piscinaveronza.com
Open in
urlscan Pro
2001:8d8:100f:f000::2de
Malicious Activity!
Public Scan
Submitted URL: https://piscinaveronza.com/app/online/mrc/tl
Effective URL: https://piscinaveronza.com/app/online/mrc/tl/tekm.html
Submission: On May 25 via automatic, source openphish — Scanned from DE
Effective URL: https://piscinaveronza.com/app/online/mrc/tl/tekm.html
Submission: On May 25 via automatic, source openphish — Scanned from DE
Summary
This website contacted 5 IPs
in 2 countries
across 5 domains to perform 25 HTTP transactions.
The main IP is 2001:8d8:100f:f000::2de, located in
Germany and
belongs to IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE.
The main domain is piscinaveronza.com.
TLS certificate: Issued by Encryption Everywhere DV TLS CA - G2 on May 27th 2023. Valid for: a year.
This is the only time piscinaveronza.com was scanned on urlscan.io!
TLS certificate: Issued by Encryption Everywhere DV TLS CA - G2 on May 27th 2023. Valid for: a year.
This is the only time piscinaveronza.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Telekom (Telecommunication)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 13 | 2001:8d8:100f... 2001:8d8:100f:f000::2de | 8560 (IONOS-AS ...) (IONOS-AS This is the joint network for IONOS) | |
| 1 1 | 2a00:cd0:104d... 2a00:cd0:104d:1:80:82:200:32 | 48173 (UNBELIEVA...) (UNBELIEVABLE-AS) | |
| 1 | 3.248.164.102 3.248.164.102 | 16509 (AMAZON-02) (AMAZON-02) | |
| 1 | 2a04:d280:2::52 2a04:d280:2::52 | 60164 (WEBTREKK-AS) (WEBTREKK-AS) | |
| 10 | 62.157.140.200 62.157.140.200 | 3320 (DTAG Inte...) (DTAG Internet service provider operations) | |
| 25 | 5 |
13
2001:8d8:100f:f000::2de
(Germany)
ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE)
ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE)
| piscinaveronza.com |
1
3.248.164.102
(Dublin, Ireland)
ASN16509 (AMAZON-02, US)
PTR: ec2-3-248-164-102.eu-west-1.compute.amazonaws.com
ASN16509 (AMAZON-02, US)
PTR: ec2-3-248-164-102.eu-west-1.compute.amazonaws.com
| lns-ev.xplosion.de |
10
62.157.140.200
(Bochum, Germany)
ASN3320 (DTAG Internet service provider operations, DE)
PTR: accounts.login.idm.telekom.com
ASN3320 (DTAG Internet service provider operations, DE)
PTR: accounts.login.idm.telekom.com
| accounts.login.idm.telekom.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 13 |
piscinaveronza.com
1 redirects
piscinaveronza.com |
328 KB |
| 10 |
telekom.com
accounts.login.idm.telekom.com — Cisco Umbrella Rank: 67096 |
|
| 1 |
telekom.de
pix.telekom.de — Cisco Umbrella Rank: 132755 |
538 B |
| 1 |
xplosion.de
lns-ev.xplosion.de — Cisco Umbrella Rank: 442222 |
338 B |
| 1 |
xdn-ttp.de
1 redirects
xdn-ttp.de — Cisco Umbrella Rank: 447725 |
464 B |
| 25 | 5 |
| Domain | Requested by | |
|---|---|---|
| 13 | piscinaveronza.com |
1 redirects
piscinaveronza.com
|
| 10 | accounts.login.idm.telekom.com |
piscinaveronza.com
|
| 1 | pix.telekom.de |
piscinaveronza.com
|
| 1 | lns-ev.xplosion.de |
piscinaveronza.com
|
| 1 | xdn-ttp.de | 1 redirects |
| 25 | 5 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.telekom.de |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| *.piscinaveronza.com Encryption Everywhere DV TLS CA - G2 |
2023-05-27 - 2024-06-10 |
a year | crt.sh |
| pix.telekom.de Telekom Security ServerID OV Class 2 CA |
2023-07-14 - 2024-07-18 |
a year | crt.sh |
| accounts.login.idm.telekom.com Telekom Security ServerID EV Class 3 CA |
2023-07-27 - 2024-07-31 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://piscinaveronza.com/app/online/mrc/tl/tekm.html
Frame ID: BC3A4C92B330F90C92F99F88092509B7
Requests: 25 HTTP requests in this frame
Screenshot
Page Title
Telekom LoginPage URL History Show full URLs
-
https://piscinaveronza.com/app/online/mrc/tl
HTTP 301
https://piscinaveronza.com/app/online/mrc/tl/ Page URL
- https://piscinaveronza.com/app/online/mrc/tl/tekm.html Page URL
Detected technologies
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
5 Outgoing links
These are links going to different origins than the main page.
URL: https://www.telekom.de/hilfe/vertrag-meine-daten/login-daten-passwoerter
Title: Benötigen Sie Hilfe?
Title: Benötigen Sie Hilfe?
Search URL Search Domain Scan URL
URL: https://www.telekom.de/unterwegs/apps-und-dienste/kommunikation/telekom-e-mail
Title: Telekom Login erstellen
Title: Telekom Login erstellen
Search URL Search Domain Scan URL
URL: https://www.telekom.de/hilfe/vertrag-meine-daten/login-daten-passwoerter/verimi
Title: Hier informieren über VERIMI
Title: Hier informieren über VERIMI
Search URL Search Domain Scan URL
URL: https://www.telekom.de/start/impressum
Title: Impressum
Title: Impressum
Search URL Search Domain Scan URL
URL: https://www.telekom.de/datenschutz-ganz-einfach
Title: Datenschutz
Title: Datenschutz
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://piscinaveronza.com/app/online/mrc/tl
HTTP 301
https://piscinaveronza.com/app/online/mrc/tl/ Page URL
- https://piscinaveronza.com/app/online/mrc/tl/tekm.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://piscinaveronza.com/app/online/mrc/tl HTTP 301
- https://piscinaveronza.com/app/online/mrc/tl/
- https://xdn-ttp.de/lns/import-event-0746?zid=de9f70e2-859f-47ec-b2f9-f8856bcab2ef HTTP 302
- https://lns-ev.xplosion.de/xdn-import/import-event?zid=de9f70e2-859f-47ec-b2f9-f8856bcab2ef&partner=0746
25 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
/
piscinaveronza.com/app/online/mrc/tl/ Redirect Chain
|
66 B 269 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
Primary Request
tekm.html
piscinaveronza.com/app/online/mrc/tl/ |
10 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
favicon.ico
piscinaveronza.com/ |
4 KB 2 KB |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
components.min.css
piscinaveronza.com/app/online/accounts.login.idm.telekom.com/oauth2/static/factorx/vdplus/css/ |
99 KB 99 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
login-21.00.0.css
piscinaveronza.com/app/online/accounts.login.idm.telekom.com/oauth2/static/factorx/vdplus/css/ |
15 KB 15 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery-3.2.1.min.js
piscinaveronza.com/app/online/accounts.login.idm.telekom.com/oauth2/static/factorx/vdplus/js/ |
85 KB 85 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery-matchheight-0.7.2.min.js
piscinaveronza.com/app/online/accounts.login.idm.telekom.com/oauth2/static/factorx/vdplus/js/ |
3 KB 3 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
components.min.js
piscinaveronza.com/app/online/accounts.login.idm.telekom.com/oauth2/static/factorx/vdplus/js/ |
76 KB 76 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
login.js
piscinaveronza.com/app/online/accounts.login.idm.telekom.com/oauth2/static/factorx/vdplus/js/ |
13 KB 13 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
t-online-logo-29112019.png
piscinaveronza.com/app/online/login.t-online.de/stats/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
services.png
piscinaveronza.com/app/online/accounts.login.idm.telekom.com/oauth2/static/factorx/vdplus/images/ |
22 KB 22 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
import-event
lns-ev.xplosion.de/xdn-import/ Redirect Chain
|
0 338 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
wt
pix.telekom.de/196380495960676/ |
43 B 538 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
teleicon-outline.woff
accounts.login.idm.telekom.com/oauth2/static/factorx/vdplus/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
telegroteskscreen-ultra.woff
accounts.login.idm.telekom.com/oauth2/static/factorx/vdplus/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
telegroteskscreen-thin.woff
accounts.login.idm.telekom.com/oauth2/static/factorx/vdplus/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
telegroteskscreen-regular.woff
accounts.login.idm.telekom.com/oauth2/static/factorx/vdplus/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
data_protection.svg
accounts.login.idm.telekom.com/static/factorx/vdplus/images/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
teleicon-ui.woff
accounts.login.idm.telekom.com/oauth2/static/factorx/vdplus/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
telegroteskscreen-ultra.ttf
accounts.login.idm.telekom.com/oauth2/static/factorx/vdplus/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
teleicon-outline.ttf
accounts.login.idm.telekom.com/oauth2/static/factorx/vdplus/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
telegroteskscreen-regular.ttf
accounts.login.idm.telekom.com/oauth2/static/factorx/vdplus/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
telegroteskscreen-thin.ttf
accounts.login.idm.telekom.com/oauth2/static/factorx/vdplus/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
teleicon-ui.ttf
accounts.login.idm.telekom.com/oauth2/static/factorx/vdplus/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
favicon.ico
piscinaveronza.com/ |
4 KB 2 KB |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- accounts.login.idm.telekom.com
- URL
- https://accounts.login.idm.telekom.com/static/factorx/vdplus/images/data_protection.svg
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Telekom (Telecommunication)7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| accountLocked boolean| accountLockedPermanent number| accountLockExpiration boolean| loginFailed function| $ function| jQuery object| Login2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| .telekom.de/ | Name: wteid_196380495960676 Value: 4171664372900729184 |
|
| .telekom.de/ | Name: wtsid_196380495960676 Value: 1 |
12 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
| Header | Value |
|---|---|
| Strict-Transport-Security | max-age=31536000; includeSubDomains |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
accounts.login.idm.telekom.com
lns-ev.xplosion.de
piscinaveronza.com
pix.telekom.de
xdn-ttp.de
accounts.login.idm.telekom.com
2001:8d8:100f:f000::2de
2a00:cd0:104d:1:80:82:200:32
2a04:d280:2::52
3.248.164.102
62.157.140.200
11eed36ec8f3c28fd90958d9881d080cf237ab18d6792dd22785e729f06795ba
14977cb7057352ad7715b93dec52f4993fc16980836d03b64f79566e8c9bec22
308cfb9255c7076eabded4740665d9f8a1f39d4d5b501ad8b6caecf44d61e8ad
42d274b3c3f7c6565c2f3cc9b009770f143ceca121b91bc25f844f7040f18c94
4f45d9883e3e19f7eaf72e99e614335bf13d68446a9a09a6cd777940ad9597da
6ebd3995a2d04fc1550f8d025400411954fdb51dcaa24def899d8fc33b2504a7
7075e2661e99afcd67f6ab7b51fd779a2d9fa656efd2c70a39601fac8bae25c8
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
c2a62c24cddee7956c48d9085876a63d9398555e66f75aabd0adbde3e0593617
d03239e8bc23b7cbfaec947904c0aca3302964363e3174f202220abd86fe73fb
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fd625226a3e59887e9ed354c63375a18c78af832f0a073acd22025768f841220