securedsupport.dyndns.dk
Open in
urlscan Pro
3.135.194.37
Malicious Activity!
Public Scan
Effective URL: https://securedsupport.dyndns.dk/read/login.php?signin=3a52f3c22ed6fcde5bf696a6c02c9e73&auth=cef25db1762bbca5320509ca26b15d0bd950...
Submission: On June 11 via manual from DE
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on June 4th 2020. Valid for: 3 months.
This is the only time securedsupport.dyndns.dk was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Telekom (Telecommunication)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 8 | 3.135.194.37 3.135.194.37 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2a02:cbf7:1:0... 2a02:cbf7:1:0:62:138:239:59 | 61157 (PLUSSERVE...) (PLUSSERVER-ASN1) | |
8 | 2 |
ASN16509 (AMAZON-02, US)
PTR: ec2-3-135-194-37.us-east-2.compute.amazonaws.com
securedsupport.dyndns.dk |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
dyndns.dk
1 redirects
securedsupport.dyndns.dk |
100 KB |
1 |
t-online.de
p.t-online.de |
|
8 | 2 |
Domain | Requested by | |
---|---|---|
8 | securedsupport.dyndns.dk |
1 redirects
securedsupport.dyndns.dk
|
1 | p.t-online.de |
securedsupport.dyndns.dk
|
8 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
meinkonto.telekom-dienste.de |
www.telekom.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
securedsupport.dyndns.dk cPanel, Inc. Certification Authority |
2020-06-04 - 2020-09-02 |
3 months | crt.sh |
p.t-online.de DigiCert Global CA G2 |
2019-07-09 - 2021-07-09 |
2 years | crt.sh |
This page contains 2 frames:
Primary Page:
https://securedsupport.dyndns.dk/read/login.php?signin=3a52f3c22ed6fcde5bf696a6c02c9e73&auth=cef25db1762bbca5320509ca26b15d0bd950ac59d48263f7d3dd6d4d6ce35ff813942c96&login=
Frame ID: 51C0334F689AF72B1D314C1034BA2B00
Requests: 7 HTTP requests in this frame
Frame:
https://p.t-online.de/email/sam3-login-ivw.html?page=login&mode=web&context=auth&status=first_attempt
Frame ID: 4AD2DF7F7205732169BCB5B210EC150E
Requests: 1 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://securedsupport.dyndns.dk/read/
HTTP 303
https://securedsupport.dyndns.dk/read/login.php?signin=3a52f3c22ed6fcde5bf696a6c02c9e73&auth=cef25db1762bbca5... Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
Title: Registrieren
Search URL Search Domain Scan URL
Title: Impressum
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://securedsupport.dyndns.dk/read/
HTTP 303
https://securedsupport.dyndns.dk/read/login.php?signin=3a52f3c22ed6fcde5bf696a6c02c9e73&auth=cef25db1762bbca5320509ca26b15d0bd950ac59d48263f7d3dd6d4d6ce35ff813942c96&login= Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
8 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
login.php
securedsupport.dyndns.dk/read/ Redirect Chain
|
6 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
web_lazy_font.min.css
securedsupport.dyndns.dk/read/static/css/ |
10 KB 10 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login-information-bubble.min.js
securedsupport.dyndns.dk/read/static/jscript/ |
1 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sam3-login-ivw.html
p.t-online.de/email/ Frame 4AD2 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bg-header-web.png
securedsupport.dyndns.dk/read/static/css/images/web/ |
98 B 338 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo_short_50x25.png
securedsupport.dyndns.dk/read/static/css/images/ |
310 B 552 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icons_16x16.png
securedsupport.dyndns.dk/read/static/images/sprites/ |
431 B 672 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
TeleGroteskNormal.woff
securedsupport.dyndns.dk/read/static/css/fonts/ |
80 KB 81 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Telekom (Telecommunication)7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| idm_stopEvent function| idm_attachEvent function| registerEventHandler function| smartFocus function| handleLoginSubmition1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
securedsupport.dyndns.dk/ | Name: PHPSESSID Value: 4e065b528aabbfc6d50f30a85a7fedec |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
p.t-online.de
securedsupport.dyndns.dk
2a02:cbf7:1:0:62:138:239:59
3.135.194.37
1231d3e9332fe1c9c7de77a135baacf2de017e7949876529b5105aae5f51ee31
419bf2f4f4f833e2dc27e13167c8be728b59fa2a20400df58ff8a32d974eba55
5a1e69517c76c1fda68cff8b3b6fb6b7773a4b75932684b72b0a23325b14c5fd
c51918b2e8a90ec12f396f1fbda614322033a6897a6812c58233f8ad4d4e1c2a
d3e265d4d627dd0b69d1af5846b15863c85a2eea8f7f15dcf4a37ea10a55b9cb
e6ec6456b73e851bc7dca0ea35513f36da9be07c92e4aac61485bf7ef674dc84
f01cc09c1caa77810d0a5315f5d3f1129713bed386269fd71543a08e151bf2af