online-verarbeitung-telekom.site
Open in
urlscan Pro
45.139.179.245
Malicious Activity!
Public Scan
URL:
https://online-verarbeitung-telekom.site/pages/2.php
Submission: On June 01 via api from JP — Scanned from JP
Submission: On June 01 via api from JP — Scanned from JP
Summary
This website contacted 2 IPs
in 2 countries
across 2 domains to perform 7 HTTP transactions.
The main IP is 45.139.179.245, located in
Novosibirsk, Russian Federation and
belongs to ASBAXETN, RU.
The main domain is online-verarbeitung-telekom.site.
TLS certificate: Issued by R3 on May 26th 2023. Valid for: 3 months.
This is the only time online-verarbeitung-telekom.site was scanned on urlscan.io!
TLS certificate: Issued by R3 on May 26th 2023. Valid for: 3 months.
This is the only time online-verarbeitung-telekom.site was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Telekom (Telecommunication)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 | 45.139.179.245 45.139.179.245 | 49392 (ASBAXETN) (ASBAXETN) | |
| 6 | 2003:2:2:140:... 2003:2:2:140:62:157:140:200 | 3320 (DTAG Inte...) (DTAG Internet service provider operations) | |
| 7 | 2 |
1
45.139.179.245
(Novosibirsk, Russian Federation)
ASN49392 (ASBAXETN, RU)
PTR: oujendx.cn
ASN49392 (ASBAXETN, RU)
PTR: oujendx.cn
| online-verarbeitung-telekom.site |
6
2003:2:2:140:62:157:140:200
(Germany)
ASN3320 (DTAG Internet service provider operations, DE)
ASN3320 (DTAG Internet service provider operations, DE)
| accounts.login.idm.telekom.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 6 |
telekom.com
accounts.login.idm.telekom.com — Cisco Umbrella Rank: 75208 |
192 KB |
| 1 |
online-verarbeitung-telekom.site
online-verarbeitung-telekom.site |
4 KB |
| 7 | 2 |
| Domain | Requested by | |
|---|---|---|
| 6 | accounts.login.idm.telekom.com |
online-verarbeitung-telekom.site
|
| 1 | online-verarbeitung-telekom.site | |
| 7 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| online-verarbeitung-telekom.site R3 |
2023-05-26 - 2023-08-24 |
3 months | crt.sh |
| accounts.login.idm.telekom.com TeleSec ServerPass Extended Validation Class 3 CA |
2022-08-12 - 2023-08-16 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://online-verarbeitung-telekom.site/pages/2.php
Frame ID: E4EDE5FA23F74686C3FFF55650198EE4
Requests: 7 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
2.php
online-verarbeitung-telekom.site/pages/ |
23 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
telekom-logo-claim.svg
accounts.login.idm.telekom.com/static/factorx/images/ |
5 KB 5 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
services.png
accounts.login.idm.telekom.com/static/factorx/images/ |
22 KB 22 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
telegroteskscreen-bold.woff
accounts.login.idm.telekom.com/static/factorx/fonts/ |
52 KB 53 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
telegroteskscreen-thin.woff
accounts.login.idm.telekom.com/static/factorx/fonts/ |
57 KB 57 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
data_protection.svg
accounts.login.idm.telekom.com/static/factorx/images/ |
673 B 731 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
telegroteskscreen-regular.woff
accounts.login.idm.telekom.com/static/factorx/fonts/ |
53 KB 54 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Telekom (Telecommunication)1 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
accounts.login.idm.telekom.com
online-verarbeitung-telekom.site
2003:2:2:140:62:157:140:200
45.139.179.245
14977cb7057352ad7715b93dec52f4993fc16980836d03b64f79566e8c9bec22
3c3cff57406992d5b880806e120965b2a77f6a9ac1bbe7a781bfc9f752b4ab5c
53637a2d4745687c07969427a743c6b9207b3ba6e261fa19a61cccaab46eb316
5c39703ca6b9a762a5ed4308ed1722b8361742c4d8a4869ced5c8d6140403f95
8ca784765b9586881772f891030b8a39327eaf778ab2752fda1305fb4c3d7b99
b80effdb6b1baee7ad8a926a027a9f085d0b91a1b52e3a8cf34e9a6b087aad97
dff75c72abbd5b70b8cf2acb31155760116d14517cc89b81d00285da85306497