Report - solitary-sea-f972.mmiloud.workers.dev/

Report Overview

Submitted URL
solitary-sea-f972.mmiloud.workers.dev/
IP
104.21.28.92
ASN
#13335 CLOUDFLARENET
Submitted
2024-04-26 17:30:17
Access
public
Website Title
Telegram Web
Final URL
solitary-sea-f972.mmiloud.workers.dev/#/login
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
34

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
solitary-sea-f972.mmiloud.workers.dev	unknown	2019-02-08	2022-09-27	2024-03-27	8.3 kB	3.1 MB	104.21.28.92
venus.web.telegram.org	47739	2003-12-15	2017-01-29	2024-04-25	2.5 kB	3.2 kB	149.154.167.99
vesta.web.telegram.org	567573	2003-12-15	2017-01-30	2024-04-05	1.5 kB	2.0 kB	149.154.167.99

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2024-04-26	medium	solitary-sea-f972.mmiloud.workers.dev/	Telegram
2024-04-26	medium	solitary-sea-f972.mmiloud.workers.dev/	Telegram
2024-04-26	medium	solitary-sea-f972.mmiloud.workers.dev/	Telegram
2024-04-26	medium	solitary-sea-f972.mmiloud.workers.dev/	Telegram
2024-04-26	medium	solitary-sea-f972.mmiloud.workers.dev/	Telegram
2024-04-26	medium	solitary-sea-f972.mmiloud.workers.dev/	Telegram
2024-04-26	medium	solitary-sea-f972.mmiloud.workers.dev/	Telegram
2024-04-26	medium	solitary-sea-f972.mmiloud.workers.dev/	Telegram
2024-04-26	medium	solitary-sea-f972.mmiloud.workers.dev/	Telegram
2024-04-26	medium	solitary-sea-f972.mmiloud.workers.dev/	Telegram
2024-04-26	medium	solitary-sea-f972.mmiloud.workers.dev/	Telegram
2024-04-26	medium	solitary-sea-f972.mmiloud.workers.dev/	Telegram
2024-04-26	medium	solitary-sea-f972.mmiloud.workers.dev/	Telegram
2024-04-26	medium	solitary-sea-f972.mmiloud.workers.dev/	Telegram
2024-04-26	medium	solitary-sea-f972.mmiloud.workers.dev/	Telegram
2024-04-26	medium	solitary-sea-f972.mmiloud.workers.dev/	Telegram
2024-04-26	medium	solitary-sea-f972.mmiloud.workers.dev/	Telegram

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (1)

	URL	Size	First Seen	Last Seen
	solitary-sea-f972.mmiloud.workers.dev/js/app.js	2.6 MB	2023-06-16	2024-05-05
Pretty URL solitary-sea-f972.mmiloud.workers.dev/js/app.js IP 104.21.28.92 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-06-16 15:07:04 Last Seen2024-05-05 19:40:20 Times Seen49 Hash 9b84db2cd5822b73926d993777c2fd65 a63a7380ad23c84201449d974eb717dd3571761f 7583205460e8aa46ec80d7ef8340f10db692ec7ca8b7df2decb95a558246c4c9 Loading...

HTTP Transactions (25)

URL IP Response Size

solitary-sea-f972.mmiloud.workers.dev/img/iphone_home120.png

104.21.28.92

200 OK

2.7 kB

URL GET HTTP/3
solitary-sea-f972.mmiloud.workers.dev/img/iphone_home120.png
IP
104.21.28.92:443
ASN
#13335 CLOUDFLARENET

Requested by
https://solitary-sea-f972.mmiloud.workers.dev/
Certificate
IssuerGoogle Trust Services LLC
Subjectmmiloud.workers.dev
Fingerprint31:92:0E:B3:C7:11:4B:36:10:75:C5:27:1C:4E:D5:14:92:CD:90:1A
ValidityTue, 26 Mar 2024 16:55:58 GMT - Mon, 24 Jun 2024 16:55:57 GMT

File type
PNG image data, 120 x 120, 8-bit/color RGB, non-interlaced
Size
2.7 kB (2732 bytes)
Hash
86b05c2c7e8ad0de8204789716898da4
27dd329b8f2dbe583357d106ce3f538896925219
8af64f45879d661f17f4e18b7dc2b73e21c883e3960da8371993511eb9fe53ae

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Telegram

HTTP Headers

GET /img/iphone_home120.png HTTP/1.1
Host: solitary-sea-f972.mmiloud.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://solitary-sea-f972.mmiloud.workers.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 26 Apr 2024 17:29:52 GMT
content-type: image/png
content-length: 2732
cf-ray: 87a84c243d80b4f9-OSL
cf-cache-status: MISS
accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=3600
etag: "5d83f6a8-aac"
expires: Fri, 26 Apr 2024 18:29:52 GMT
last-modified: Thu, 19 Sep 2019 21:44:08 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
x-frame-options: deny
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JIMl1Ly9kB9buCBmFn6ZimyE76Px3KQf7J%2FWltIjEMwfLq%2FJ8mA9sDoW5VMw%2FsQACcSC%2F1GmkWP7%2FJ3rjjYvBzLoAkUgf%2BjpcckacoPARCxb%2BNQ8EN%2FaIft881aGKnJ%2FyuS6Nrri2dEb6mzvc%2FfiDxdY%2Fw%2FGmqFT"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
alt-svc: h3=":443"; ma=86400

solitary-sea-f972.mmiloud.workers.dev/favicon.ico

104.21.28.92

200 OK

7.3 kB

URL GET HTTP/3
solitary-sea-f972.mmiloud.workers.dev/favicon.ico
IP
104.21.28.92:443
ASN
#13335 CLOUDFLARENET

Requested by
https://solitary-sea-f972.mmiloud.workers.dev/
Certificate
IssuerGoogle Trust Services LLC
Subjectmmiloud.workers.dev
Fingerprint31:92:0E:B3:C7:11:4B:36:10:75:C5:27:1C:4E:D5:14:92:CD:90:1A
ValidityTue, 26 Mar 2024 16:55:58 GMT - Mon, 24 Jun 2024 16:55:57 GMT

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Size
7.3 kB (7315 bytes)
Hash
fb606fe0a27a1c62bdfc48561d908f39
3306fba7846b0fedbd75ee0c602b3d5b8f9703d5
462c72824442b77689e0650dfe56a218cbea68b48669d68f3f7b3247af187d09

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Telegram

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: solitary-sea-f972.mmiloud.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://solitary-sea-f972.mmiloud.workers.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 26 Apr 2024 17:29:52 GMT
content-type: image/x-icon
cf-ray: 87a84c243d8ab4f9-OSL
cf-cache-status: REVALIDATED
access-control-allow-origin: *
cache-control: max-age=3600
etag: W/"5d83f6a8-3bf"
expires: Fri, 26 Apr 2024 18:29:52 GMT
last-modified: Thu, 19 Sep 2019 21:44:08 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
x-frame-options: deny
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8ktyW4VrszvojZb5t2xgtX2XCU7PwYdJAI4BgT45gLOfr1UpOyGHVS9ga7NeOASGfVNQB%2BkkkKHrwzBYirbYA3Pa7zqYzXDj%2BeP440GDShzzCCoKizCh6s2YANsXqQ4cI31MweQyeBsU9TVIIHyVMuiR2nUkx7Wf"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
alt-svc: h3=":443"; ma=86400

venus.web.telegram.org/apiw1

149.154.167.99

200 OK

84 B

URL POST HTTP/2
venus.web.telegram.org/apiw1
IP
149.154.167.99:443
ASN
#62041 Telegram Messenger Inc

Requested by
https://solitary-sea-f972.mmiloud.workers.dev/
Certificate
IssuerGoDaddy.com, Inc.
Subject*.web.telegram.org
Fingerprint74:51:4A:F8:C5:D2:E1:36:68:30:25:98:05:27:E8:6F:57:FC:E0:3B
ValidityWed, 30 Aug 2023 00:40:43 GMT - Mon, 30 Sep 2024 00:40:43 GMT

File type
data
Size
84 B (84 bytes)
Hash
fa9830486549702779437f9b33fb8555
b38034f48fd3e484597a7e5725cd462e6d5a155a
fb9bc3c4b2c9d0f875f31bf1ffc696dba21b03bf161c3f7f54d0be5f5b2bf104

HTTP Headers

POST /apiw1 HTTP/1.1
Host: venus.web.telegram.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Length: 40
Origin: https://solitary-sea-f972.mmiloud.workers.dev
DNT: 1
Connection: keep-alive
Referer: https://solitary-sea-f972.mmiloud.workers.dev/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx/1.18.0
date: Fri, 26 Apr 2024 17:29:52 GMT
content-type: application/octet-stream
content-length: 84
pragma: no-cache
cache-control: no-store
access-control-allow-origin: *
access-control-allow-methods: POST, OPTIONS
access-control-allow-headers: origin, content-type
access-control-max-age: 1728000
strict-transport-security: max-age=35768000
X-Firefox-Spdy: h2

solitary-sea-f972.mmiloud.workers.dev/vendor/leemon_bigint/bigint.js

104.21.28.92

200 OK

15 kB

URL GET HTTP/3
solitary-sea-f972.mmiloud.workers.dev/vendor/leemon_bigint/bigint.js
IP
104.21.28.92:443
ASN
#13335 CLOUDFLARENET

Requested by
https://solitary-sea-f972.mmiloud.workers.dev/js/lib/crypto_worker.js
Certificate
IssuerGoogle Trust Services LLC
Subjectmmiloud.workers.dev
Fingerprint31:92:0E:B3:C7:11:4B:36:10:75:C5:27:1C:4E:D5:14:92:CD:90:1A
ValidityTue, 26 Mar 2024 16:55:58 GMT - Mon, 24 Jun 2024 16:55:57 GMT

File type
Unicode text, UTF-8 text
Size
15 kB (14767 bytes)
Hash
99290db3a3369437ba0d44152dc36ba1
2382de9bdf5bdf705531b41a88de8f2868959b20
358c053657f1248c79d797b02c00660d8c5e9a11c786cabcd45f58d11e723dec

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Telegram

HTTP Headers

GET /vendor/leemon_bigint/bigint.js HTTP/1.1
Host: solitary-sea-f972.mmiloud.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://solitary-sea-f972.mmiloud.workers.dev/js/lib/crypto_worker.js
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 26 Apr 2024 17:29:52 GMT
content-type: application/javascript
cf-ray: 87a84c259f68b4f9-OSL
cf-cache-status: MISS
access-control-allow-origin: *
cache-control: max-age=3600
etag: W/"5d83f6a8-bf99"
expires: Fri, 26 Apr 2024 18:29:52 GMT
last-modified: Thu, 19 Sep 2019 21:44:08 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
x-frame-options: deny
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o9kAKakdfk35peBAsb9tmPUrKx2Mc%2FFWIrtf1ZE1i7o2Vos40OJCmeZJyK1uMyJx0uswfD8212SK5aj4gN8tBRQ3XmymhAVlCcOSeSu%2BtEyQfm%2Fa4HiECqbnAKNPNNz%2F%2FZqXhYbYcXI%2Bw2R3tfXgXq%2F9SXhUQI77"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
alt-svc: h3=":443"; ma=86400

solitary-sea-f972.mmiloud.workers.dev/vendor/cryptoJS/crypto.js

104.21.28.92

200 OK

12 kB

URL GET HTTP/3
solitary-sea-f972.mmiloud.workers.dev/vendor/cryptoJS/crypto.js
IP
104.21.28.92:443
ASN
#13335 CLOUDFLARENET

Requested by
https://solitary-sea-f972.mmiloud.workers.dev/js/lib/crypto_worker.js
Certificate
IssuerGoogle Trust Services LLC
Subjectmmiloud.workers.dev
Fingerprint31:92:0E:B3:C7:11:4B:36:10:75:C5:27:1C:4E:D5:14:92:CD:90:1A
ValidityTue, 26 Mar 2024 16:55:58 GMT - Mon, 24 Jun 2024 16:55:57 GMT

File type
JavaScript source, ASCII text
Size
12 kB (12361 bytes)
Hash
6d1ac0184656afab590fbf06e7bc8c5d
d19746a7093963f02edce52c35b2fa348f581e7c
3f0843eec5370cfa3e77ed908dc39353f1c8ba6facdfd88105605e6807a4dde2

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Telegram

HTTP Headers

GET /vendor/cryptoJS/crypto.js HTTP/1.1
Host: solitary-sea-f972.mmiloud.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://solitary-sea-f972.mmiloud.workers.dev/js/lib/crypto_worker.js
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 26 Apr 2024 17:29:52 GMT
content-type: application/javascript
cf-ray: 87a84c25ffd8b4f9-OSL
cf-cache-status: MISS
access-control-allow-origin: *
cache-control: max-age=3600
etag: W/"5d83f6a8-10096"
expires: Fri, 26 Apr 2024 18:29:52 GMT
last-modified: Thu, 19 Sep 2019 21:44:08 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
x-frame-options: deny
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GZGsT5bX4aP2SYcci%2F%2BrFpGIF00cp6fLFZ3R1Tfog8qunZs3RqpQB6WhDBYxcdMsv6xWIwfCP0sOmXcwsOi9SLdUF4a2BYwzjlG0Lrfbnn8ajCFWqciagP1bafg9CW6Y8peWgerWWru5giGpuJUgErhrazmr3e0p"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
alt-svc: h3=":443"; ma=86400

solitary-sea-f972.mmiloud.workers.dev/vendor/closure/long.js

104.21.28.92

200 OK

11 kB

URL GET HTTP/3
solitary-sea-f972.mmiloud.workers.dev/vendor/closure/long.js
IP
104.21.28.92:443
ASN
#13335 CLOUDFLARENET

Requested by
https://solitary-sea-f972.mmiloud.workers.dev/js/lib/crypto_worker.js
Certificate
IssuerGoogle Trust Services LLC
Subjectmmiloud.workers.dev
Fingerprint31:92:0E:B3:C7:11:4B:36:10:75:C5:27:1C:4E:D5:14:92:CD:90:1A
ValidityTue, 26 Mar 2024 16:55:58 GMT - Mon, 24 Jun 2024 16:55:57 GMT

File type
ASCII text
Size
11 kB (10918 bytes)
Hash
b0a35c095dc09f1fd10de13953946b82
5405ea3612003c91e32f721d664953a3c59d617d
aa33fd722e9ffa58aca046c34ba1d850bbccc689b6eceaaef4700337cfa7a597

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Telegram

HTTP Headers

GET /vendor/closure/long.js HTTP/1.1
Host: solitary-sea-f972.mmiloud.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://solitary-sea-f972.mmiloud.workers.dev/js/lib/crypto_worker.js
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 26 Apr 2024 17:29:52 GMT
content-type: application/javascript
cf-ray: 87a84c25efd2b4f9-OSL
cf-cache-status: MISS
access-control-allow-origin: *
cache-control: max-age=3600
etag: W/"5d83f6a8-5bfe"
expires: Fri, 26 Apr 2024 18:29:52 GMT
last-modified: Thu, 19 Sep 2019 21:44:08 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
x-frame-options: deny
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qB5sQ6WJ1Mq3AqILK3EL69w8zY5jR%2B0O4hNyrPrneE0WgNteQQcXwu2%2BlLF1TaE2Y%2FRgos0iAwJpJROY4G5UOsa3Tn7T%2BXTcN5F1rS2dNJbEk%2BNh%2FktV69eAeAuCYPFcSd1UU0QxMByb8tthD14s3XRAwcFXMsRE"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
alt-svc: h3=":443"; ma=86400

solitary-sea-f972.mmiloud.workers.dev/js/lib/crypto_worker.js

104.21.28.92

200 OK

8.5 kB

URL GET HTTP/3
solitary-sea-f972.mmiloud.workers.dev/js/lib/crypto_worker.js
IP
104.21.28.92:443
ASN
#13335 CLOUDFLARENET

Requested by
https://solitary-sea-f972.mmiloud.workers.dev/
Certificate
IssuerGoogle Trust Services LLC
Subjectmmiloud.workers.dev
Fingerprint31:92:0E:B3:C7:11:4B:36:10:75:C5:27:1C:4E:D5:14:92:CD:90:1A
ValidityTue, 26 Mar 2024 16:55:58 GMT - Mon, 24 Jun 2024 16:55:57 GMT

File type
ASCII text
Size
8.5 kB (8524 bytes)
Hash
71e05d663296e5122981424d5b8f756f
f4b4bf884bd101adfb192e5e69be504c0fa46dd9
fe146019189901e1e9b9a1d1ce67ed7435ddf121c04461169c6fd4b3e8ed1f6c

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Telegram

HTTP Headers

GET /js/lib/crypto_worker.js HTTP/1.1
Host: solitary-sea-f972.mmiloud.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://solitary-sea-f972.mmiloud.workers.dev/
Sec-Fetch-Dest: worker
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 26 Apr 2024 17:29:52 GMT
content-type: application/javascript
cf-ray: 87a84c24ee88b4f9-OSL
cf-cache-status: MISS
access-control-allow-origin: *
cache-control: max-age=3600
etag: W/"5d83f6a8-4a3"
expires: Fri, 26 Apr 2024 18:29:52 GMT
last-modified: Thu, 19 Sep 2019 21:44:08 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
x-frame-options: deny
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y3cAVzGPy5t3DqfYqkflez4l5RWwChr2U0xNCiwTRsqeKO8dSbqumRtuiEpnuIlnoJ1PQpoEL9XvynSTjbYH4LFlrPPAIL%2Fiv9xU2eTQHntirdC9vvVLhibAF5Q1IzWtMYnQk8p3n4FDU2U%2F2D24Q8Tru6ZMKeKE"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
alt-svc: h3=":443"; ma=86400

solitary-sea-f972.mmiloud.workers.dev/js/lib/bin_utils.js

104.21.28.92

200 OK

14 kB

URL GET HTTP/3
solitary-sea-f972.mmiloud.workers.dev/js/lib/bin_utils.js
IP
104.21.28.92:443
ASN
#13335 CLOUDFLARENET

Requested by
https://solitary-sea-f972.mmiloud.workers.dev/js/lib/crypto_worker.js
Certificate
IssuerGoogle Trust Services LLC
Subjectmmiloud.workers.dev
Fingerprint31:92:0E:B3:C7:11:4B:36:10:75:C5:27:1C:4E:D5:14:92:CD:90:1A
ValidityTue, 26 Mar 2024 16:55:58 GMT - Mon, 24 Jun 2024 16:55:57 GMT

File type
ASCII text
Size
14 kB (13954 bytes)
Hash
ff3766aeac6bdf4b355f93dba1b7d6f9
4fd4b8d4f42e17199f1e60d3e5237fa6acc447b3
0c5729f25599688103762e69ca5da531baffc0f0169787e7190e4ff5a1583f9a

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Telegram

HTTP Headers

GET /js/lib/bin_utils.js HTTP/1.1
Host: solitary-sea-f972.mmiloud.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://solitary-sea-f972.mmiloud.workers.dev/js/lib/crypto_worker.js
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 26 Apr 2024 17:29:52 GMT
content-type: application/javascript
cf-ray: 87a84c258f58b4f9-OSL
cf-cache-status: MISS
access-control-allow-origin: *
cache-control: max-age=3600
etag: W/"5d83f6a8-3dbc"
expires: Fri, 26 Apr 2024 18:29:52 GMT
last-modified: Thu, 19 Sep 2019 21:44:08 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
x-frame-options: deny
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UgxuQc5ECqKCyIDiXIJnceV06JfUUBXnp0UyXCQQCW%2Byb1ntnK1NBdHjwgAc%2BZXU2MZL1fkIeRuXmrw4vbvMC%2FZL9f5fEl4GXYAb9hZgvgGXpGhLXskcyMzEJbbCxKs61vd9HQELiTeO%2B%2BrCHQn7cCiAzfHBiyE9"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
alt-svc: h3=":443"; ma=86400

solitary-sea-f972.mmiloud.workers.dev/js/lib/polyfill.js

104.21.28.92

200 OK

13 kB

URL GET HTTP/3
solitary-sea-f972.mmiloud.workers.dev/js/lib/polyfill.js
IP
104.21.28.92:443
ASN
#13335 CLOUDFLARENET

Requested by
https://solitary-sea-f972.mmiloud.workers.dev/js/lib/crypto_worker.js
Certificate
IssuerGoogle Trust Services LLC
Subjectmmiloud.workers.dev
Fingerprint31:92:0E:B3:C7:11:4B:36:10:75:C5:27:1C:4E:D5:14:92:CD:90:1A
ValidityTue, 26 Mar 2024 16:55:58 GMT - Mon, 24 Jun 2024 16:55:57 GMT

File type
JavaScript source, ASCII text
Size
13 kB (12799 bytes)
Hash
b530810019a85da1b809ad5ca05b9d78
12f7fd232ccdd4f8bd500d24b00594fd87aa880d
efbe1b8cd2f0d607180f5e17863ef1918232b0401b15e61e49ec76f8ac49dee2

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Telegram

HTTP Headers

GET /js/lib/polyfill.js HTTP/1.1
Host: solitary-sea-f972.mmiloud.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://solitary-sea-f972.mmiloud.workers.dev/js/lib/crypto_worker.js
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 26 Apr 2024 17:29:52 GMT
content-type: application/javascript
cf-ray: 87a84c258f56b4f9-OSL
cf-cache-status: MISS
access-control-allow-origin: *
cache-control: max-age=3600
etag: W/"5d83f6a8-117e"
expires: Fri, 26 Apr 2024 18:29:52 GMT
last-modified: Thu, 19 Sep 2019 21:44:08 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
x-frame-options: deny
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fw%2Br4QT0AGltQ1ATKDhrtwGQmZMH6WnWFiHNDcNrMnZsuqf8f19iIxHOpsp9dhPfqNNx5yeVI2jl0cpjanJCJPCIUErtmZRaC9vAcyuiZdpqoNhDwfKIGxJrmkAiSW5Ublr%2B47A0EzdeOWRIh2IHsAjiCGmf%2BaJQ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
alt-svc: h3=":443"; ma=86400

venus.web.telegram.org/apiw1

149.154.167.99

200 OK

652 B

URL POST HTTP/2
venus.web.telegram.org/apiw1
IP
149.154.167.99:443
ASN
#62041 Telegram Messenger Inc

Requested by
https://solitary-sea-f972.mmiloud.workers.dev/
Certificate
IssuerGoDaddy.com, Inc.
Subject*.web.telegram.org
Fingerprint74:51:4A:F8:C5:D2:E1:36:68:30:25:98:05:27:E8:6F:57:FC:E0:3B
ValidityWed, 30 Aug 2023 00:40:43 GMT - Mon, 30 Sep 2024 00:40:43 GMT

File type
data
Size
652 B (652 bytes)
Hash
817b5735fcd22bee00566a14c61e97b1
9d0ad87cbad95676cfdff02456c0f0e4d184acd3
b67e30393388defd725c7d5069f02ddb896f0c597504f9fd20ba0a98cdb2237e

HTTP Headers

POST /apiw1 HTTP/1.1
Host: venus.web.telegram.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Length: 340
Origin: https://solitary-sea-f972.mmiloud.workers.dev
DNT: 1
Connection: keep-alive
Referer: https://solitary-sea-f972.mmiloud.workers.dev/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx/1.18.0
date: Fri, 26 Apr 2024 17:29:54 GMT
content-type: application/octet-stream
content-length: 652
pragma: no-cache
cache-control: no-store
access-control-allow-origin: *
access-control-allow-methods: POST, OPTIONS
access-control-allow-headers: origin, content-type
access-control-max-age: 1728000
strict-transport-security: max-age=35768000
X-Firefox-Spdy: h2

venus.web.telegram.org/apiw1

149.154.167.99

200 OK

72 B

URL POST HTTP/2
venus.web.telegram.org/apiw1
IP
149.154.167.99:443
ASN
#62041 Telegram Messenger Inc

Requested by
https://solitary-sea-f972.mmiloud.workers.dev/
Certificate
IssuerGoDaddy.com, Inc.
Subject*.web.telegram.org
Fingerprint74:51:4A:F8:C5:D2:E1:36:68:30:25:98:05:27:E8:6F:57:FC:E0:3B
ValidityWed, 30 Aug 2023 00:40:43 GMT - Mon, 30 Sep 2024 00:40:43 GMT

File type
data
Size
72 B (72 bytes)
Hash
9d9b3a7fe826d20970b839d51bb8d651
9a41dcaf522b24db500f7bfce7c30bf6560e55ed
7318ddd2c3da5167cbf6b39381fcbddf3bbacba0df44ca3ad4c7dea9d55150bb

HTTP Headers

POST /apiw1 HTTP/1.1
Host: venus.web.telegram.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Length: 396
Origin: https://solitary-sea-f972.mmiloud.workers.dev
DNT: 1
Connection: keep-alive
Referer: https://solitary-sea-f972.mmiloud.workers.dev/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx/1.18.0
date: Fri, 26 Apr 2024 17:29:55 GMT
content-type: application/octet-stream
content-length: 72
pragma: no-cache
cache-control: no-store
access-control-allow-origin: *
access-control-allow-methods: POST, OPTIONS
access-control-allow-headers: origin, content-type
access-control-max-age: 1728000
strict-transport-security: max-age=35768000
X-Firefox-Spdy: h2

venus.web.telegram.org/apiw1

149.154.167.99

200 OK

168 B

URL POST HTTP/2
venus.web.telegram.org/apiw1
IP
149.154.167.99:443
ASN
#62041 Telegram Messenger Inc

Requested by
https://solitary-sea-f972.mmiloud.workers.dev/
Certificate
IssuerGoDaddy.com, Inc.
Subject*.web.telegram.org
Fingerprint74:51:4A:F8:C5:D2:E1:36:68:30:25:98:05:27:E8:6F:57:FC:E0:3B
ValidityWed, 30 Aug 2023 00:40:43 GMT - Mon, 30 Sep 2024 00:40:43 GMT

File type
data
Size
168 B (168 bytes)
Hash
4ec817f630c3fd08034c7218d27f8d85
c773fc1dbc400a3d50b77623adadd9132287ea14
db4aebf2d6df3df6eea8e7d4567a1f49613db126b2dbe4ca66961177e3d8b644

HTTP Headers

POST /apiw1 HTTP/1.1
Host: venus.web.telegram.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Length: 344
Origin: https://solitary-sea-f972.mmiloud.workers.dev
DNT: 1
Connection: keep-alive
Referer: https://solitary-sea-f972.mmiloud.workers.dev/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx/1.18.0
date: Fri, 26 Apr 2024 17:29:56 GMT
content-type: application/octet-stream
content-length: 168
pragma: no-cache
cache-control: no-store
access-control-allow-origin: *
access-control-allow-methods: POST, OPTIONS
access-control-allow-headers: origin, content-type
access-control-max-age: 1728000
strict-transport-security: max-age=35768000
X-Firefox-Spdy: h2

vesta.web.telegram.org/apiw1

149.154.167.99

200 OK

84 B

URL POST HTTP/2
vesta.web.telegram.org/apiw1
IP
149.154.167.99:443
ASN
#62041 Telegram Messenger Inc

Requested by
https://solitary-sea-f972.mmiloud.workers.dev/
Certificate
IssuerGoDaddy.com, Inc.
Subject*.web.telegram.org
Fingerprint74:51:4A:F8:C5:D2:E1:36:68:30:25:98:05:27:E8:6F:57:FC:E0:3B
ValidityWed, 30 Aug 2023 00:40:43 GMT - Mon, 30 Sep 2024 00:40:43 GMT

File type
data
Size
84 B (84 bytes)
Hash
f84560e47ba063fa08ee03882ee8e9a5
30442d75af06a8c556157304d109332ab8686fc0
d20fc1486ed7a0683ea6019a3e420f6e568d7887317d3ae02c4f03d7cda6a924

HTTP Headers

POST /apiw1 HTTP/1.1
Host: vesta.web.telegram.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Length: 40
Origin: https://solitary-sea-f972.mmiloud.workers.dev
DNT: 1
Connection: keep-alive
Referer: https://solitary-sea-f972.mmiloud.workers.dev/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx/1.18.0
date: Fri, 26 Apr 2024 17:29:56 GMT
content-type: application/octet-stream
content-length: 84
pragma: no-cache
cache-control: no-store
access-control-allow-origin: *
access-control-allow-methods: POST, OPTIONS
access-control-allow-headers: origin, content-type
access-control-max-age: 1728000
strict-transport-security: max-age=35768000
X-Firefox-Spdy: h2

venus.web.telegram.org/apiw1

149.154.167.99

200 OK

168 B

URL POST HTTP/2
venus.web.telegram.org/apiw1
IP
149.154.167.99:443
ASN
#62041 Telegram Messenger Inc

Requested by
https://solitary-sea-f972.mmiloud.workers.dev/
Certificate
IssuerGoDaddy.com, Inc.
Subject*.web.telegram.org
Fingerprint74:51:4A:F8:C5:D2:E1:36:68:30:25:98:05:27:E8:6F:57:FC:E0:3B
ValidityWed, 30 Aug 2023 00:40:43 GMT - Mon, 30 Sep 2024 00:40:43 GMT

File type
data
Size
168 B (168 bytes)
Hash
f74f1fcf76f722ea18370e8b0e927ae7
68c44146182d4b2ff69a0c1619c5d4d3d64438d6
62a66d7b7b65e07ad17953bd0dc3e5022f520e3dac2633ad0876bd283928ff53

HTTP Headers

POST /apiw1 HTTP/1.1
Host: venus.web.telegram.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Length: 168
Origin: https://solitary-sea-f972.mmiloud.workers.dev
DNT: 1
Connection: keep-alive
Referer: https://solitary-sea-f972.mmiloud.workers.dev/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx/1.18.0
date: Fri, 26 Apr 2024 17:29:56 GMT
content-type: application/octet-stream
content-length: 168
pragma: no-cache
cache-control: no-store
access-control-allow-origin: *
access-control-allow-methods: POST, OPTIONS
access-control-allow-headers: origin, content-type
access-control-max-age: 1728000
strict-transport-security: max-age=35768000
X-Firefox-Spdy: h2

solitary-sea-f972.mmiloud.workers.dev/img/Telegram.svg

104.21.28.92

200 OK

13 kB

URL GET HTTP/3
solitary-sea-f972.mmiloud.workers.dev/img/Telegram.svg
IP
104.21.28.92:443
ASN
#13335 CLOUDFLARENET

Requested by
https://solitary-sea-f972.mmiloud.workers.dev/
Certificate
IssuerGoogle Trust Services LLC
Subjectmmiloud.workers.dev
Fingerprint31:92:0E:B3:C7:11:4B:36:10:75:C5:27:1C:4E:D5:14:92:CD:90:1A
ValidityTue, 26 Mar 2024 16:55:58 GMT - Mon, 24 Jun 2024 16:55:57 GMT

File type
SVG Scalable Vector Graphics image
Size
13 kB (12555 bytes)
Hash
4964c9bbfba510f495319c52562d70d4
dc3592a833a3e24be2d6df7a261973b7585a8392
bd24e2e781d27a24a5b689e340f6acfd17069cf48814d563160c8c9265382d77

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Telegram

HTTP Headers

GET /img/Telegram.svg HTTP/1.1
Host: solitary-sea-f972.mmiloud.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://solitary-sea-f972.mmiloud.workers.dev/css/app.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 26 Apr 2024 17:29:52 GMT
content-type: image/svg+xml
cf-ray: 87a84c24de7db4f9-OSL
cf-cache-status: MISS
access-control-allow-origin: *
cache-control: max-age=3600
etag: W/"5d83f6a8-14c9"
expires: Fri, 26 Apr 2024 18:29:52 GMT
last-modified: Thu, 19 Sep 2019 21:44:08 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
x-frame-options: deny
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QGLr%2BawGmxphTENdM80U609OnQLqluQ1309jPIYs7lG6ETp3WOBJk2pNrvbNS5g1XGwSmtVGdjqLqdX8gyE61%2Fo1W%2BdTheQ7%2F70QmsQZItDM36doot8F2F%2BsQ1WWJ0PrGBDbqL9pot08vV67r4%2F4zcNaQ6i4pBH7"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
alt-svc: h3=":443"; ma=86400

vesta.web.telegram.org/apiw1

149.154.167.99

200 OK

652 B

URL POST HTTP/2
vesta.web.telegram.org/apiw1
IP
149.154.167.99:443
ASN
#62041 Telegram Messenger Inc

Requested by
https://solitary-sea-f972.mmiloud.workers.dev/
Certificate
IssuerGoDaddy.com, Inc.
Subject*.web.telegram.org
Fingerprint74:51:4A:F8:C5:D2:E1:36:68:30:25:98:05:27:E8:6F:57:FC:E0:3B
ValidityWed, 30 Aug 2023 00:40:43 GMT - Mon, 30 Sep 2024 00:40:43 GMT

File type
data
Size
652 B (652 bytes)
Hash
34a2abb74fedb04c692bf305f5469458
f26f8cb084acba6db8dc7ab3f66c575c3228f1a4
d532994c945c9a767838db23d1b321ed1825285a0e73cc8f6cd6e852e68358c2

HTTP Headers

POST /apiw1 HTTP/1.1
Host: vesta.web.telegram.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Length: 340
Origin: https://solitary-sea-f972.mmiloud.workers.dev
DNT: 1
Connection: keep-alive
Referer: https://solitary-sea-f972.mmiloud.workers.dev/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx/1.18.0
date: Fri, 26 Apr 2024 17:30:00 GMT
content-type: application/octet-stream
content-length: 652
pragma: no-cache
cache-control: no-store
access-control-allow-origin: *
access-control-allow-methods: POST, OPTIONS
access-control-allow-headers: origin, content-type
access-control-max-age: 1728000
strict-transport-security: max-age=35768000
X-Firefox-Spdy: h2

vesta.web.telegram.org/apiw1

149.154.167.99

200 OK

72 B

URL POST HTTP/2
vesta.web.telegram.org/apiw1
IP
149.154.167.99:443
ASN
#62041 Telegram Messenger Inc

Requested by
https://solitary-sea-f972.mmiloud.workers.dev/
Certificate
IssuerGoDaddy.com, Inc.
Subject*.web.telegram.org
Fingerprint74:51:4A:F8:C5:D2:E1:36:68:30:25:98:05:27:E8:6F:57:FC:E0:3B
ValidityWed, 30 Aug 2023 00:40:43 GMT - Mon, 30 Sep 2024 00:40:43 GMT

File type
data
Size
72 B (72 bytes)
Hash
f0abffead9075a01949953af9508a728
f3b2661b964c1575f89df0ca23a5543fc96ce647
01b9ecb147f7d9268460b47ab286251ae86a79860b7861770d908a747221dded

HTTP Headers

POST /apiw1 HTTP/1.1
Host: vesta.web.telegram.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Length: 396
Origin: https://solitary-sea-f972.mmiloud.workers.dev
DNT: 1
Connection: keep-alive
Referer: https://solitary-sea-f972.mmiloud.workers.dev/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx/1.18.0
date: Fri, 26 Apr 2024 17:30:01 GMT
content-type: application/octet-stream
content-length: 72
pragma: no-cache
cache-control: no-store
access-control-allow-origin: *
access-control-allow-methods: POST, OPTIONS
access-control-allow-headers: origin, content-type
access-control-max-age: 1728000
strict-transport-security: max-age=35768000
X-Firefox-Spdy: h2

solitary-sea-f972.mmiloud.workers.dev/vendor/rusha/rusha.js

104.21.28.92

200 OK

17 kB

URL GET HTTP/3
solitary-sea-f972.mmiloud.workers.dev/vendor/rusha/rusha.js
IP
104.21.28.92:443
ASN
#13335 CLOUDFLARENET

Requested by
https://solitary-sea-f972.mmiloud.workers.dev/js/lib/crypto_worker.js
Certificate
IssuerGoogle Trust Services LLC
Subjectmmiloud.workers.dev
Fingerprint31:92:0E:B3:C7:11:4B:36:10:75:C5:27:1C:4E:D5:14:92:CD:90:1A
ValidityTue, 26 Mar 2024 16:55:58 GMT - Mon, 24 Jun 2024 16:55:57 GMT

File type

Size
17 kB (16970 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Telegram

HTTP Headers

GET /vendor/rusha/rusha.js HTTP/1.1
Host: solitary-sea-f972.mmiloud.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://solitary-sea-f972.mmiloud.workers.dev/js/lib/crypto_worker.js
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 26 Apr 2024 17:29:52 GMT
content-type: application/javascript
cf-ray: 87a84c25ffdab4f9-OSL
cf-cache-status: MISS
access-control-allow-origin: *
cache-control: max-age=3600
etag: W/"5d83f6a8-424a"
expires: Fri, 26 Apr 2024 18:29:52 GMT
last-modified: Thu, 19 Sep 2019 21:44:08 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
x-frame-options: deny
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=C7vpql7uKeB%2BiUhmsKTrdzkoGbVD6ZliWiS4RG3VZQWWRAPWWk5B3YziRwTBZknOqEeu6Vl4ACrnsK0SaqL%2BEWuBsKT31Rdk2BheTwjV6dbwp1f3O3jhD5NWtqdqVd1vHljX7pAWFEXwG2VW1A8%2B4UjNJSJ2p%2FfI"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
alt-svc: h3=":443"; ma=86400

solitary-sea-f972.mmiloud.workers.dev/vendor/jsbn/jsbn_combined.js

104.21.28.92

200 OK

37 kB

URL GET HTTP/3
solitary-sea-f972.mmiloud.workers.dev/vendor/jsbn/jsbn_combined.js
IP
104.21.28.92:443
ASN
#13335 CLOUDFLARENET

Requested by
https://solitary-sea-f972.mmiloud.workers.dev/js/lib/crypto_worker.js
Certificate
IssuerGoogle Trust Services LLC
Subjectmmiloud.workers.dev
Fingerprint31:92:0E:B3:C7:11:4B:36:10:75:C5:27:1C:4E:D5:14:92:CD:90:1A
ValidityTue, 26 Mar 2024 16:55:58 GMT - Mon, 24 Jun 2024 16:55:57 GMT

File type
ASCII text, with very long lines (661)
Size
37 kB (37064 bytes)
Hash
d7eb1b82e658eef11ce3d8fd9caf10d5
5f6537a517860b4c57fbd2d0de201b5ba80bec2b
bf35737ecb19f93b2e4c411eb6a3ce6e6b9398d14c199cccec272e70865807ed

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Telegram

HTTP Headers

GET /vendor/jsbn/jsbn_combined.js HTTP/1.1
Host: solitary-sea-f972.mmiloud.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://solitary-sea-f972.mmiloud.workers.dev/js/lib/crypto_worker.js
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 26 Apr 2024 17:29:52 GMT
content-type: application/javascript
cf-ray: 87a84c259f5eb4f9-OSL
cf-cache-status: MISS
access-control-allow-origin: *
cache-control: max-age=3600
etag: W/"5d83f6a8-90c8"
expires: Fri, 26 Apr 2024 18:29:52 GMT
last-modified: Thu, 19 Sep 2019 21:44:08 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
x-frame-options: deny
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0YeJrWrYO3%2BE0Ayw0vBlg85m3gtY8bTEAu7wGOQgFEJW3fssVOGkXQKzy1acUJB6EYef9JKjGdn5Tl481p1mo%2Bt5hekBG%2BQ98m4%2FywMAtiCBMlefr%2FI1RnIQR%2Fs%2BgmujTwya2svmvx7LwrnX8ETcg9HFhboG%2BIUZ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
alt-svc: h3=":443"; ma=86400

solitary-sea-f972.mmiloud.workers.dev/img/icons/General.png

104.21.28.92

200 OK

6.4 kB

URL GET HTTP/3
solitary-sea-f972.mmiloud.workers.dev/img/icons/General.png
IP
104.21.28.92:443
ASN
#13335 CLOUDFLARENET

Requested by
https://solitary-sea-f972.mmiloud.workers.dev/
Certificate
IssuerGoogle Trust Services LLC
Subjectmmiloud.workers.dev
Fingerprint31:92:0E:B3:C7:11:4B:36:10:75:C5:27:1C:4E:D5:14:92:CD:90:1A
ValidityTue, 26 Mar 2024 16:55:58 GMT - Mon, 24 Jun 2024 16:55:57 GMT

File type
PNG image data, 40 x 948, 8-bit/color RGBA, non-interlaced
Size
6.4 kB (6355 bytes)
Hash
10639598adc8046b54dfa15d2e6443d0
9e4255140f3f8793ed06181cb016c5120c5cdb24
1787211bb6c15bc910e4aa84f5840a92bf1d52d9fed9975d604e91a2164d894e

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Telegram

HTTP Headers

GET /img/icons/General.png HTTP/1.1
Host: solitary-sea-f972.mmiloud.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://solitary-sea-f972.mmiloud.workers.dev/css/app.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 26 Apr 2024 17:29:52 GMT
content-type: image/png
content-length: 6355
cf-ray: 87a84c24ce79b4f9-OSL
cf-cache-status: MISS
accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=3600
etag: "5d83f6a8-18d3"
expires: Fri, 26 Apr 2024 18:29:52 GMT
last-modified: Thu, 19 Sep 2019 21:44:08 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
x-frame-options: deny
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=f6Bt73QN%2FmSCS3UzifJS6GSKVwekWUmJNwwmhIyq011CjE2I%2Fw775FcNsfTRyxYiKNtiE%2BQoygiV8hkIZaj6ScyM350mn6WMLZpr2SFtnvs64i2woKJpd4bL%2FGIztXVRNtBTxkHJNLrdcBZAdlbIO5RJn1Sre%2FyQ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
alt-svc: h3=":443"; ma=86400

solitary-sea-f972.mmiloud.workers.dev/css/app.css

104.21.28.92

200 OK

192 kB

URL GET HTTP/3
solitary-sea-f972.mmiloud.workers.dev/css/app.css
IP
104.21.28.92:443
ASN
#13335 CLOUDFLARENET

Requested by
https://solitary-sea-f972.mmiloud.workers.dev/
Certificate
IssuerGoogle Trust Services LLC
Subjectmmiloud.workers.dev
Fingerprint31:92:0E:B3:C7:11:4B:36:10:75:C5:27:1C:4E:D5:14:92:CD:90:1A
ValidityTue, 26 Mar 2024 16:55:58 GMT - Mon, 24 Jun 2024 16:55:57 GMT

File type
assembler source, ASCII text, with very long lines (556)
Size
192 kB (192079 bytes)
Hash
9800f784d00ac7a3515484676b730bcb
93a5e9d8631d889ec17686c287d5f6ffe21704fd
ab24b8258e6d00603702753a091af931e3995de0059ab0aadc1bf8700a8cb37e

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Telegram

HTTP Headers

GET /css/app.css HTTP/1.1
Host: solitary-sea-f972.mmiloud.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://solitary-sea-f972.mmiloud.workers.dev/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 26 Apr 2024 17:29:51 GMT
content-type: text/css
cf-ray: 87a84c1e9e87b4f9-OSL
cf-cache-status: MISS
access-control-allow-origin: *
cache-control: max-age=3600
etag: W/"5fdcb452-2ee4f"
expires: Fri, 26 Apr 2024 18:29:51 GMT
last-modified: Fri, 18 Dec 2020 13:53:22 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
x-frame-options: deny
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=p1S7oclMzYRZhNPVMwItobe%2FtCh5fSKUYGYReCnBh619Gn86PbCrSiM5oMFfsVT3txxDo6dU%2BUdYjNApuVaVbyUA8Oc1LfA5oB7x74wPBNMf2UIOGYttzOf0AtUn39VuQ7KjV1Ebgn5hZydStcb9BexTkWnqj11n"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
alt-svc: h3=":443"; ma=86400

solitary-sea-f972.mmiloud.workers.dev/js/app.js

104.21.28.92

200 OK

2.6 MB

URL GET HTTP/3
solitary-sea-f972.mmiloud.workers.dev/js/app.js
IP
104.21.28.92:443
ASN
#13335 CLOUDFLARENET

Requested by
https://solitary-sea-f972.mmiloud.workers.dev/
Certificate
IssuerGoogle Trust Services LLC
Subjectmmiloud.workers.dev
Fingerprint31:92:0E:B3:C7:11:4B:36:10:75:C5:27:1C:4E:D5:14:92:CD:90:1A
ValidityTue, 26 Mar 2024 16:55:58 GMT - Mon, 24 Jun 2024 16:55:57 GMT

File type

Size
2.6 MB (2633033 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Telegram

HTTP Headers

GET /js/app.js HTTP/1.1
Host: solitary-sea-f972.mmiloud.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://solitary-sea-f972.mmiloud.workers.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 26 Apr 2024 17:29:51 GMT
content-type: application/javascript
cf-ray: 87a84c1e9e8ab4f9-OSL
cf-cache-status: MISS
access-control-allow-origin: *
cache-control: max-age=3600
etag: W/"6455eb92-282d49"
expires: Fri, 26 Apr 2024 18:29:51 GMT
last-modified: Sat, 06 May 2023 05:54:26 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
x-frame-options: deny
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FTi1zYJy5QP6H4qhcmhkpJ8hbPNnlbbATLb83EOTm6WHKT1kYhDUM%2FAz2JGBQgfopg23451B2xo57CLARs8cPn4Kz4%2Ff6ayxKgDKbbKJ%2FAo6URhI3nOjpicOdd3aQ4VaZf7bkaRKZ5dSaaTxf%2FL7GysdtOqQZ5Xx"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
alt-svc: h3=":443"; ma=86400

solitary-sea-f972.mmiloud.workers.dev/js/locales/en-us.json

104.21.28.92

200 OK

49 kB

URL GET HTTP/3
solitary-sea-f972.mmiloud.workers.dev/js/locales/en-us.json
IP
104.21.28.92:443
ASN
#13335 CLOUDFLARENET

Requested by
https://solitary-sea-f972.mmiloud.workers.dev/
Certificate
IssuerGoogle Trust Services LLC
Subjectmmiloud.workers.dev
Fingerprint31:92:0E:B3:C7:11:4B:36:10:75:C5:27:1C:4E:D5:14:92:CD:90:1A
ValidityTue, 26 Mar 2024 16:55:58 GMT - Mon, 24 Jun 2024 16:55:57 GMT

File type

Size
49 kB (48847 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Telegram

HTTP Headers

GET /js/locales/en-us.json HTTP/1.1
Host: solitary-sea-f972.mmiloud.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
DNT: 1
Connection: keep-alive
Referer: https://solitary-sea-f972.mmiloud.workers.dev/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 26 Apr 2024 17:29:52 GMT
content-type: application/json
cf-ray: 87a84c236cb4b4f9-OSL
cf-cache-status: DYNAMIC
access-control-allow-origin: *
cache-control: max-age=3600
etag: W/"600496b2-becf"
expires: Fri, 26 Apr 2024 18:29:51 GMT
last-modified: Sun, 17 Jan 2021 19:57:38 GMT
access-control-allow-credentials: true
x-frame-options: deny
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=q5T9XyITzBGl39igPo2A8%2BGnxofUR3F2qkO5LmM9O1UbEp0JG0i4n9qDB2kbRznPAiwab5q0wUuJYiK22sgV6pmCN7s9%2F6WLe3sp3N22%2BY0l1Ax1l%2ByC1PPPY7yAUi731MnOEV%2FXifkk3QoegNFC6yCiM1MihTcx"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
content-encoding: br
alt-svc: h3=":443"; ma=86400

solitary-sea-f972.mmiloud.workers.dev/

104.21.28.92

200 OK

1.6 kB

URL User Request GET HTTP/2
solitary-sea-f972.mmiloud.workers.dev/
IP
104.21.28.92:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services LLC
Subjectmmiloud.workers.dev
Fingerprint31:92:0E:B3:C7:11:4B:36:10:75:C5:27:1C:4E:D5:14:92:CD:90:1A
ValidityTue, 26 Mar 2024 16:55:58 GMT - Mon, 24 Jun 2024 16:55:57 GMT

File type
HTML document, ASCII text, with very long lines (1606), with no line terminators
Size
1.6 kB (1587 bytes)
Hash
17812bbaf192c7e0d5a6073bfa71e32f
ec6e055fc71d9ac11646765fcc6302a4b4c58429
1796784b6ff2b8ebc641be88fd11c986829f8bbcfa8fb98fd0dab4196d51b918

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Telegram

HTTP Headers

GET / HTTP/1.1
Host: solitary-sea-f972.mmiloud.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 26 Apr 2024 17:29:50 GMT
content-type: text/html
cf-ray: 87a84c1c3b3156c3-OSL
cf-cache-status: DYNAMIC
access-control-allow-origin: *
cache-control: max-age=3600
expires: Fri, 26 Apr 2024 18:29:50 GMT
last-modified: Wed, 25 Oct 2023 19:17:17 GMT
access-control-allow-credentials: true
x-frame-options: deny
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PT5Z0iMI141xvYHWFuI0esq3ysbL4nH8MMHd7DodnlkTPBBklKid9GeIGgUleSNxKXGlz5wsT%2Fe0MgQo3etqKuVRV3fRyi6ws6RuaeZ8VmQtCYjKd4T%2FmR%2FCBWVf4VEmSZqf%2B0fYQ5Gpi73wCnGzZ7U5%2Fbxfk2Vy"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

solitary-sea-f972.mmiloud.workers.dev/css/desktop.css

104.21.28.92

200 OK

50 kB

URL GET HTTP/3
solitary-sea-f972.mmiloud.workers.dev/css/desktop.css
IP
104.21.28.92:443
ASN
#13335 CLOUDFLARENET

Requested by
https://solitary-sea-f972.mmiloud.workers.dev/
Certificate
IssuerGoogle Trust Services LLC
Subjectmmiloud.workers.dev
Fingerprint31:92:0E:B3:C7:11:4B:36:10:75:C5:27:1C:4E:D5:14:92:CD:90:1A
ValidityTue, 26 Mar 2024 16:55:58 GMT - Mon, 24 Jun 2024 16:55:57 GMT

File type
ASCII text, with very long lines (1030)
Size
50 kB (49603 bytes)
Hash
cdeaae73c3902e8e2d9e20baab11006f
7d9edd8c78f47a61fcdfa63b8e691c1086bcb8e7
c47434acd9cc3f90b5bce8c782561ce10c52903c7fac19e141030c57d9c6dcf3

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Telegram

HTTP Headers

GET /css/desktop.css HTTP/1.1
Host: solitary-sea-f972.mmiloud.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://solitary-sea-f972.mmiloud.workers.dev/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 26 Apr 2024 17:29:52 GMT
content-type: text/css
cf-ray: 87a84c236cabb4f9-OSL
cf-cache-status: MISS
access-control-allow-origin: *
cache-control: max-age=3600
etag: W/"600496b2-c1c3"
expires: Fri, 26 Apr 2024 18:29:51 GMT
last-modified: Sun, 17 Jan 2021 19:57:38 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
x-frame-options: deny
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iB%2BZ5QZtrdhf97IcQkfjjSM686PitxfTB2Mb6nyC62etSDp709DZGyEIpP0Hw8Wv2ja%2FzqW1U%2FWzKUUOKGWZ2qmT%2FjVCZMp64qypye6BW0wN2lpI1FFovmQnBqVGTg%2BnrX6NtsnmLshH8tisucKYIXO5jFg%2FQ5kL"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
alt-svc: h3=":443"; ma=86400

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (1)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (25)

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL POST HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type

Size