gut-grupe.de Open in urlscan Pro
137.184.220.162 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://gut-grupe.de/OL/oauth2/
Submission: On June 04 via api (June 4th 2023, 10:34:08 pm UTC) from JP — Scanned from DE

Summary HTTP 19 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 19 HTTP transactions. The main IP is 137.184.220.162, located in North Bergen, United States and belongs to DIGITALOCEAN-ASN, US. The main domain is gut-grupe.de.
TLS certificate: Issued by cPanel, Inc. Certification Authority on June 2nd 2023. Valid for: 3 months.

This is the only time gut-grupe.de was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Telekom (Telecommunication)

Domain & IP information

	IP Address	AS Autonomous System
17	137.184.220.162 137.184.220.162	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	2600:9000:20c... 2600:9000:20c3:8600:f:f903:2f40:93a1	16509 (AMAZON-02) (AMAZON-02)
1	80.158.67.40 80.158.67.40	34086 (SCZN-AS) (SCZN-AS)
19	3

17 137.184.220.162 (North Bergen, United States)

ASN14061 (DIGITALOCEAN-ASN, US)

gut-grupe.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20c3:8600:f:f903:2f40:93a1 (United States)

ASN16509 (AMAZON-02, US)

www.t-online.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 80.158.67.40 (Germany)

ASN34086 (SCZN-AS, DE)

www.telekom.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
17	gut-grupe.de gut-grupe.de	583 KB
1	telekom.de www.telekom.de — Cisco Umbrella Rank: 139102
1	t-online.de www.t-online.de — Cisco Umbrella Rank: 33559	6 KB
19	3

	Domain	Requested by
17	gut-grupe.de	gut-grupe.de
1	www.telekom.de	gut-grupe.de
1	www.t-online.de	gut-grupe.de
19	3

This site contains links to these domains. Also see Links.

Domain
www.telekom.de

Subject Issuer	Validity	Valid
gut-grupe.de cPanel, Inc. Certification Authority	`2023-06-02` - `2023-08-31`	3 months	crt.sh
www.t-online.de Amazon RSA 2048 M02	`2023-02-28` - `2024-03-29`	a year	crt.sh
www.telekom.de TeleSec ServerPass Class 2 CA	`2022-08-02` - `2023-08-06`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://gut-grupe.de/OL/oauth2/
Frame ID: 5453F2B792BB180FAF6DFAFD448B374E
Requests: 18 HTTP requests in this frame

Frame: https://www.telekom.de/ueber-das-unternehmen/emetriq-xdn?zid=ebadb00a-d182-4d48-a155-c78bcacde8c4
Frame ID: 281E4E133AE3F09A59C1395512264DC0
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Telekom Login

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

19
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

590 kB
Transfer

585 kB
Size

0
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://www.telekom.de/datenschutzhinweise/download/026.pdf
Title: hier

Search URL Search Domain Scan URL

URL: https://www.telekom.de/start/impressum
Title: Impressum

Search URL Search Domain Scan URL

URL: https://www.telekom.de/datenschutz-ganz-einfach
Title: Datenschutz

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

19 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
gut-grupe.de/OL/oauth2/ 12 KB
13 KB 342ms
121ms Document
text/html 137.184.220.162
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://gut-grupe.de/OL/oauth2/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 137.184.220.162 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache /
Resource Hash: 3e7339c88313bf24bb6d6191993e9c382104b6f16c22c684f1a8a253356cf36e

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Date: Sun, 04 Jun 2023 22:34:03 GMT
Keep-Alive: timeout=5, max=100
Server: Apache
Transfer-Encoding: chunked

GET
H/1.1 200
OK components.min.css
gut-grupe.de/OL/static/factorx/css/ 96 KB
96 KB 153ms
95ms Stylesheet
text/css 137.184.220.162
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://gut-grupe.de/OL/static/factorx/css/components.min.css
Requested by: Host: gut-grupe.de
URL: https://gut-grupe.de/OL/oauth2/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 137.184.220.162 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache /
Resource Hash: 8b3fb3e233cd4952bea4010e16b93b68a4236d42e582fd4f290d336477bba4cb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gut-grupe.de/OL/oauth2/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Date: Sun, 04 Jun 2023 22:34:03 GMT
Last-Modified: Thu, 21 Apr 2022 17:45:50 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 98149

GET
H/1.1 200
OK login-24.12.2.css
gut-grupe.de/OL/static/factorx/css/ 18 KB
18 KB 285ms
95ms Stylesheet
text/css 137.184.220.162
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://gut-grupe.de/OL/static/factorx/css/login-24.12.2.css
Requested by: Host: gut-grupe.de
URL: https://gut-grupe.de/OL/oauth2/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 137.184.220.162 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache /
Resource Hash: 3c6b946bce78ef63d1f778b859041ce09e1f3a60d4b0a478eb92e5856c1c44f0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gut-grupe.de/OL/oauth2/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Date: Sun, 04 Jun 2023 22:34:04 GMT
Last-Modified: Thu, 21 Apr 2022 17:45:50 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 18187

GET
H/1.1 200
OK jquery-3.2.1.min.js Show response
gut-grupe.de/OL/static/factorx/js/ 85 KB
85 KB 283ms
92ms Script
application/javascript 137.184.220.162
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://gut-grupe.de/OL/static/factorx/js/jquery-3.2.1.min.js
Requested by: Host: gut-grupe.de
URL: https://gut-grupe.de/OL/oauth2/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 137.184.220.162 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache /
Resource Hash: 87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gut-grupe.de/OL/oauth2/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Date: Sun, 04 Jun 2023 22:34:04 GMT
Last-Modified: Thu, 21 Apr 2022 17:45:50 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 86659

GET
H/1.1 200
OK jquery-matchheight-0.7.2.min.js Show response
gut-grupe.de/OL/static/factorx/js/ 3 KB
4 KB 285ms
92ms Script
application/javascript 137.184.220.162
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://gut-grupe.de/OL/static/factorx/js/jquery-matchheight-0.7.2.min.js
Requested by: Host: gut-grupe.de
URL: https://gut-grupe.de/OL/oauth2/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 137.184.220.162 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache /
Resource Hash: 6ebd3995a2d04fc1550f8d025400411954fdb51dcaa24def899d8fc33b2504a7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gut-grupe.de/OL/oauth2/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Date: Sun, 04 Jun 2023 22:34:04 GMT
Last-Modified: Thu, 21 Apr 2022 17:45:50 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 3376

GET
H/1.1 200
OK components.min.js Show response
gut-grupe.de/OL/static/factorx/js/ 76 KB
76 KB 287ms
94ms Script
application/javascript 137.184.220.162
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://gut-grupe.de/OL/static/factorx/js/components.min.js
Requested by: Host: gut-grupe.de
URL: https://gut-grupe.de/OL/oauth2/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 137.184.220.162 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache /
Resource Hash: 42d274b3c3f7c6565c2f3cc9b009770f143ceca121b91bc25f844f7040f18c94

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gut-grupe.de/OL/oauth2/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Date: Sun, 04 Jun 2023 22:34:04 GMT
Last-Modified: Thu, 21 Apr 2022 17:45:50 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 77706

GET
H/1.1 200
OK login.js Show response
gut-grupe.de/OL/static/factorx/js/ 18 KB
18 KB 325ms
97ms Script
application/javascript 137.184.220.162
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://gut-grupe.de/OL/static/factorx/js/login.js
Requested by: Host: gut-grupe.de
URL: https://gut-grupe.de/OL/oauth2/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 137.184.220.162 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache /
Resource Hash: 5afe5d26fe07381a334b70a62717604740db6805b881903176efe76dc1723bb1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gut-grupe.de/OL/oauth2/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Date: Sun, 04 Jun 2023 22:34:04 GMT
Last-Modified: Thu, 21 Apr 2022 17:45:50 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 17925

GET
H/1.1 200
OK behavioweb_form_2021-06-24.min.js Show response
gut-grupe.de/OL/static/factorx/js/ 22 KB
22 KB 378ms
92ms Script
application/javascript 137.184.220.162
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://gut-grupe.de/OL/static/factorx/js/behavioweb_form_2021-06-24.min.js
Requested by: Host: gut-grupe.de
URL: https://gut-grupe.de/OL/oauth2/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 137.184.220.162 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache /
Resource Hash: 6bc4cb95356938694c444e05063a18fb77ef9a804edc1a1a8c9a9f6460f95533

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gut-grupe.de/OL/oauth2/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Date: Sun, 04 Jun 2023 22:34:04 GMT
Last-Modified: Thu, 21 Apr 2022 17:45:50 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 22176

GET
H2 200 t-online-logo-29112019.png
www.t-online.de/auth/ 6 KB
6 KB 89ms
15ms Image
image/png 2600:9000:20c3:8600:f:f903:2f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.t-online.de/auth/t-online-logo-29112019.png

Requested by

Host: gut-grupe.de
URL: https://gut-grupe.de/OL/oauth2/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:20c3:8600:f:f903:2f40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

envoy /

Resource Hash

11eed36ec8f3c28fd90958d9881d080cf237ab18d6792dd22785e729f06795ba

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://*.t-online.de;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gut-grupe.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sun, 04 Jun 2023 22:33:04 GMT
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self' https://*.t-online.de;
via: 1.1 fe36c7f30c8ef2853edecc43f320092c.cloudfront.net (CloudFront)
x-amz-cf-pop: MUC50-C1
age: 60
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 0
alt-svc: h3=":443"; ma=86400
content-length: 5851
x-xss-protection: 1; mode=block
x-request-id: a7e0f397-991f-9a83-9dc1-503ff32a604f
referrer-policy: strict-origin-when-cross-origin
last-modified: Thu, 01 Jan 1970 00:00:01 GMT
server: envoy
x-amzn-trace-id: Root=1-6477bc1b-25275692761d01337dab0b88
etag: "0596f294efc4d2edc959324fdbf2b1539"
x-frame-options: DENY
content-type: image/png
cache-control: max-age=86400, public
accept-ranges: bytes
x-amz-cf-id: C9S8jAAcsURyAs451gJPMUpzwdkW2w5BrOXMKgBW1S49ZBGH6LU7PQ==

GET
H/1.1 200
OK services.png
gut-grupe.de/OL/static/factorx/images/ 22 KB
22 KB 94ms
94ms Image
image/png 137.184.220.162
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gut-grupe.de/OL/static/factorx/images/services.png
Requested by: Host: gut-grupe.de
URL: https://gut-grupe.de/OL/oauth2/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 137.184.220.162 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache /
Resource Hash: 14977cb7057352ad7715b93dec52f4993fc16980836d03b64f79566e8c9bec22

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gut-grupe.de/OL/oauth2/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Date: Sun, 04 Jun 2023 22:34:04 GMT
Last-Modified: Thu, 21 Apr 2022 17:45:50 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 22647

GET
H2 200 emetriq-xdn
www.telekom.de/ueber-das-unternehmen/ Frame 281E 0
0 437ms
118ms Document
text/html 80.158.67.40
SCZN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.telekom.de/ueber-das-unternehmen/emetriq-xdn?zid=ebadb00a-d182-4d48-a155-c78bcacde8c4

Requested by

Host: gut-grupe.de
URL: https://gut-grupe.de/OL/oauth2/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

80.158.67.40 , Germany, ASN34086 (SCZN-AS, DE),

Reverse DNS

Software

Apache /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' accounts.login.idm.telekom.com;
Strict-Transport-Security	max-age=16070400; includeSubDomains
X-Frame-Options	SAMEORIGIN, ALLOW-FROM https://accounts.login.idm.telekom.com/

Request headers

Referer: https://gut-grupe.de/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
content-disposition: inline; filename="emetriq-xdn.htm"
content-language: de-DE
content-length: 951
content-security-policy: frame-ancestors 'self' accounts.login.idm.telekom.com;
content-type: text/html;charset=UTF-8
date: Sun, 04 Jun 2023 22:34:04 GMT
etag: "add9ad32ce432e5189c293a415a60849"
server: Apache
strict-transport-security: max-age=16070400; includeSubDomains
vary: Accept-Encoding
x-cache: MISS
x-frame-options: SAMEORIGIN, ALLOW-FROM https://accounts.login.idm.telekom.com/
x-varnish: 472424645

GET
H/1.1 200
OK icon-eye-display.svg
gut-grupe.de/OL/static/factorx/images/ 1 KB
2 KB 92ms
91ms Image
image/svg+xml 137.184.220.162
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gut-grupe.de/OL/static/factorx/images/icon-eye-display.svg
Requested by: Host: gut-grupe.de
URL: https://gut-grupe.de/OL/static/factorx/css/login-24.12.2.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 137.184.220.162 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache /
Resource Hash: 0b15b23f77811821dfb9c3842f72042e6d1a43854deaab0f6c1cc3eeebb440a3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gut-grupe.de/OL/static/factorx/css/login-24.12.2.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Date: Sun, 04 Jun 2023 22:34:04 GMT
Last-Modified: Thu, 21 Apr 2022 17:45:50 GMT
Server: Apache
Content-Type: image/svg+xml
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 1483

GET
H/1.1 200
OK data_protection.svg
gut-grupe.de/OL/static/factorx/images/ 673 B
918 B 92ms
92ms Image
image/svg+xml 137.184.220.162
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gut-grupe.de/OL/static/factorx/images/data_protection.svg
Requested by: Host: gut-grupe.de
URL: https://gut-grupe.de/OL/static/factorx/css/login-24.12.2.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 137.184.220.162 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache /
Resource Hash: 53637a2d4745687c07969427a743c6b9207b3ba6e261fa19a61cccaab46eb316

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gut-grupe.de/OL/static/factorx/css/login-24.12.2.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Date: Sun, 04 Jun 2023 22:34:04 GMT
Last-Modified: Thu, 21 Apr 2022 17:45:50 GMT
Server: Apache
Content-Type: image/svg+xml
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 673

GET
H/1.1 200
OK teleicon-outline.woff
gut-grupe.de/OL/static/factorx/fonts/ 9 KB
9 KB 97ms
96ms Font
font/woff 137.184.220.162
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://gut-grupe.de/OL/static/factorx/fonts/teleicon-outline.woff
Requested by: Host: gut-grupe.de
URL: https://gut-grupe.de/OL/static/factorx/css/components.min.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 137.184.220.162 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache /
Resource Hash: 01fa42140c7fd1e43496b320027681e75123e8121c4ff52e7a390a4ec37d9379

Request headers

Referer: https://gut-grupe.de/OL/static/factorx/css/components.min.css
Origin: https://gut-grupe.de
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Date: Sun, 04 Jun 2023 22:34:04 GMT
Last-Modified: Thu, 21 Apr 2022 17:45:50 GMT
Server: Apache
Content-Type: font/woff
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 8824

GET
H/1.1 200
OK telegroteskscreen-ultra.woff
gut-grupe.de/OL/static/factorx/fonts/ 52 KB
52 KB 95ms
94ms Font
font/woff 137.184.220.162
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://gut-grupe.de/OL/static/factorx/fonts/telegroteskscreen-ultra.woff
Requested by: Host: gut-grupe.de
URL: https://gut-grupe.de/OL/static/factorx/css/components.min.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 137.184.220.162 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache /
Resource Hash: 3b6317d7c6288f6380f182e8bdc16b4cea82df91bc0f0209dfbce457b3e16910

Request headers

Referer: https://gut-grupe.de/OL/static/factorx/css/components.min.css
Origin: https://gut-grupe.de
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Date: Sun, 04 Jun 2023 22:34:04 GMT
Last-Modified: Thu, 21 Apr 2022 17:45:50 GMT
Server: Apache
Content-Type: font/woff
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 53428

GET
H/1.1 200
OK telegroteskscreen-regular.woff
gut-grupe.de/OL/static/factorx/fonts/ 53 KB
54 KB 95ms
94ms Font
font/woff 137.184.220.162
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://gut-grupe.de/OL/static/factorx/fonts/telegroteskscreen-regular.woff
Requested by: Host: gut-grupe.de
URL: https://gut-grupe.de/OL/static/factorx/css/components.min.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 137.184.220.162 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache /
Resource Hash: b80effdb6b1baee7ad8a926a027a9f085d0b91a1b52e3a8cf34e9a6b087aad97

Request headers

Referer: https://gut-grupe.de/OL/static/factorx/css/components.min.css
Origin: https://gut-grupe.de
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Date: Sun, 04 Jun 2023 22:34:04 GMT
Last-Modified: Thu, 21 Apr 2022 17:45:50 GMT
Server: Apache
Content-Type: font/woff
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 54684

GET
H/1.1 200
OK telegroteskscreen-bold.woff
gut-grupe.de/OL/static/factorx/fonts/ 52 KB
52 KB 179ms
94ms Font
font/woff 137.184.220.162
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://gut-grupe.de/OL/static/factorx/fonts/telegroteskscreen-bold.woff
Requested by: Host: gut-grupe.de
URL: https://gut-grupe.de/OL/static/factorx/css/components.min.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 137.184.220.162 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache /
Resource Hash: dff75c72abbd5b70b8cf2acb31155760116d14517cc89b81d00285da85306497

Request headers

Referer: https://gut-grupe.de/OL/static/factorx/css/components.min.css
Origin: https://gut-grupe.de
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Date: Sun, 04 Jun 2023 22:34:04 GMT
Last-Modified: Thu, 21 Apr 2022 17:45:50 GMT
Server: Apache
Content-Type: font/woff
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 53500

GET
H/1.1 200
OK telegroteskscreen-thin.woff
gut-grupe.de/OL/static/factorx/fonts/ 57 KB
57 KB 183ms
91ms Font
font/woff 137.184.220.162
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://gut-grupe.de/OL/static/factorx/fonts/telegroteskscreen-thin.woff
Requested by: Host: gut-grupe.de
URL: https://gut-grupe.de/OL/static/factorx/css/components.min.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 137.184.220.162 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache /
Resource Hash: 3c3cff57406992d5b880806e120965b2a77f6a9ac1bbe7a781bfc9f752b4ab5c

Request headers

Referer: https://gut-grupe.de/OL/static/factorx/css/components.min.css
Origin: https://gut-grupe.de
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Date: Sun, 04 Jun 2023 22:34:04 GMT
Last-Modified: Thu, 21 Apr 2022 17:45:50 GMT
Server: Apache
Content-Type: font/woff
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 58248

GET
H/1.1 200
OK teleicon-ui.woff
gut-grupe.de/OL/static/factorx/fonts/ 3 KB
3 KB 183ms
92ms Font
font/woff 137.184.220.162
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://gut-grupe.de/OL/static/factorx/fonts/teleicon-ui.woff
Requested by: Host: gut-grupe.de
URL: https://gut-grupe.de/OL/static/factorx/css/components.min.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 137.184.220.162 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache /
Resource Hash: 3cf35b128c4c5dcd9bb0a12bcc009f2e46e382edec4737360a623d0052a6fe34

Request headers

Referer: https://gut-grupe.de/OL/static/factorx/css/components.min.css
Origin: https://gut-grupe.de
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Date: Sun, 04 Jun 2023 22:34:04 GMT
Last-Modified: Thu, 21 Apr 2022 17:45:50 GMT
Server: Apache
Content-Type: font/woff
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 2736

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Telekom (Telecommunication)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	Message: Refused to frame 'https://www.telekom.de/' because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'self' accounts.login.idm.telekom.com".

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

gut-grupe.de
www.t-online.de
www.telekom.de
137.184.220.162
2600:9000:20c3:8600:f:f903:2f40:93a1
80.158.67.40
01fa42140c7fd1e43496b320027681e75123e8121c4ff52e7a390a4ec37d9379
0b15b23f77811821dfb9c3842f72042e6d1a43854deaab0f6c1cc3eeebb440a3
11eed36ec8f3c28fd90958d9881d080cf237ab18d6792dd22785e729f06795ba
14977cb7057352ad7715b93dec52f4993fc16980836d03b64f79566e8c9bec22
3b6317d7c6288f6380f182e8bdc16b4cea82df91bc0f0209dfbce457b3e16910
3c3cff57406992d5b880806e120965b2a77f6a9ac1bbe7a781bfc9f752b4ab5c
3c6b946bce78ef63d1f778b859041ce09e1f3a60d4b0a478eb92e5856c1c44f0
3cf35b128c4c5dcd9bb0a12bcc009f2e46e382edec4737360a623d0052a6fe34
3e7339c88313bf24bb6d6191993e9c382104b6f16c22c684f1a8a253356cf36e
42d274b3c3f7c6565c2f3cc9b009770f143ceca121b91bc25f844f7040f18c94
53637a2d4745687c07969427a743c6b9207b3ba6e261fa19a61cccaab46eb316
5afe5d26fe07381a334b70a62717604740db6805b881903176efe76dc1723bb1
6bc4cb95356938694c444e05063a18fb77ef9a804edc1a1a8c9a9f6460f95533
6ebd3995a2d04fc1550f8d025400411954fdb51dcaa24def899d8fc33b2504a7
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
8b3fb3e233cd4952bea4010e16b93b68a4236d42e582fd4f290d336477bba4cb
b80effdb6b1baee7ad8a926a027a9f085d0b91a1b52e3a8cf34e9a6b087aad97
dff75c72abbd5b70b8cf2acb31155760116d14517cc89b81d00285da85306497

gut-grupe.de Open in urlscan Pro 137.184.220.162 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

19 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

590 kBTransfer

585 kBSize

0 Cookies

3 Outgoing links

Redirected requests

19 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

14 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

gut-grupe.de Open in urlscan Pro
137.184.220.162 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

19
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

590 kB
Transfer

585 kB
Size

0
Cookies

19 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!