ws-ext.mcos-d4.t-systems-service.com
Open in
urlscan Pro
93.188.241.171
Malicious Activity!
Public Scan
Submission: On June 24 via automatic, source certstream-suspicious — Scanned from DE
Summary
TLS certificate: Issued by TeleSec ServerPass Class 2 CA on June 24th 2021. Valid for: a year.
This is the only time ws-ext.mcos-d4.t-systems-service.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Telekom (Telecommunication)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
11 | 93.188.241.171 93.188.241.171 | 34086 (SCZN-AS) (SCZN-AS) | |
11 | 2 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
t-systems-service.com
ws-ext.mcos-d4.t-systems-service.com |
4 MB |
11 | 1 |
Domain | Requested by | |
---|---|---|
11 | ws-ext.mcos-d4.t-systems-service.com |
ws-ext.mcos-d4.t-systems-service.com
|
11 | 1 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.t-systems.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
ws-ext.mcos-d4.t-systems-service.com TeleSec ServerPass Class 2 CA |
2021-06-24 - 2022-06-28 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://ws-ext.mcos-d4.t-systems-service.com/
Frame ID: D3B3BDC96909A63B329B97F511D9265B
Requests: 12 HTTP requests in this frame
2 Outgoing links
These are links going to different origins than the main page.
Title: Imprint
Search URL Search Domain Scan URL
Title: Data Protection
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
ws-ext.mcos-d4.t-systems-service.com/ |
4 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
2.d1a8a408.chunk.css
ws-ext.mcos-d4.t-systems-service.com/mcos/static/css/ |
110 KB 110 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
2.c149e39f.chunk.js
ws-ext.mcos-d4.t-systems-service.com/mcos/static/js/ |
2 MB 2 MB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.a3c4514d.chunk.js
ws-ext.mcos-d4.t-systems-service.com/mcos/static/js/ |
395 KB 396 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
background.f8c17a1b.jpg
ws-ext.mcos-d4.t-systems-service.com/mcos/static/media/ |
1 MB 1 MB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
telegrotesknext-regular.woff2
ws-ext.mcos-d4.t-systems-service.com/mcos/fonts/ |
51 KB 52 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
telegrotesknext-thin.woff2
ws-ext.mcos-d4.t-systems-service.com/mcos/fonts/ |
50 KB 51 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
telegrotesknext-ultra.woff2
ws-ext.mcos-d4.t-systems-service.com/mcos/fonts/ |
51 KB 52 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
teleIcon-outline.ttf
ws-ext.mcos-d4.t-systems-service.com/mcos/fonts/ |
14 KB 15 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
deutsche-telekom-logo.8a6a305c.svg
ws-ext.mcos-d4.t-systems-service.com/mcos/static/media/ |
737 B 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
compliance_graphical.3b10b552.svg
ws-ext.mcos-d4.t-systems-service.com/mcos/static/media/ |
1 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Telekom (Telecommunication)11 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| webpackJsonpmcosr object| __core-js_shared__ object| regeneratorRuntime0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | : default-src 'self' *.t-systems-service.com; object-src 'none' |
Strict-Transport-Security | max-age=31536000; includeSubDomains; preload; |
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ws-ext.mcos-d4.t-systems-service.com
93.188.241.171
347328af8834d06505c9f7ab29390f89bd111339112a84d9709e1bb60f8e9aff
422cef28edec4721ae7e7bc831e547006a0c1866b50577164c6b2c1c1a0822ac
5794d94feefc0fecb546f67690f0d37b105734b6674c57f349fa0252318a0eac
59843ec2431a6df2a43226874af8dc8286a5cb3d1e5b9da932febb7ba3564d35
62d3e5bf0301ae7bee1114a2ae5bdfcb3a9f1208e49233a569aaef86dd4ae11f
6e4ecfdcc38736ffef0dead694f5adec8d48dc1897dfd9cf3df430d099720d31
73106a4eb7addd8a6e266d7a0b04ff74663b764253b02ccaa145c879db723048
75858a046aae3202332768623d03db54f4ef31031a65592f1d2bdee6afb18b19
c81bcf50fcba0252be61eabf8c7a96d0ce993c61b8d451057222610f82503c9e
c9b755ea2bcd12831aad19102224e9280de7efdb05a61984437491f8432fbe48
f06e05084162f06b3e3f0f25ad08bf8da3d2574551ca8b530d6b0e07e4b6b6f2
f5ac797c2314aae20433ad0ab636d503bcb657cdd752b89c5465b913c0c94971