trinkets.life Open in urlscan Pro
95.179.208.77 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://trinkets.life/admin/view/stylesheet/redirect/t-onlineweb/telekom2.php?email=c..*@t..*.de
Submission: On November 05 via automatic, source openphish (November 5th 2024, 1:40:14 pm UTC) — Scanned from FR

Summary HTTP 17 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 17 HTTP transactions. The main IP is 95.179.208.77, located in Aubervilliers, France and belongs to AS-VULTR, US. The main domain is trinkets.life.
TLS certificate: Issued by R11 on August 25th 2024. Valid for: 3 months.

This is the only time trinkets.life was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Telekom (Telecommunication)

Domain & IP information

	IP Address	AS Autonomous System
7	95.179.208.77 95.179.208.77	20473 (AS-VULTR) (AS-VULTR)
9	2003:2:2:140:... 2003:2:2:140:62:157:140:200	3320 (DTAG Inte...) (DTAG Internet service provider operations)
1	2600:9000:223... 2600:9000:223f:4200:f:f903:2f40:93a1	16509 (AMAZON-02) (AMAZON-02)
17	3

7 95.179.208.77 (Aubervilliers, France)

ASN20473 (AS-VULTR, US)
PTR: 95.179.208.77.vultrusercontent.com

trinkets.life	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2003:2:2:140:62:157:140:200 (Germany)

ASN3320 (DTAG Internet service provider operations, DE)

accounts.login.idm.telekom.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:223f:4200:f:f903:2f40:93a1 (United States)

ASN16509 (AMAZON-02, US)

www.t-online.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	telekom.com accounts.login.idm.telekom.com — Cisco Umbrella Rank: 124089	200 KB
7	trinkets.life trinkets.life	3 KB
1	t-online.de www.t-online.de — Cisco Umbrella Rank: 51729	7 KB
17	3

	Domain	Requested by
9	accounts.login.idm.telekom.com	trinkets.life accounts.login.idm.telekom.com
7	trinkets.life	trinkets.life
1	www.t-online.de	trinkets.life
17	3

This site contains links to these domains. Also see Links.

Domain
www.telekom.de

Subject Issuer	Validity	Valid
trinkets.life R11	`2024-08-25` - `2024-11-23`	3 months	crt.sh
accounts.login.idm.telekom.com Telekom Security ServerID EV Class 3 CA	`2024-07-12` - `2025-07-16`	a year	crt.sh
www.t-online.de Amazon ECDSA 256 M03	`2024-06-09` - `2025-07-08`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://trinkets.life/admin/view/stylesheet/redirect/t-onlineweb/telekom2.php?email=c..*@t..*.de
Frame ID: 607C0E1E31877FF775E56EA7F058A948
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Telekom Login

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

17
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

209 kB
Transfer

304 kB
Size

0
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://www.telekom.de/hilfe/telekom-login
Title: Benötigen Sie Hilfe?

Search URL Search Domain Scan URL

URL: https://www.telekom.de/start/impressum
Title: Impressum

Search URL Search Domain Scan URL

URL: https://www.telekom.de/datenschutz-ganz-einfach
Title: Datenschutz

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request telekom2.php Show response
trinkets.life/admin/view/stylesheet/redirect/t-onlineweb/ 8 KB
3 KB 282ms
17ms Document
text/html 95.179.208.77
AS-VULTR

General

Check archive.org

Show headers Download Go to

Full URL

https://trinkets.life/admin/view/stylesheet/redirect/t-onlineweb/telekom2.php?email=c..*@t..*.de

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.179.208.77 Aubervilliers, France, ASN20473 (AS-VULTR, US),

Reverse DNS

95.179.208.77.vultrusercontent.com

Software

nginx /

Resource Hash

94e2ba062580e1d12059f044c8b54ddb24e06a426074ca49a62afd48b68ebe8c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Tue, 05 Nov 2024 13:40:07 GMT
server: nginx
strict-transport-security: max-age=31536000
vary: Accept-Encoding

GET
H2 200 components.min.css
accounts.login.idm.telekom.com/static/factorx/css/ 96 KB
18 KB 156ms
41ms Stylesheet
text/css 2003:2:2:140:62:157:140:200
DTAG Internet ser...

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.login.idm.telekom.com/static/factorx/css/components.min.css

Requested by

Host: trinkets.life
URL: https://trinkets.life/admin/view/stylesheet/redirect/t-onlineweb/telekom2.php?email=c..*@t..*.de

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2003:2:2:140:62:157:140:200 , Germany, ASN3320 (DTAG Internet service provider operations, DE),

Reverse DNS

Software

Apache /

Resource Hash

f7c9a6a063bebf358281210d89deab95b3664efdaa7221d33003e76bb819481a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://trinkets.life/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public
content-encoding: gzip
expires: Tue, 12 Nov 2024 13:40:07 GMT
accept-ranges: bytes
sh: 094f0c8ad1c1f32f93e30becb4ca542a
p3p: CP="NOI CURa TAIa OUR NOR UNI"
content-length: 18596
date: Tue, 05 Nov 2024 13:40:07 GMT
last-modified: Wed, 25 Nov 2020 06:16:23 GMT
vary: Accept-Encoding
server: Apache
content-type: text/css; charset=utf-8

GET
H2 200 login-24.08.0.css
accounts.login.idm.telekom.com/static/factorx/css/ 18 KB
4 KB 155ms
41ms Stylesheet
text/css 2003:2:2:140:62:157:140:200
DTAG Internet ser...

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.login.idm.telekom.com/static/factorx/css/login-24.08.0.css

Requested by

Host: trinkets.life
URL: https://trinkets.life/admin/view/stylesheet/redirect/t-onlineweb/telekom2.php?email=c..*@t..*.de

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2003:2:2:140:62:157:140:200 , Germany, ASN3320 (DTAG Internet service provider operations, DE),

Reverse DNS

Software

Apache /

Resource Hash

9d34f2b8d86dfcbbdb3da353eb04b805b0bf60cd3d90e8a0a1723f2dfff7a916

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://trinkets.life/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public
content-encoding: gzip
expires: Tue, 12 Nov 2024 13:40:07 GMT
accept-ranges: bytes
sh: 094f0c8ad1c1f32f93e30becb4ca542a
p3p: CP="NOI CURa TAIa OUR NOR UNI"
content-length: 3686
date: Tue, 05 Nov 2024 13:40:07 GMT
last-modified: Wed, 09 Jun 2021 03:40:49 GMT
vary: Accept-Encoding
server: Apache
content-type: text/css; charset=utf-8

GET
H2 404 jquery-3.2.1.min.js
trinkets.life/static/factorx/js/ 0
0 19ms
16ms Script
text/html 95.179.208.77
AS-VULTR

General

Check archive.org

Show headers Download Go to

Full URL: https://trinkets.life/static/factorx/js/jquery-3.2.1.min.js
Requested by: Host: trinkets.life
URL: https://trinkets.life/admin/view/stylesheet/redirect/t-onlineweb/telekom2.php?email=c..*@t..*.de
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.179.208.77 Aubervilliers, France, ASN20473 (AS-VULTR, US),
Reverse DNS: 95.179.208.77.vultrusercontent.com
Software: nginx /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://trinkets.life/admin/view/stylesheet/redirect/t-onlineweb/telekom2.php?email=c..*@t..*.de

Response headers

content-length: 548
date: Tue, 05 Nov 2024 13:40:07 GMT
content-type: text/html
server: nginx

GET
H2 404 jquery-matchheight-0.7.2.min.js
trinkets.life/static/factorx/js/ 0
0 20ms
17ms Script
text/html 95.179.208.77
AS-VULTR

General

Check archive.org

Show headers Download Go to

Full URL: https://trinkets.life/static/factorx/js/jquery-matchheight-0.7.2.min.js
Requested by: Host: trinkets.life
URL: https://trinkets.life/admin/view/stylesheet/redirect/t-onlineweb/telekom2.php?email=c..*@t..*.de
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.179.208.77 Aubervilliers, France, ASN20473 (AS-VULTR, US),
Reverse DNS: 95.179.208.77.vultrusercontent.com
Software: nginx /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://trinkets.life/admin/view/stylesheet/redirect/t-onlineweb/telekom2.php?email=c..*@t..*.de

Response headers

content-length: 548
date: Tue, 05 Nov 2024 13:40:07 GMT
content-type: text/html
server: nginx

GET
H2 404 components.min.js
trinkets.life/static/factorx/js/ 0
0 21ms
19ms Script
text/html 95.179.208.77
AS-VULTR

General

Check archive.org

Show headers Download Go to

Full URL: https://trinkets.life/static/factorx/js/components.min.js
Requested by: Host: trinkets.life
URL: https://trinkets.life/admin/view/stylesheet/redirect/t-onlineweb/telekom2.php?email=c..*@t..*.de
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.179.208.77 Aubervilliers, France, ASN20473 (AS-VULTR, US),
Reverse DNS: 95.179.208.77.vultrusercontent.com
Software: nginx /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://trinkets.life/admin/view/stylesheet/redirect/t-onlineweb/telekom2.php?email=c..*@t..*.de

Response headers

content-length: 548
date: Tue, 05 Nov 2024 13:40:07 GMT
content-type: text/html
server: nginx

GET
H2 404 login.js
trinkets.life/static/factorx/js/ 0
0 20ms
18ms Script
text/html 95.179.208.77
AS-VULTR

General

Check archive.org

Show headers Download Go to

Full URL: https://trinkets.life/static/factorx/js/login.js
Requested by: Host: trinkets.life
URL: https://trinkets.life/admin/view/stylesheet/redirect/t-onlineweb/telekom2.php?email=c..*@t..*.de
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.179.208.77 Aubervilliers, France, ASN20473 (AS-VULTR, US),
Reverse DNS: 95.179.208.77.vultrusercontent.com
Software: nginx /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://trinkets.life/admin/view/stylesheet/redirect/t-onlineweb/telekom2.php?email=c..*@t..*.de

Response headers

content-length: 548
date: Tue, 05 Nov 2024 13:40:07 GMT
content-type: text/html
server: nginx

GET
H2 404 behavioweb_form.min.js
trinkets.life/static/factorx/js/ 0
0 22ms
20ms Script
text/html 95.179.208.77
AS-VULTR

General

Check archive.org

Show headers Download Go to

Full URL: https://trinkets.life/static/factorx/js/behavioweb_form.min.js
Requested by: Host: trinkets.life
URL: https://trinkets.life/admin/view/stylesheet/redirect/t-onlineweb/telekom2.php?email=c..*@t..*.de
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.179.208.77 Aubervilliers, France, ASN20473 (AS-VULTR, US),
Reverse DNS: 95.179.208.77.vultrusercontent.com
Software: nginx /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://trinkets.life/admin/view/stylesheet/redirect/t-onlineweb/telekom2.php?email=c..*@t..*.de

Response headers

content-length: 548
date: Tue, 05 Nov 2024 13:40:07 GMT
content-type: text/html
server: nginx

GET
H2 200 t-online-logo-29112019.png
www.t-online.de/auth/ 6 KB
7 KB 102ms
25ms Image
image/png 2600:9000:223f:4200:f:f903:2f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.t-online.de/auth/t-online-logo-29112019.png

Requested by

Host: trinkets.life
URL: https://trinkets.life/admin/view/stylesheet/redirect/t-onlineweb/telekom2.php?email=c..*@t..*.de

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223f:4200:f:f903:2f40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

envoy /

Resource Hash

11eed36ec8f3c28fd90958d9881d080cf237ab18d6792dd22785e729f06795ba

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://*.t-online.de;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://trinkets.life/

Response headers

x-request-id: 06e0d256-8166-9519-a6f1-f5e92e9307ba
etag: "0596f294efc4d2edc959324fdbf2b1539"
age: 368
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: gdm7epJ2gnW7TEi4wHm374Y80Xan8DG6dxd0MJb7HANvmqu0YxPL-Q==
date: Tue, 05 Nov 2024 13:33:59 GMT
content-type: image/png
last-modified: Thu, 01 Jan 1970 00:00:01 GMT
x-frame-options: DENY
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: frame-ancestors 'self' https://*.t-online.de;
cache-control: max-age=86400, public
x-envoy-upstream-service-time: 6
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P5",cdn-rid;desc="gdm7epJ2gnW7TEi4wHm374Y80Xan8DG6dxd0MJb7HANvmqu0YxPL-Q==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=0
x-amzn-trace-id: Root=1-672a1ec7-06ff4f4a0c09968c08a38718
referrer-policy: strict-origin-when-cross-origin
via: 1.1 0341da327f4c4c49034aa07ebeeab1f0.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 5851
x-xss-protection: 1; mode=block
x-amz-cf-pop: FRA56-P5
server: envoy

GET
H2 200 icon-eye-display.svg
accounts.login.idm.telekom.com/static/factorx/images/ 1 KB
2 KB 37ms
36ms Image
image/svg+xml 2003:2:2:140:62:157:140:200
DTAG Internet ser...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://accounts.login.idm.telekom.com/static/factorx/images/icon-eye-display.svg

Requested by

Host: accounts.login.idm.telekom.com
URL: https://accounts.login.idm.telekom.com/static/factorx/css/login-24.08.0.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2003:2:2:140:62:157:140:200 , Germany, ASN3320 (DTAG Internet service provider operations, DE),

Reverse DNS

Software

Apache /

Resource Hash

0b15b23f77811821dfb9c3842f72042e6d1a43854deaab0f6c1cc3eeebb440a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://accounts.login.idm.telekom.com/static/factorx/css/login-24.08.0.css

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public
expires: Tue, 05 Nov 2024 14:40:08 GMT
accept-ranges: bytes
sh: 094f0c8ad1c1f32f93e30becb4ca542a
content-length: 1483
p3p: CP="NOI CURa TAIa OUR NOR UNI"
date: Tue, 05 Nov 2024 13:40:08 GMT
last-modified: Tue, 23 Mar 2021 05:38:59 GMT
content-type: image/svg+xml
server: Apache

GET
H2 200 data_protection.svg
accounts.login.idm.telekom.com/static/factorx/images/ 673 B
708 B 39ms
38ms Image
image/svg+xml 2003:2:2:140:62:157:140:200
DTAG Internet ser...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://accounts.login.idm.telekom.com/static/factorx/images/data_protection.svg

Requested by

Host: accounts.login.idm.telekom.com
URL: https://accounts.login.idm.telekom.com/static/factorx/css/login-24.08.0.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2003:2:2:140:62:157:140:200 , Germany, ASN3320 (DTAG Internet service provider operations, DE),

Reverse DNS

Software

Apache /

Resource Hash

53637a2d4745687c07969427a743c6b9207b3ba6e261fa19a61cccaab46eb316

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://accounts.login.idm.telekom.com/static/factorx/css/login-24.08.0.css

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public
expires: Tue, 05 Nov 2024 14:40:08 GMT
accept-ranges: bytes
sh: 094f0c8ad1c1f32f93e30becb4ca542a
content-length: 673
p3p: CP="NOI CURa TAIa OUR NOR UNI"
date: Tue, 05 Nov 2024 13:40:08 GMT
last-modified: Wed, 25 Nov 2020 06:16:23 GMT
content-type: image/svg+xml
server: Apache

GET
H2 200 teleicon-outline.woff
accounts.login.idm.telekom.com/static/factorx/fonts/ 9 KB
9 KB 245ms
33ms Font
application/x-font-woff 2003:2:2:140:62:157:140:200
DTAG Internet ser...

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.login.idm.telekom.com/static/factorx/fonts/teleicon-outline.woff

Requested by

Host: accounts.login.idm.telekom.com
URL: https://accounts.login.idm.telekom.com/static/factorx/css/components.min.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2003:2:2:140:62:157:140:200 , Germany, ASN3320 (DTAG Internet service provider operations, DE),

Reverse DNS

Software

Apache /

Resource Hash

01fa42140c7fd1e43496b320027681e75123e8121c4ff52e7a390a4ec37d9379

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://trinkets.life
Referer: https://accounts.login.idm.telekom.com/static/factorx/css/components.min.css

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public
expires: Tue, 12 Nov 2024 13:40:08 GMT
accept-ranges: bytes
access-control-allow-origin: https://trinkets.life
sh: dc189bafd5fe6a47948620a3878820fa
content-length: 8824
p3p: CP="NOI CURa TAIa OUR NOR UNI"
date: Tue, 05 Nov 2024 13:40:08 GMT
last-modified: Wed, 25 Nov 2020 06:16:23 GMT
content-type: application/x-font-woff
server: Apache

GET
H2 200 telegroteskscreen-ultra.woff
accounts.login.idm.telekom.com/static/factorx/fonts/ 52 KB
53 KB 247ms
35ms Font
application/x-font-woff 2003:2:2:140:62:157:140:200
DTAG Internet ser...

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.login.idm.telekom.com/static/factorx/fonts/telegroteskscreen-ultra.woff

Requested by

Host: accounts.login.idm.telekom.com
URL: https://accounts.login.idm.telekom.com/static/factorx/css/components.min.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2003:2:2:140:62:157:140:200 , Germany, ASN3320 (DTAG Internet service provider operations, DE),

Reverse DNS

Software

Apache /

Resource Hash

3b6317d7c6288f6380f182e8bdc16b4cea82df91bc0f0209dfbce457b3e16910

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://trinkets.life
Referer: https://accounts.login.idm.telekom.com/static/factorx/css/components.min.css

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public
expires: Tue, 12 Nov 2024 13:40:08 GMT
accept-ranges: bytes
access-control-allow-origin: https://trinkets.life
sh: dc189bafd5fe6a47948620a3878820fa
content-length: 53428
p3p: CP="NOI CURa TAIa OUR NOR UNI"
date: Tue, 05 Nov 2024 13:40:08 GMT
last-modified: Wed, 25 Nov 2020 06:16:23 GMT
content-type: application/x-font-woff
server: Apache

GET
H2 200 telegroteskscreen-thin.woff
accounts.login.idm.telekom.com/static/factorx/fonts/ 57 KB
57 KB 246ms
35ms Font
application/x-font-woff 2003:2:2:140:62:157:140:200
DTAG Internet ser...

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.login.idm.telekom.com/static/factorx/fonts/telegroteskscreen-thin.woff

Requested by

Host: accounts.login.idm.telekom.com
URL: https://accounts.login.idm.telekom.com/static/factorx/css/components.min.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2003:2:2:140:62:157:140:200 , Germany, ASN3320 (DTAG Internet service provider operations, DE),

Reverse DNS

Software

Apache /

Resource Hash

3c3cff57406992d5b880806e120965b2a77f6a9ac1bbe7a781bfc9f752b4ab5c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://trinkets.life
Referer: https://accounts.login.idm.telekom.com/static/factorx/css/components.min.css

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public
expires: Tue, 12 Nov 2024 13:40:08 GMT
accept-ranges: bytes
access-control-allow-origin: https://trinkets.life
sh: dc189bafd5fe6a47948620a3878820fa
content-length: 58248
p3p: CP="NOI CURa TAIa OUR NOR UNI"
date: Tue, 05 Nov 2024 13:40:08 GMT
last-modified: Wed, 25 Nov 2020 06:16:23 GMT
content-type: application/x-font-woff
server: Apache

GET
H2 200 telegroteskscreen-regular.woff
accounts.login.idm.telekom.com/static/factorx/fonts/ 53 KB
54 KB 244ms
33ms Font
application/x-font-woff 2003:2:2:140:62:157:140:200
DTAG Internet ser...

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.login.idm.telekom.com/static/factorx/fonts/telegroteskscreen-regular.woff

Requested by

Host: accounts.login.idm.telekom.com
URL: https://accounts.login.idm.telekom.com/static/factorx/css/components.min.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2003:2:2:140:62:157:140:200 , Germany, ASN3320 (DTAG Internet service provider operations, DE),

Reverse DNS

Software

Apache /

Resource Hash

b80effdb6b1baee7ad8a926a027a9f085d0b91a1b52e3a8cf34e9a6b087aad97

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://trinkets.life
Referer: https://accounts.login.idm.telekom.com/static/factorx/css/components.min.css

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public
expires: Tue, 12 Nov 2024 13:40:08 GMT
accept-ranges: bytes
access-control-allow-origin: https://trinkets.life
sh: dc189bafd5fe6a47948620a3878820fa
content-length: 54684
p3p: CP="NOI CURa TAIa OUR NOR UNI"
date: Tue, 05 Nov 2024 13:40:08 GMT
last-modified: Wed, 25 Nov 2020 06:16:23 GMT
content-type: application/x-font-woff
server: Apache

GET
H2 200 teleicon-ui.woff
accounts.login.idm.telekom.com/static/factorx/fonts/ 3 KB
3 KB 245ms
34ms Font
application/x-font-woff 2003:2:2:140:62:157:140:200
DTAG Internet ser...

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.login.idm.telekom.com/static/factorx/fonts/teleicon-ui.woff

Requested by

Host: accounts.login.idm.telekom.com
URL: https://accounts.login.idm.telekom.com/static/factorx/css/components.min.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2003:2:2:140:62:157:140:200 , Germany, ASN3320 (DTAG Internet service provider operations, DE),

Reverse DNS

Software

Apache /

Resource Hash

3cf35b128c4c5dcd9bb0a12bcc009f2e46e382edec4737360a623d0052a6fe34

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://trinkets.life
Referer: https://accounts.login.idm.telekom.com/static/factorx/css/components.min.css

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public
expires: Tue, 12 Nov 2024 13:40:08 GMT
accept-ranges: bytes
access-control-allow-origin: https://trinkets.life
sh: dc189bafd5fe6a47948620a3878820fa
content-length: 2736
p3p: CP="NOI CURa TAIa OUR NOR UNI"
date: Tue, 05 Nov 2024 13:40:08 GMT
last-modified: Wed, 25 Nov 2020 06:16:23 GMT
content-type: application/x-font-woff
server: Apache

GET
H2 404 favicon.ico
trinkets.life/ 548 B
611 B 16ms
16ms Other
text/html 95.179.208.77
AS-VULTR

General

Check archive.org

Show headers Download Go to

Full URL: https://trinkets.life/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.179.208.77 Aubervilliers, France, ASN20473 (AS-VULTR, US),
Reverse DNS: 95.179.208.77.vultrusercontent.com
Software: nginx /
Resource Hash: d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://trinkets.life/admin/view/stylesheet/redirect/t-onlineweb/telekom2.php?email=c..*@t..*.de

Response headers

content-length: 548
date: Tue, 05 Nov 2024 13:40:08 GMT
content-type: text/html
server: nginx

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Telekom (Telecommunication)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

6 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://trinkets.life/static/factorx/js/jquery-3.2.1.min.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://trinkets.life/static/factorx/js/jquery-matchheight-0.7.2.min.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://trinkets.life/static/factorx/js/components.min.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://trinkets.life/static/factorx/js/login.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://trinkets.life/static/factorx/js/behavioweb_form.min.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://trinkets.life/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

accounts.login.idm.telekom.com
trinkets.life
www.t-online.de
2003:2:2:140:62:157:140:200
2600:9000:223f:4200:f:f903:2f40:93a1
95.179.208.77
01fa42140c7fd1e43496b320027681e75123e8121c4ff52e7a390a4ec37d9379
0b15b23f77811821dfb9c3842f72042e6d1a43854deaab0f6c1cc3eeebb440a3
11eed36ec8f3c28fd90958d9881d080cf237ab18d6792dd22785e729f06795ba
3b6317d7c6288f6380f182e8bdc16b4cea82df91bc0f0209dfbce457b3e16910
3c3cff57406992d5b880806e120965b2a77f6a9ac1bbe7a781bfc9f752b4ab5c
3cf35b128c4c5dcd9bb0a12bcc009f2e46e382edec4737360a623d0052a6fe34
53637a2d4745687c07969427a743c6b9207b3ba6e261fa19a61cccaab46eb316
94e2ba062580e1d12059f044c8b54ddb24e06a426074ca49a62afd48b68ebe8c
9d34f2b8d86dfcbbdb3da353eb04b805b0bf60cd3d90e8a0a1723f2dfff7a916
b80effdb6b1baee7ad8a926a027a9f085d0b91a1b52e3a8cf34e9a6b087aad97
d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090
f7c9a6a063bebf358281210d89deab95b3664efdaa7221d33003e76bb819481a

trinkets.life Open in urlscan Pro 95.179.208.77 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

17 Requests

100 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

209 kBTransfer

304 kBSize

0 Cookies

3 Outgoing links

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

6 Console Messages

Security Headers

Indicators

trinkets.life Open in urlscan Pro
95.179.208.77 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

209 kB
Transfer

304 kB
Size

0
Cookies

17 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!