miles-and-more-kartenabrechnug.com
Open in
urlscan Pro
2a00:4b40:aaaa:2009::6
Malicious Activity!
Public Scan
Effective URL: https://miles-and-more-kartenabrechnug.com/login/bd251a7/Sign_in.php
Submission: On September 26 via api from US — Scanned from DE
Summary
TLS certificate: Issued by R10 on September 25th 2024. Valid for: 3 months.
This is the only time miles-and-more-kartenabrechnug.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Lufthansa (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 8 | 2a00:4b40:aaa... 2a00:4b40:aaaa:2009::6 | 51013 (WEBSUPPOR...) (WEBSUPPORT-SRO-SK-AS) | |
3 | 104.17.24.14 104.17.24.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
5 | 37.9.175.196 37.9.175.196 | 51013 (WEBSUPPOR...) (WEBSUPPORT-SRO-SK-AS) | |
15 | 3 |
ASN51013 (WEBSUPPORT-SRO-SK-AS, SK)
miles-and-more-kartenabrechnug.com |
ASN51013 (WEBSUPPORT-SRO-SK-AS, SK)
PTR: ing.r6.websupport.sk
miles-and-more-kartenabrechnug.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
13 |
miles-and-more-kartenabrechnug.com
1 redirects
miles-and-more-kartenabrechnug.com |
171 KB |
3 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 257 |
134 KB |
15 | 2 |
Domain | Requested by | |
---|---|---|
13 | miles-and-more-kartenabrechnug.com |
1 redirects
miles-and-more-kartenabrechnug.com
|
3 | cdnjs.cloudflare.com |
miles-and-more-kartenabrechnug.com
|
15 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
miles-and-more-kartenabrechnug.com R10 |
2024-09-25 - 2024-12-24 |
3 months | crt.sh |
cdnjs.cloudflare.com WE1 |
2024-07-31 - 2024-10-29 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://miles-and-more-kartenabrechnug.com/login/bd251a7/Sign_in.php
Frame ID: 473DBD535A8EF87E45FD39239D4C3AA6
Requests: 15 HTTP requests in this frame
Screenshot
Page Title
Miles and More Online-KartenkontoPage URL History Show full URLs
-
https://miles-and-more-kartenabrechnug.com/login/bd251a7/
HTTP 302
https://miles-and-more-kartenabrechnug.com/login/bd251a7/Sign_in.php Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
AngularJS (JavaScript Frameworks) Expand
Detected patterns
- /([\d.]+(?:-?rc[.\d]*)*)/angular(?:\.min)?\.js
- \bangular.{0,32}\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jQuery UI (JavaScript Libraries) Expand
Detected patterns
- ([\d.]+)/jquery-ui(?:\.min)?\.js
- jquery-ui.*\.js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://miles-and-more-kartenabrechnug.com/login/bd251a7/
HTTP 302
https://miles-and-more-kartenabrechnug.com/login/bd251a7/Sign_in.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
Sign_in.php
miles-and-more-kartenabrechnug.com/login/bd251a7/ Redirect Chain
|
6 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
brand-min.css
miles-and-more-kartenabrechnug.com/login/bd251a7/Folder/ |
374 KB 58 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
miles-and-more-kartenabrechnug.com/login/bd251a7/Folder/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
calc.png
miles-and-more-kartenabrechnug.com/login/bd251a7/Folder/ |
474 B 635 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
angular.min.js
cdnjs.cloudflare.com/ajax/libs/angular.js/1.6.1/ |
162 KB 50 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.1.1/ |
85 KB 27 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery-ui.min.js
cdnjs.cloudflare.com/ajax/libs/jqueryui/1.12.1/ |
248 KB 56 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Login_Teaser_1.jpg
miles-and-more-kartenabrechnug.com/login/bd251a7/Folder/ |
11 KB 12 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Login_Teaser_2.jpg
miles-and-more-kartenabrechnug.com/login/bd251a7/Folder/ |
29 KB 29 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Login_Teaser_3.jpg
miles-and-more-kartenabrechnug.com/login/bd251a7/Folder/ |
18 KB 18 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
miles-and-more-kartenabrechnug.com/login/bd251a7/Folder/ |
184 KB 47 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Time_Online.php
miles-and-more-kartenabrechnug.com/login/bd251a7/Account/request/ |
0 211 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Time_Online.php
miles-and-more-kartenabrechnug.com/login/bd251a7/Account/request/ |
0 163 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Time_Online.php
miles-and-more-kartenabrechnug.com/login/bd251a7/Account/request/ |
0 163 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Time_Online.php
miles-and-more-kartenabrechnug.com/login/bd251a7/Account/request/ |
0 163 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Lufthansa (Transportation)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| noBack object| angular function| $ function| jQuery1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
miles-and-more-kartenabrechnug.com/ | Name: PHPSESSID Value: 377ab5f4120a2656720dd27854538892 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdnjs.cloudflare.com
miles-and-more-kartenabrechnug.com
104.17.24.14
2a00:4b40:aaaa:2009::6
37.9.175.196
00876c3905a9c20877a672fac341a9de88eb72f08883284f2de9eb2a3d4d933d
1e60d6be855b676cf8e219a975668897531b85ab903bf1c493a309ea2b2a0fe3
28ce75d953678c4942df47a11707a15e3c756021cf89090e3e6aa7ad6b6971c3
55925c9223edddf35f6b3c8037045a31999b4d9589ffd808183d287c27c6f452
5f860bda689940395f68c8d2177985332efc38df1add0814a05fe6a5f96d2439
7e6288ccf7d9c98c652ba79e54e14bf0b5f83161625c78b10ed2a21fce3b0adf
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
87be7352a44beb76fe90497c91ef9616bdfc7f7f09ddbc0cbfb1d6ca3abdaf70
941eac851ccd75e43ad4871d499a85fc49d08d21332b99f37cc574db82978cb1
9fe593f72a58398fe5a0bb041bdc1135d0044e959a66d513452561508d836e80
dd2acb8cf7913dad687ccdbcd2bf8e31c52325928b5891ebe9246d46eddd45bd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855