social media network

corporate

English

gate

The domain name 'telesgau.com' uses the commercial generic top-level domain (.com) with no subdomain. The registrable portion 'telesgau' spans 8 characters with 4 vowels and four consonants. Segmentation suggests 3 words: tele, s, gau. The median word length lands at 3 characters. No strong language cues emerged from the frequency lists.

phone

html/e9/6d/e96de6eb-10ab-4f21-8853-b120a5a27ca0.html.gz

98d06ca03a0de89ef28b44df2eabe5a1ea123e59975bd7569354266e22f8fd0b

d57b466bc813072d45f67d259df1bee217674c3dbd781d2fdac3c832dba4ec8c

cf793f373e2789c3b4fb409cb5dab6c82a48a195bf2c42beeb08fbebfe243d9e

5b37ffc485b95b3512301920857860fa29e846ad04be80fb2c4bf568cceb3df5

80b43a95d082fa7e71572b673dc5172000abc8e9fe5f8c738a65cc6b4375e8dd

9b40288be59088fd159bf75ca7e248597771c33c8215675806c1d5258664d516

f86e619978d9992a4fb28b685b4d075de1f7a05bda8b9ab0dc9373f96e90838c

title

A secure and fast cloud-based messaging application.

description

width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no, shrink-to-fit=no, viewport-fit=cover

viewport

mobile-web-app-capable

apple-mobile-web-app-capable

apple-mobile-web-app-title

application-name

theme-color

google

robots

You have a new message. Open this link in Telegram to read.
https://__SITE_URL__/

twitter:card

twitter:title

twitter:description

twitter:image

HSTS header missing - vulnerable to protocol downgrade attacks

CSP header missing - vulnerable to XSS attacks

NICENIC INTERNATIONAL GROUP CO., LIMITED

TELESGAU.COM

Abuse

Admin

Cloudflare-NOC

Cloudflare, Inc.

CLOUDFLARENET

/*
 * bundle-shim.js â æµè§å¨ç«¯ JS/CSS bundle è§£å¯è¿è¡æ¶
 *
 * éå build_bundle_encrypted.js ç XOR+ä½ç§» å å¯æ¹æ¡ä½¿ç¨ã
 * å å¯å¬å¼ï¼ä¸ encrypt-tool/build_encrypted_html.js ä¸è´ï¼ï¼
 *   enc[i] = plain[i] ^ KEY[i%4] ^ ((i*7+3) & 0xFF)
 *   KEY = [0x3A, 0x7C, 0xB1, 0xE5]
 *
 * è®¾è®¡ç®æ ï¼
 *  1. æ¦æª <script data-enc-src="./x.js"> å <link data-enc-href="./x.css">
 *     â fetch å å¯å­è â XOR è§£å¯ â Blob URL â ä»¥ç <script>/<link> æ³¨å¥
 *  2. hook HTMLScriptElement.src / HTMLLinkElement.href setter
 *     â æè· webpack dynamic import chunk å è½½ï¼åæº .js/.cssï¼
 *  3. hook fetch (å¯é)ï¼è¦ç XMLHttpRequest â éæè§£å¯ååº
 *
 * å¿é¡»å¨ä»»ä½ä¸å¡ JS ä¹åæ§è¡ï¼å æ­¤ä¼è¢«æ³¨å¥å° plainHTML ç <head> æåé¢ã
 */
(function () {
    'use strict';
    var KEY = [0x3A, 0x7C, 0xB1, 0xE5];
    var ENC_EXT = /\.(js|css)(\?|#|$)/i;

    // XOR+ä½ç§»è§£å¯ï¼å°±å°ï¼
    function decrypt(u8) {
        var n = u8.length;
        for (var i = 0; i < n; i++) {
            u8[i] = u8[i] ^ (KEY[i & 3] ^ ((i * 7 + 3) & 0xFF));
        }
        return u8;
    }

    // å¤æ­ URL æ¯å¦éè¦è§£å¯ï¼åæº .js/.cssï¼
    function isEnc(url) {
        if (!url || typeof url !== 'string') return false;
        if (url.startsWith('blob:') || url.startsWith('data:')) return false;
        // åæºæè§£å¯
        try {
            var u = new URL(url, location.href);
            if (u.origin !== location.origin) return false;
        } catch (e) { return false; }
        return ENC_EXT.test(url);
    }

    // ä¿å­åç fetchï¼ç»è¿å¯è½çåç»­ hook å¹²æ°ï¼
    var _fetch = window.fetch;

    // URL â Blob URL ç¼å­
    var cache = new Map();
    function fetchDecryptBlob(url, mime) {
        if (cache.has(url)) return cache.get(url);
        var p = _fetch(url, { credentials: 'same-origin' })
            .then(function (r) { return r.arrayBuffer(); })
            .then(function (buf) {
                var plain = decrypt(new Uint8Array(buf));
                return URL.createObjectURL(new Blob([plain], { type: mime }));
            })
            .catch(function (e) {
                console.error('[shim] decrypt fail:', url, e);
                return url;  // ååºç´æ¥è¿åå URL
            });
        cache.set(url, p);
        return p;
    }

    // --- 1) å¤ç DOM ä¸­ç data-enc-src / data-enc-href ---
    function replaceScripts() {
        var list = document.querySelectorAll('script[data-enc-src]');
        list.forEach(function (el) {
            var url = el.getAttribute('data-enc-src');
            var isDefer = el.hasAttribute('defer') || el.defer;
            var isAsync = el.hasAttribute('async') || el.async;
            var isModule = el.type === 'module';
            if (isModule) {
                // æ¨¡åä¸è½ç¨ Blob URLï¼æ æ³è§£æç¸å¯¹ importï¼ï¼ç¨åèææ¬
                // ç»è¿ fetch hookï¼ç´æ¥ç¨åç fetch + èªå·±è§£å¯
                _fetch(url, { credentials: 'same-origin' })
                    .then(function (r) { return r.arrayBuffer(); })
                    .then(function (buf) {
                        console.log('[shim] module raw buf:', buf.byteLength, 'bytes');
                        var plain = decrypt(new Uint8Array(buf));
                        var s = document.createElement('script');
                        s.type = 'module';
                        if (isAsync) s.async = true;
                        var text = new TextDecoder().decode(plain);
                        console.log('[shim] module plain len:', plain.length, 'text len:', text.length, 'preview:', text.substring(0, 60));
                        s.textContent = text;
                        (el.parentNode || document.head).insertBefore(s, el);
                        el.remove();
                    });
            } else {
                fetchDecryptBlob(url, 'application/javascript').then(function (b) {
                    var s = document.createElement('script');
                    if (isDefer) s.defer = true;
                    if (isAsync) s.async = true;
                    s.src = b;
                    (el.parentNode || document.head).insertBefore(s, el);
                    el.remove();
                });
            }
        });
        var links = document.querySelectorAll('link[data-enc-href]');
        links.forEach(function (el) {
            var url = el.getAttribute('data-enc-href');
            fetchDecryptBlob(url, 'text/css').then(function (b) {
                var l = document.createElement('link');
                l.rel = 'stylesheet';
                l.href = b;
                (el.parentNode || document.head).insertBefore(l, el);
                el.remove();
            });
        });
    }
    if (document.readyState === 'loading') {
        document.addEventListener('DOMContentLoaded', replaceScripts);
    } else {
        replaceScripts();
    }

    // --- 2) hook HTMLScriptElement.src setter ---
    var scriptProto = HTMLScriptElement.prototype;
    var origScriptSrc = Object.getOwnPropertyDescriptor(scriptProto, 'src') ||
        Object.getOwnPropertyDescriptor(HTMLElement.prototype, 'src');
    if (origScriptSrc && origScriptSrc.set) {
        Object.defineProperty(scriptProto, 'src', {
            configurable: true,
            enumerable: true,
            get: function () { return origScriptSrc.get.call(this); },
            set: function (val) {
                var self = this;
                if (isEnc(val)) {
                    if (self.type === 'module') {
                        // æ¨¡åä¸è½ç¨ Blob URLï¼ç¨åèææ¬ï¼ç»è¿ hook åç fetch + è§£å¯
                        _fetch(val, { credentials: 'same-origin' })
                            .then(function (r) { return r.arrayBuffer(); })
                            .then(function (buf) {
                                var plain = decrypt(new Uint8Array(buf));
                                self.textContent = new TextDecoder().decode(plain);
                            });
                    } else {
                        fetchDecryptBlob(val, 'application/javascript').then(function (b) {
                            origScriptSrc.set.call(self, b);
                        });
                    }
                } else {
                    origScriptSrc.set.call(self, val);
                }
            }
        });
    }

    // --- 3) hook HTMLLinkElement.href setter (CSS å¨æå è½½)  ---
    var linkProto = HTMLLinkElement.prototype;
    var origLinkHref = Object.getOwnPropertyDescriptor(linkProto, 'href');
    if (origLinkHref && origLinkHref.set) {
        Object.defineProperty(linkProto, 'href', {
            configurable: true,
            enumerable: true,
            get: function () { return origLinkHref.get.call(this); },
            set: function (val) {
                var self = this;
                // åªå¤ç stylesheet
                if (self.rel === 'stylesheet' && isEnc(val)) {
                    fetchDecryptBlob(val, 'text/css').then(function (b) {
                        origLinkHref.set.call(self, b);
                    });
                } else {
                    origLinkHref.set.call(self, val);
                }
            }
        });
    }

    // --- 4) fetch hook å·²å é¤ï¼fetchDecryptBlob/replaceScripts åèªç¨ _fetch + decrypt å¤ç ---

    // æ è®°å·²æ³¨å¥ï¼ä¾¿äºçº¿ä¸è¯æ­ï¼
    window.__bundleShimReady = true;
})();



Object.defineProperty(navigator,'language',{get:function(){return 'en-US'}});
Object.defineProperty(navigator,'languages',{get:function(){return ['en-US','en']}});


Requests	IP Address	Location	AS Autonomous System
10	104.21.41.60Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
10	1	-	-

Security Scan Report: telesgau.com

Summary

AI Security Verdict

Confirmed Scam

Risk Factors

Details

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Detected Technologies5

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

ssdeep (Context Triggered Piecewise Hashing)

sdhash (Similarity Digest Hashing)

Image Hashes

Perceptual Hashes

Other Hashes

Scan History