account.x65.de
Open in
urlscan Pro
91.249.154.173
Public Scan
Submitted URL: https://monitoring.x65.de/
Effective URL: https://account.x65.de/user/login/?sso_client_token=BKDd7roURZ4lArPfyDuQJfB5Klndfln6e3dxz7whmxtVWTOXonhtUDcZWSZ7ILjJukE...
Submission Tags: phishingrod
Submission: On August 28 via api from DE — Scanned from DE
Effective URL: https://account.x65.de/user/login/?sso_client_token=BKDd7roURZ4lArPfyDuQJfB5Klndfln6e3dxz7whmxtVWTOXonhtUDcZWSZ7ILjJukE...
Submission Tags: phishingrod
Submission: On August 28 via api from DE — Scanned from DE
Summary
This website contacted 1 IPs
in 2 countries
across 1 domains to perform 11 HTTP transactions.
The main IP is 91.249.154.173, located in
Oldenburg, Germany and
belongs to EWETEL, DE.
The main domain is account.x65.de.
TLS certificate: Issued by R11 on August 17th 2024. Valid for: 3 months.
This is the only time account.x65.de was scanned on urlscan.io!
TLS certificate: Issued by R11 on August 17th 2024. Valid for: 3 months.
This is the only time account.x65.de was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 3 3 | 34.111.69.175 34.111.69.175 | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM) | |
| 11 | 91.249.154.173 91.249.154.173 | 9145 (EWETEL) (EWETEL) | |
| 11 | 1 |
3
34.111.69.175
(Kansas City, United States)
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 175.69.111.34.bc.googleusercontent.com
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 175.69.111.34.bc.googleusercontent.com
| monitoring.x65.de |
11
91.249.154.173
(Oldenburg, Germany)
ASN9145 (EWETEL, DE)
PTR: mail-test.abakuselektronik.com
ASN9145 (EWETEL, DE)
PTR: mail-test.abakuselektronik.com
| account.x65.de |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 14 |
x65.de
3 redirects
monitoring.x65.de account.x65.de |
584 KB |
| 11 | 1 |
| Domain | Requested by | |
|---|---|---|
| 11 | account.x65.de |
account.x65.de
|
| 3 | monitoring.x65.de | 3 redirects |
| 11 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| account.x65.de R11 |
2024-08-17 - 2024-11-15 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://account.x65.de/user/login/?sso_client_token=BKDd7roURZ4lArPfyDuQJfB5Klndfln6e3dxz7whmxtVWTOXonhtUDcZWSZ7ILjJukEK6vXu04YGIXeGKvW6Ow..
Frame ID: 701D62355B6A559D633239EFBBCFB238
Requests: 11 HTTP requests in this frame
Screenshot
Page Title
Account-ServicePage URL History Show full URLs
-
https://monitoring.x65.de/
HTTP 302
https://monitoring.x65.de/dashboard HTTP 302
https://monitoring.x65.de/user/login?backto=L2Rhc2hib2FyZA== HTTP 302
https://account.x65.de/user/login/?sso_client_token=BKDd7roURZ4lArPfyDuQJfB5Klndfln6e3dxz7whmxtVWTO... Page URL
Detected technologies
Bootstrap
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Font Awesome
(Font Scripts)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://monitoring.x65.de/
HTTP 302
https://monitoring.x65.de/dashboard HTTP 302
https://monitoring.x65.de/user/login?backto=L2Rhc2hib2FyZA== HTTP 302
https://account.x65.de/user/login/?sso_client_token=BKDd7roURZ4lArPfyDuQJfB5Klndfln6e3dxz7whmxtVWTOXonhtUDcZWSZ7ILjJukEK6vXu04YGIXeGKvW6Ow.. Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
account.x65.de/user/login/ Redirect Chain
|
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
all.min.css
account.x65.de/thirdparty/components/font-awesome/css/ |
99 KB 22 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bootstrap.min.css
account.x65.de/thirdparty/bootstrap/dist/css/ |
190 KB 27 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bootstrap-icons.css
account.x65.de/thirdparty/bootstrap-icons/font/ |
93 KB 14 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
style.css
account.x65.de/thirdparty/coreui/coreui-free-bootstrap-admin-template/dist/css/ |
335 KB 40 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
user.css
account.x65.de/view/project/user/ |
0 305 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
base.css
account.x65.de/view/project/app/ |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.min.js
account.x65.de/thirdparty/jquery/dist/ |
88 KB 31 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bootstrap.bundle.min.js
account.x65.de/thirdparty/bootstrap/dist/js/ |
79 KB 23 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
free.svg
account.x65.de/thirdparty/coreui/coreui-free-bootstrap-admin-template/dist/vendors/@coreui/icons/svg/ |
409 KB 409 KB |
Other
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
favicon.ico
account.x65.de/ |
15 KB 15 KB |
Other
image/vnd.microsoft.icon |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery number| uidEvent object| bootstrap2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| monitoring.x65.de/ | Name: SESSION-80 Value: 4d396bc3169c429d46be9452fd65b7ad |
|
| account.x65.de/ | Name: SESSION-80 Value: fa570843abe615e4ef303e62bf67df9f |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
account.x65.de
monitoring.x65.de
34.111.69.175
91.249.154.173
01b035efb5dfa529c512f82962ed633328222da6f33c224244806d4798c67349
2721f2e4223ceaf49679dfc834168bbd1e4be46a142155aa8f5acf5872aa4b42
4f7ccfb020c996ddc1182a2ee02fcc1be535bfffcf1b416ffb826dcf9e1506aa
69ba22f690d41132ceed045b7330412ca3b9f234c5b58e65d06ec9f9a8cd7a48
9520018fa5d81f4e4dc9d06afb576f90cbbaba209cfcc6cb60e1464647f7890b
a6bddb68eda3d2c47d89ea52c52f0eb4a73167d7f4162a8ab5f9dc8b27e68956
a6f3f0faea4b3d48e03176341bef0ed3151ffbf226d4c6635f1c6039c0500575
c0bcf7898fdc3b87babca678cd19a8e3ef570e931c80a3afbffcc453738c951a
ddb994f8d7ad0ff5234ff1ae626cc9ef052b0620f13cda25bf9a53d2614286df
e1172d3a0a208cf01dc066f0abeaf17f00264a966159a69f71947d6edcd4935f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855