storewatch-tmobile.com Open in urlscan Pro
91.215.85.79 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://storewatch-tmobile.com/signin.php
Submission: On September 23 via manual (September 23rd 2024, 4:39:02 am UTC) from AU — Scanned from AU

Summary HTTP 4 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 4 HTTP transactions. The main IP is 91.215.85.79, located in Russian Federation and belongs to PROSPERO-AS, RU. The main domain is storewatch-tmobile.com.
TLS certificate: Issued by R11 on August 20th 2024. Valid for: 3 months.

This is the only time storewatch-tmobile.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Telekom (Telecommunication)

Domain & IP information

	IP Address	AS Autonomous System
1	91.215.85.79 91.215.85.79	200593 (PROSPERO-AS) (PROSPERO-AS)
1	151.101.130.137 151.101.130.137	54113 (FASTLY) (FASTLY)
2	65.8.33.2 65.8.33.2	16509 (AMAZON-02) (AMAZON-02)
4	4

1 91.215.85.79 (Russian Federation)

ASN200593 (PROSPERO-AS, RU)

storewatch-tmobile.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.130.137 (San Francisco, United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 65.8.33.2 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-8-33-2.mel50.r.cloudfront.net

ok5static.oktacdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	oktacdn.com ok5static.oktacdn.com — Cisco Umbrella Rank: 21151	8 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 794	30 KB
1	storewatch-tmobile.com storewatch-tmobile.com	437 KB
4	3

	Domain	Requested by
2	ok5static.oktacdn.com	storewatch-tmobile.com
1	code.jquery.com	storewatch-tmobile.com
1	storewatch-tmobile.com
4	3

This site contains links to these domains. Also see Links.

Domain
metropcs.service-now.com
t-mobile.okta.com
www.okta.com

Subject Issuer	Validity	Valid
*.storewatch-tmobile.com R11	`2024-08-20` - `2024-11-18`	3 months	crt.sh
*.jquery.com Sectigo ECC Domain Validation Secure Server CA	`2024-06-25` - `2025-06-25`	a year	crt.sh
*.oktacdn.com DigiCert TLS RSA SHA256 2020 CA1	`2023-12-15` - `2025-01-02`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://storewatch-tmobile.com/signin.php
Frame ID: ACA940C3279B7624B235E391BB49D5A2
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

T-Mobile USA - Sign In

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

4
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

518 kB
Transfer

1317 kB
Size

0
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://metropcs.service-now.com/
Title: GC-Metro ID Reset/Unlock

Search URL Search Domain Scan URL

URL: https://t-mobile.okta.com/help/login
Title: Help

Search URL Search Domain Scan URL

URL: http://www.okta.com/
Title: Okta

Search URL Search Domain Scan URL

URL: https://t-mobile.okta.com/privacy
Title: Privacy Policy

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
5 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request signin.php Show response
storewatch-tmobile.com/ 810 KB
437 KB 3454ms
2430ms Document
text/html 91.215.85.79
PROSPERO-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://storewatch-tmobile.com/signin.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 91.215.85.79 , Russian Federation, ASN200593 (PROSPERO-AS, RU),
Reverse DNS
Software: /
Resource Hash: 7e09718dee8d842caeb93e3a17ead0fcf0cc81ae29b1dfe24624d04fc2da40c1

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding: br
content-type: text/html; charset=UTF-8
date: Mon, 23 Sep 2024 04:38:56 GMT
vary: Accept-Encoding

GET
H2 200 jquery-3.7.0.min.js Show response
code.jquery.com/ 85 KB
30 KB 14ms
2ms Script
application/javascript 151.101.130.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.7.0.min.js
Requested by: Host: storewatch-tmobile.com
URL: https://storewatch-tmobile.com/signin.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.130.137 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: d8f9afbf492e4c139e9d2bcb9ba6ef7c14921eb509fb703bc7a3f911b774eff8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://storewatch-tmobile.com
Referer: https://storewatch-tmobile.com/

Response headers

content-encoding: gzip
etag: W/"28feccc0-155a6"
age: 4574888
x-cache: HIT, HIT
date: Mon, 23 Sep 2024 04:38:57 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
x-cache-hits: 54060, 29128
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
x-served-by: cache-lga21977-LGA, cache-syd10172-SYD
cache-control: public, max-age=31536000, stale-while-revalidate=604800
x-timer: S1727066338.786367,VS0,VE0
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 30308
server: nginx

GET
H2 200 fs01fnbx6kOAMFx2g297
ok5static.oktacdn.com/fs/bco/4/ 1 KB
2 KB 954ms
703ms Image
image/png 65.8.33.2
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ok5static.oktacdn.com/fs/bco/4/fs01fnbx6kOAMFx2g297

Requested by

Host: storewatch-tmobile.com
URL: https://storewatch-tmobile.com/signin.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

65.8.33.2 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-65-8-33-2.mel50.r.cloudfront.net

Software

nginx /

Resource Hash

d3568ffab0bf6851259909b9ae492e1784184dc201c0038f98ffcdffb54aed72

Security Headers

Name	Value
Strict-Transport-Security	max-age=315360000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://storewatch-tmobile.com/

Response headers

strict-transport-security: max-age=315360000; includeSubDomains
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
etag: "e7dcde43ed8f0a7232cb265f8f0a847e"
via: 1.1 a3da61174db66bd312419bc500e07018.cloudfront.net (CloudFront)
expires: Tue, 23 Sep 2025 04:38:58 GMT
accept-ranges: bytes
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 1340
x-amz-cf-id: A23BzKj4Fv8y9DtbiM7botgA4Yi8_sxNq-oBMFPRGYThTxXpXmYRLw==
date: Mon, 23 Sep 2024 04:38:58 GMT
content-type: image/png
last-modified: Wed, 07 Aug 2019 00:17:58 GMT
server: nginx
x-amz-cf-pop: MEL50-C2

GET
H2 200 fs08dibx65I2cAW47297
ok5static.oktacdn.com/fs/bco/1/ 6 KB
6 KB 266ms
15ms Image
image/png 65.8.33.2
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ok5static.oktacdn.com/fs/bco/1/fs08dibx65I2cAW47297

Requested by

Host: storewatch-tmobile.com
URL: https://storewatch-tmobile.com/signin.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

65.8.33.2 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-65-8-33-2.mel50.r.cloudfront.net

Software

nginx /

Resource Hash

323832cd46da88a59e1dd959855a45d13ddad09e34380f2276e6cb6299d29975

Security Headers

Name	Value
Strict-Transport-Security	max-age=315360000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://storewatch-tmobile.com/

Response headers

etag: "bbdf23f20b5051b10a72d81eccfa36de"
age: 459251
expires: Wed, 17 Sep 2025 21:04:47 GMT
x-cache: Hit from cloudfront
x-amz-cf-id: cDxBeJiDs8CWp9zC90UB1TfskH1fTkuflbVd2WyUkQtTXCcnK3NbDQ==
date: Tue, 17 Sep 2024 21:04:47 GMT
content-type: image/png
last-modified: Fri, 21 May 2021 01:29:55 GMT
strict-transport-security: max-age=315360000; includeSubDomains
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
via: 1.1 a3da61174db66bd312419bc500e07018.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 5712
x-amz-cf-pop: MEL50-C2
server: nginx

GET
DATA 200
OK truncated
/ 6 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 323832cd46da88a59e1dd959855a45d13ddad09e34380f2276e6cb6299d29975

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 363 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 107b8978e9fac8368bb26def167dea137f1afe3fa97356e3e7bcbb087833ce00

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 22 KB
22 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: feb177fb563f478cb8ecade71caea5df5ad318ca161c71875114e504ce304ace

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://storewatch-tmobile.com
Referer

Response headers

Content-Type: application/font-woff

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 40810b0318131f9ba52c83a17e633a0ac476ade66ea8a914d6c4980571397665

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 21 KB
21 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1d5325892ecf2dc3abd0caf2a1ef4eabf2477e2937c9a372760fd2acae8fddf3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://storewatch-tmobile.com
Referer

Response headers

Content-Type: application/font-woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Telekom (Telecommunication)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
ok5static.oktacdn.com
storewatch-tmobile.com
151.101.130.137
65.8.33.2
91.215.85.79
107b8978e9fac8368bb26def167dea137f1afe3fa97356e3e7bcbb087833ce00
1d5325892ecf2dc3abd0caf2a1ef4eabf2477e2937c9a372760fd2acae8fddf3
323832cd46da88a59e1dd959855a45d13ddad09e34380f2276e6cb6299d29975
40810b0318131f9ba52c83a17e633a0ac476ade66ea8a914d6c4980571397665
7e09718dee8d842caeb93e3a17ead0fcf0cc81ae29b1dfe24624d04fc2da40c1
d3568ffab0bf6851259909b9ae492e1784184dc201c0038f98ffcdffb54aed72
d8f9afbf492e4c139e9d2bcb9ba6ef7c14921eb509fb703bc7a3f911b774eff8
feb177fb563f478cb8ecade71caea5df5ad318ca161c71875114e504ce304ace

storewatch-tmobile.com Open in urlscan Pro 91.215.85.79 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

4 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

4 IPs

2 Countries

518 kBTransfer

1317 kBSize

0 Cookies

4 Outgoing links

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 5 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

13 JavaScript Global Variables

0 Cookies

Indicators

storewatch-tmobile.com Open in urlscan Pro
91.215.85.79 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

518 kB
Transfer

1317 kB
Size

0
Cookies

4 HTTP transactions
5 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!