urlquery.net
Investigate/Report/ff97f133-c72b-46e9-a55d-4aeca2012ed0
WEBSITE ANALYSIS REPORT

https://sendusdt-usd.vercel.app/

public
Report tags
suspicious
Submit tags
openphish
Request review
Suspicious activity

3 detections · review the detection signals

Review evidence →

Domain graph

Hostnames and connections captured in this scan

CallsLoads fromRedirects toEmbeds
Loading domain graph…

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds
Reset
Captured HTTP requests; click any summary row or use its hostname button to expand transaction details.
Timestamp (UTC)MethodStatusHost / pathTypeSizeDurationSignals
GET200document6.7 KB94 ms1 alerts
GET200stylesheet16.1 KB19 ms1 alerts
GET200script742.4 KB58 ms—
GET200script1.0 KB16 ms1 alerts
GET200script12.2 KB15 ms3 alerts

Transaction #03

Request / response

URL

GET HTTPS
https://sendusdt-usd.vercel.app/main.js

IP / ASN

United States 216.198.79.3

AS16509 · AMAZON-02

Requested by
https://sendusdt-usd.vercel.app/

Resource information

File type
Unicode text, UTF-8 text
MIME type
application/javascript; charset=utf-8
First seen (UTC)
19 Sep 2026 · 06:52:42.031 UTC
Last seen (UTC)
18 Oct 2026 · 09:08:01.065 UTC
Times seen
12
Size
12.2 KB (12531 bytes)
MD5
5316a396c393ac761dd23af6f2a9465a
SHA1
68887067febaf84ec6a1bd125476bda681862f38
SHA256
e93fb90c6fe68f99529e233632d39a3071a6afcdc2250b6b4e61a407b99c89d7

Certificate information

Issuer
Google Trust Services · WR1
Subject
*.vercel.app
Protocol / cipher
TLSv1.3 · TLS_AES_128_GCM_SHA256
SHA1 fingerprint
E9:FE:9E:58:E9:B3:95:78:1F:9A:AE:FE:41:C4:01:64:C9:FB:2A:BC
Valid from
Sat, 29 Aug 2026 19:48:09 GMT
Valid until
Fri, 27 Nov 2026 19:48:08 GMT

Technology fingerprints

  • Vercel (PaaS)
  • HSTS (Security)

Detections

Detection observations attached to this HTTP transaction.
DetectionSeverityVerdict
urlquery Suspicious - Suspicious Javascript codemediumSuspicious
YARAhub by abuse.ch Detects file containing Telegram Bot APImediummalware
DNS4EU SinkholedmediumMalicious

HTTP headers

Request headers

GET /main.js HTTP/1.1
Host: sendusdt-usd.vercel.app
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br, zstd
Sec-GPC: 1
Connection: keep-alive
Referer: https://sendusdt-usd.vercel.app/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/2 200 
access-control-allow-origin: *
age: 53067
cache-control: public, max-age=0, must-revalidate
content-disposition: inline; filename="main.js"
content-encoding: br
content-type: application/javascript; charset=utf-8
date: Sat, 17 Oct 2026 20:23:08 GMT
etag: W/"5316a396c393ac761dd23af6f2a9465a"
last-modified: Sat, 17 Oct 2026 05:38:40 GMT
server: Vercel
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-vercel-cache: HIT
x-vercel-id: arn1::9pjhs-1792268588083-9c1931b3ff42
X-Firefox-Spdy: h2
GET404img79 B24 ms1 alerts
6 visible / 6 matching / 6 captured
First
Loading evidence…
WORKSPACE SETTINGS

Display preferences

Saved on this device.

SuccessInfoWarningDangerCriticalUnknown

Security colors remain independent of your accent.

Go to…

Recent scans ↵ Search reports /Search hosts ↵

No matching commands.

Ctrl/⌘ K Commands · Esc Close
LOCAL DEMONSTRATION

Notifications

No live event connection.

No notifications yet. Preview an event below.

Full request body

Full screenshot

Full browser screenshot