"
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Date: Thu, 18 Apr 2024 20:16:05 GMT
Content-Length: 15086

ipinfo.io/?token=ad76fbd92e6bbb

34.117.186.192

429 Too Many Requests

202 B

URL GET HTTP/2
ipinfo.io/?token=ad76fbd92e6bbb
IP
34.117.186.192:443
ASN
#396982 GOOGLE-CLOUD-PLATFORM

Requested by
http://telegsmz.work/
Certificate
IssuerLet's Encrypt
Subjectipinfo.io
Fingerprint9D:3E:28:56:62:A9:9F:DE:23:E2:E3:28:72:EE:AE:0B:F3:A5:C0:63
ValidityTue, 05 Mar 2024 21:14:09 GMT - Mon, 03 Jun 2024 21:14:08 GMT

File type
JSON text data
Size
202 B (202 bytes)
Hash
3319a200adef63cfb155c84ad6a1bcc1
ced752e1f3903015159f1f18ac409a6373d027b0
60b59a85b456eea5ea7b0d592088fbb7416f938598bf39aaaf2b56c45a02783e

HTTP Headers

GET /?token=ad76fbd92e6bbb HTTP/1.1
Host: ipinfo.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://telegsmz.work
DNT: 1
Connection: keep-alive
Referer: http://telegsmz.work/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 429 Too Many Requests
server: nginx/1.24.0
date: Thu, 18 Apr 2024 20:16:06 GMT
content-type: application/json; charset=utf-8
content-length: 202
access-control-allow-origin: *
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
x-envoy-upstream-service-time: 2
via: 1.1 google
strict-transport-security: max-age=2592000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

telegsmz.work/assets/datas/countries/phoneCode.json

103.140.127.123

200 OK

3.8 kB

URL GET HTTP/1.1
telegsmz.work/assets/datas/countries/phoneCode.json
IP
103.140.127.123:80
ASN
#55933 Cloudie Limited

Requested by
http://telegsmz.work/

File type
ASCII text, with very long lines (5008), with no line terminators
Size
3.8 kB (3756 bytes)
Hash
bebd50ec3d0bbbdddbcf1549a1011893
8459509012f58f63a969ca7bc0eec89f62a19e42
36f064f0cef3903219dff83dabbb4d8525fbc282c145dc36138f0e18f027fd97

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Telegram
OpenPhish	phishing	Telegram

NIDS	Severity	Alert
suricata	medium	ET INFO HTTP Request to Suspicious *.work Domain

HTTP Headers

GET /assets/datas/countries/phoneCode.json HTTP/1.1
Host: telegsmz.work
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://telegsmz.work/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/json
Last-Modified: Thu, 29 Feb 2024 15:02:02 GMT
Accept-Ranges: bytes
ETag: "266e2a40206bda1:0"
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Date: Thu, 18 Apr 2024 20:16:05 GMT
Content-Length: 3756

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (7)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (20)

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

Detections