t-mobile-ticket.co Open in urlscan Pro
199.188.205.245 Malicious Activity! Public Scan

URL:
https://t-mobile-ticket.co/
Submission: On July 23 via api (July 23rd 2020, 9:01:21 pm UTC) from DE

Summary HTTP 11 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 11 HTTP transactions. The main IP is 199.188.205.245, located in Los Angeles, United States and belongs to NAMECHEAP-NET, US. The main domain is t-mobile-ticket.co.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on May 7th 2020. Valid for: 2 years.

This is the only time t-mobile-ticket.co was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Telekom (Telecommunication)

Domain & IP information

	IP Address	AS Autonomous System
1	199.188.205.245 199.188.205.245	22612 (NAMECHEAP...) (NAMECHEAP-NET)
6	208.54.116.197 208.54.116.197	21928 (T-MOBILE-...) (T-MOBILE-AS21928)
11	3

1 199.188.205.245 (Los Angeles, United States)

ASN22612 (NAMECHEAP-NET, US)
PTR: server61-4.web-hosting.com

t-mobile-ticket.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 208.54.116.197 (United States)

ASN21928 (T-MOBILE-AS21928, US)

workspace35.t-mobile.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	t-mobile.com workspace35.t-mobile.com	373 KB
1	t-mobile-ticket.co t-mobile-ticket.co	3 KB
11	2

	Domain	Requested by
6	workspace35.t-mobile.com	t-mobile-ticket.co
1	t-mobile-ticket.co
11	2

This site contains links to these domains. Also see Links.

Domain
passwordreset.t-mobile.com

Subject Issuer	Validity	Valid
*.web-hosting.com Sectigo RSA Domain Validation Secure Server CA	`2020-05-07` - `2022-04-05`	2 years	crt.sh
workspace35tt.euv01.t-mobile.com Entrust Certification Authority - L1K	`2019-11-07` - `2020-11-08`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://t-mobile-ticket.co/
Frame ID: 8F504E47EED564EF636390F9AC8BDF5C
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

11
Requests

55 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

376 kB
Transfer

702 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://passwordreset.t-mobile.com/courion/accountcourier
Title: Click here to reset your password.

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
t-mobile-ticket.co/ 8 KB
3 KB 500ms
172ms Document
text/html 199.188.205.245
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://t-mobile-ticket.co/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 199.188.205.245 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: server61-4.web-hosting.com
Software: Apache / PHP/7.2.32
Resource Hash: e01295c44d791b8654d59905bc15226941f6437dfbc4736ee1c20f7f4a2e8506

Request headers

:method: GET
:authority: t-mobile-ticket.co
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Thu, 23 Jul 2020 21:01:02 GMT
server: Apache
x-powered-by: PHP/7.2.32
vary: Accept-Encoding
content-encoding: gzip
content-length: 3004
content-type: text/html; charset=UTF-8

GET
H/1.1 200
OK rdx.css
workspace35.t-mobile.com/vpn/js/rdx/core/css/ 397 KB
73 KB 512ms
134ms Stylesheet
text/css 208.54.116.197
T-MOBILE-AS21928

General

Check archive.org

Show headers Download Go to

Full URL

https://workspace35.t-mobile.com/vpn/js/rdx/core/css/rdx.css

Requested by

Host: t-mobile-ticket.co
URL: https://t-mobile-ticket.co/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

208.54.116.197 , United States, ASN21928 (T-MOBILE-AS21928, US),

Reverse DNS

Software

Apache /

Resource Hash

f512b1c7b49a4d1af362ebd101a2051a6648a7a369a24c52534f38bbc63e1d83

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://t-mobile-ticket.co/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 23 Jul 2020 20:59:41 GMT
Via: NS-CACHE-10.0: 1
Last-Modified: Thu, 09 Jul 2020 18:09:39 GMT
Server: Apache
Age: 82
ETag: "61b9-12202-5aa0620b7dec0"
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Cache-Control: no-cache
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Encoding: gzip
Keep-Alive: timeout=15, max=100
Content-Length: 74242

GET
H/1.1 200
OK base.css
workspace35.t-mobile.com/logon/themes/Default/css/ 35 KB
36 KB 512ms
135ms Stylesheet
text/css 208.54.116.197
T-MOBILE-AS21928

General

Check archive.org

Show headers Download Go to

Full URL

https://workspace35.t-mobile.com/logon/themes/Default/css/base.css

Requested by

Host: t-mobile-ticket.co
URL: https://t-mobile-ticket.co/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

208.54.116.197 , United States, ASN21928 (T-MOBILE-AS21928, US),

Reverse DNS

Software

Apache /

Resource Hash

86e7d27908a1e8f073270209229f4f71d57020f7a3b38327665abcfa99681448

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://t-mobile-ticket.co/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 23 Jul 2020 20:59:40 GMT
Via: NS-CACHE-10.0: 1
Last-Modified: Tue, 02 Jun 2020 02:53:51 GMT
Server: Apache
Age: 83
ETag: "3980714-8d77-5a711056f0dc0"
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Cache-Control: no-store,must-revalidate
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Content-Length: 36215
Expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H/1.1 200
OK citrix-fonts.css
workspace35.t-mobile.com/logon/fonts/ 5 KB
5 KB 512ms
135ms Stylesheet
text/css 208.54.116.197
T-MOBILE-AS21928

General

Check archive.org

Show headers Download Go to

Full URL

https://workspace35.t-mobile.com/logon/fonts/citrix-fonts.css

Requested by

Host: t-mobile-ticket.co
URL: https://t-mobile-ticket.co/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

208.54.116.197 , United States, ASN21928 (T-MOBILE-AS21928, US),

Reverse DNS

Software

Apache /

Resource Hash

13fc4b7a465f3458acaa898b644fca2092fc73ab128a166644ebe56f49debf2a

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://t-mobile-ticket.co/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 23 Jul 2020 20:59:40 GMT
Via: NS-CACHE-10.0: 1
Last-Modified: Tue, 02 Jun 2020 02:53:51 GMT
Server: Apache
Age: 83
ETag: "3980719-1270-5a711056f0dc0"
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Cache-Control: no-store,must-revalidate
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Content-Length: 4720
Expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H/1.1 200
OK custom.css
workspace35.t-mobile.com/logon/themes/Default/css/ 4 KB
4 KB 513ms
136ms Stylesheet
text/css 208.54.116.197
T-MOBILE-AS21928

General

Check archive.org

Show headers Download Go to

Full URL

https://workspace35.t-mobile.com/logon/themes/Default/css/custom.css

Requested by

Host: t-mobile-ticket.co
URL: https://t-mobile-ticket.co/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

208.54.116.197 , United States, ASN21928 (T-MOBILE-AS21928, US),

Reverse DNS

Software

Apache /

Resource Hash

87124f6c3518887e888a669e4ae156f8da68d367f59821671d98ac2490f466f1

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://t-mobile-ticket.co/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 23 Jul 2020 20:59:40 GMT
Via: NS-CACHE-10.0: 1
Last-Modified: Tue, 11 Apr 2017 15:22:58 GMT
Server: Apache
Age: 83
ETag: "398b815-ecd-54ce5aaa95880"
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Cache-Control: no-store,must-revalidate
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=99
Content-Length: 3789
Expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H/1.1 200
OK TMobile_Background_Web.jpg
workspace35.t-mobile.com/logon/themes/Default/custom_media/ 115 KB
116 KB 131ms
131ms Image
image/jpeg 208.54.116.197
T-MOBILE-AS21928

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://workspace35.t-mobile.com/logon/themes/Default/custom_media/TMobile_Background_Web.jpg

Requested by

Host: t-mobile-ticket.co
URL: https://t-mobile-ticket.co/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

208.54.116.197 , United States, ASN21928 (T-MOBILE-AS21928, US),

Reverse DNS

Software

Apache /

Resource Hash

ee96581381cd6b5cafefb9f2d2cc77be78d7e769c9fcd7aa083468e43087ba93

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://workspace35.t-mobile.com/logon/themes/Default/css/custom.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 23 Jul 2020 21:01:00 GMT
Via: NS-CACHE-10.0: 1
Last-Modified: Tue, 11 Apr 2017 15:23:09 GMT
Server: Apache
Age: 4
ETag: "398b819-1cce8-54ce5ab513140"
X-Frame-Options: SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: no-store,must-revalidate
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=97
Content-Length: 117992
Expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H/1.1 200
OK header_gradient.png
workspace35.t-mobile.com/vpn/js/rdx/core/css/ 139 KB
139 KB 131ms
131ms Image
image/png 208.54.116.197
T-MOBILE-AS21928

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://workspace35.t-mobile.com/vpn/js/rdx/core/css/header_gradient.png

Requested by

Host: t-mobile-ticket.co
URL: https://t-mobile-ticket.co/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

208.54.116.197 , United States, ASN21928 (T-MOBILE-AS21928, US),

Reverse DNS

Software

Apache /

Resource Hash

1e3ec2f8f39970fa0536478aa80d3b7986c3ec6b02ee0505ae3b90630e68fc52

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://workspace35.t-mobile.com/vpn/js/rdx/core/css/rdx.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 23 Jul 2020 21:00:03 GMT
Via: NS-CACHE-10.0: 1
Last-Modified: Thu, 09 Jul 2020 18:09:39 GMT
Server: Apache
Age: 61
ETag: "6165-22b81-5aa0620b7dec0"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=97
Content-Length: 142209

GET citrixsans_regular.woff
workspace35.t-mobile.com/vpn/js/rdx/core/css/fonts/citrix_sans/ 0
0

GET citrixsans_semibold.woff
workspace35.t-mobile.com/vpn/js/rdx/core/css/fonts/citrix_sans/ 0
0

GET citrixsans_regular.ttf
workspace35.t-mobile.com/vpn/js/rdx/core/css/fonts/citrix_sans/ 0
0

GET citrixsans_semibold.ttf
workspace35.t-mobile.com/vpn/js/rdx/core/css/fonts/citrix_sans/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: workspace35.t-mobile.com
URL: https://workspace35.t-mobile.com/vpn/js/rdx/core/css/fonts/citrix_sans/citrixsans_regular.woff

Domain: workspace35.t-mobile.com
URL: https://workspace35.t-mobile.com/vpn/js/rdx/core/css/fonts/citrix_sans/citrixsans_semibold.woff

Domain: workspace35.t-mobile.com
URL: https://workspace35.t-mobile.com/vpn/js/rdx/core/css/fonts/citrix_sans/citrixsans_regular.ttf

Domain: workspace35.t-mobile.com
URL: https://workspace35.t-mobile.com/vpn/js/rdx/core/css/fonts/citrix_sans/citrixsans_semibold.ttf

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Telekom (Telecommunication)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| changePage function| setFocus

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

t-mobile-ticket.co
workspace35.t-mobile.com
workspace35.t-mobile.com
199.188.205.245
208.54.116.197
13fc4b7a465f3458acaa898b644fca2092fc73ab128a166644ebe56f49debf2a
1e3ec2f8f39970fa0536478aa80d3b7986c3ec6b02ee0505ae3b90630e68fc52
86e7d27908a1e8f073270209229f4f71d57020f7a3b38327665abcfa99681448
87124f6c3518887e888a669e4ae156f8da68d367f59821671d98ac2490f466f1
e01295c44d791b8654d59905bc15226941f6437dfbc4736ee1c20f7f4a2e8506
ee96581381cd6b5cafefb9f2d2cc77be78d7e769c9fcd7aa083468e43087ba93
f512b1c7b49a4d1af362ebd101a2051a6648a7a369a24c52534f38bbc63e1d83

t-mobile-ticket.co Open in urlscan Pro 199.188.205.245 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

11 Requests

55 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

3 IPs

1 Countries

376 kBTransfer

702 kBSize

0 Cookies

1 Outgoing links

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

0 Cookies

Indicators

t-mobile-ticket.co Open in urlscan Pro
199.188.205.245 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

55 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

376 kB
Transfer

702 kB
Size

0
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!