exchange.add-solution.de
Open in
urlscan Pro
62.176.232.218
Malicious Activity!
Public Scan
Submitted URL: http://exchange.add-solution.de/ecp/ecp_ocbcadejsm_form/ecp_ocbcadejsm_form
Effective URL: https://exchange.add-solution.de/ecp_ocbcadejsm_form?L2VjcC9lY3Bfb2NiY2FkZWpzbV9mb3JtL2VjcF9vY2JjYWRlanNtX2Zvcm0=
Submission: On December 18 via automatic, source openphish — Scanned from DE
Effective URL: https://exchange.add-solution.de/ecp_ocbcadejsm_form?L2VjcC9lY3Bfb2NiY2FkZWpzbV9mb3JtL2VjcF9vY2JjYWRlanNtX2Zvcm0=
Submission: On December 18 via automatic, source openphish — Scanned from DE
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 6 HTTP transactions.
The main IP is 62.176.232.218, located in
Wolfsburg, Germany and
belongs to WOBCOM Wobcom GmbH, DE.
The main domain is exchange.add-solution.de.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on April 21st 2024. Valid for: a year.
This is the only time exchange.add-solution.de was scanned on urlscan.io!
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on April 21st 2024. Valid for: a year.
This is the only time exchange.add-solution.de was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Outlook Web Access (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 3 9 | 62.176.232.218 62.176.232.218 | 9136 (WOBCOM Wo...) (WOBCOM Wobcom GmbH) | |
| 6 | 1 |
9
62.176.232.218
(Wolfsburg, Germany)
ASN9136 (WOBCOM Wobcom GmbH, DE)
PTR: customer-pool1-218.wobline-ip.de
ASN9136 (WOBCOM Wobcom GmbH, DE)
PTR: customer-pool1-218.wobline-ip.de
| exchange.add-solution.de |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 9 |
add-solution.de
3 redirects
exchange.add-solution.de |
32 KB |
| 6 | 1 |
| Domain | Requested by | |
|---|---|---|
| 9 | exchange.add-solution.de |
3 redirects
exchange.add-solution.de
|
| 6 | 1 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| *.add-solution.de Sectigo RSA Domain Validation Secure Server CA |
2024-04-21 - 2025-05-22 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://exchange.add-solution.de/ecp_ocbcadejsm_form?L2VjcC9lY3Bfb2NiY2FkZWpzbV9mb3JtL2VjcF9vY2JjYWRlanNtX2Zvcm0=
Frame ID: 5530A166F470A1BE99804E7217649475
Requests: 6 HTTP requests in this frame
Screenshot
Page Title
Outlook WebAppPage URL History Show full URLs
-
http://exchange.add-solution.de/ecp/ecp_ocbcadejsm_form/ecp_ocbcadejsm_form
HTTP 307
https://exchange.add-solution.de/ecp/ecp_ocbcadejsm_form/ecp_ocbcadejsm_form HTTP 302
https://exchange.add-solution.de/ecp_ocbcadejsm_form?L2VjcC9lY3Bfb2NiY2FkZWpzbV9mb3JtL2VjcF9vY2JjYWRlanNtX2Zv... Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://exchange.add-solution.de/ecp/ecp_ocbcadejsm_form/ecp_ocbcadejsm_form
HTTP 307
https://exchange.add-solution.de/ecp/ecp_ocbcadejsm_form/ecp_ocbcadejsm_form HTTP 302
https://exchange.add-solution.de/ecp_ocbcadejsm_form?L2VjcC9lY3Bfb2NiY2FkZWpzbV9mb3JtL2VjcF9vY2JjYWRlanNtX2Zvcm0= Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 4- https://exchange.add-solution.de/favicon.ico HTTP 302
- https://exchange.add-solution.de/owa/favicon.ico?s=BAD6EE0B2F0E6E084A42B96D89C1AB6C6AC21E2A HTTP 302
- https://exchange.add-solution.de/owa_ocbcadejsm_form?L293YS9mYXZpY29uLmljbz8=
6 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
ecp_ocbcadejsm_form
exchange.add-solution.de/ Redirect Chain
|
3 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
styles_responsive.css
exchange.add-solution.de/REF_RevAutExchangOtp/ |
78 KB 14 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
olk_logo_white.png
exchange.add-solution.de/REF_RevAutExchangOtp/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logo.png
exchange.add-solution.de/REF_RevAutExchangOtp/ |
10 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Sign_in_arrow.png
exchange.add-solution.de/REF_RevAutExchangOtp/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
owa_ocbcadejsm_form
exchange.add-solution.de/ Redirect Chain
|
3 KB 1 KB |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Outlook Web Access (Online)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| window_onload function| checkSubmit function| SubmitForm0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
exchange.add-solution.de
62.176.232.218
07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7
453359ea8a714667f2237ff2951da0e1c360ac0ed017dfacfe38573589d5af80
4ca8c8e6e02f07dce8259eba1498b0c32927062e323abbc23b6911d2924b6b1e
7c9b1fdee5abb849c8ed9a2218673feb4ba476c0a0091c8353ce4594b3da9691
959e58279a99e4cc1e75675f8decd42248da989fc9c2b49e20551e12be04186f
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b