208.54.142.197
Open in
urlscan Pro
208.54.142.197
Malicious Activity!
Public Scan
Submission: On February 05 via manual from CZ
Summary
TLS certificate: Issued by Entrust Certification Authority - L1K on November 7th 2019. Valid for: a year.
This is the only time 208.54.142.197 was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Telekom (Telecommunication)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
20 | 208.54.142.197 208.54.142.197 | 21928 (T-MOBILE-...) (T-MOBILE-AS21928) | |
1 | 18.208.22.38 18.208.22.38 | 14618 (AMAZON-AES) (AMAZON-AES) | |
21 | 2 |
ASN14618 (AMAZON-AES, US)
PTR: ec2-18-208-22-38.compute-1.amazonaws.com
userservices.vip.symantec.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
1 |
symantec.com
userservices.vip.symantec.com |
353 KB |
21 | 1 |
Domain | Requested by | |
---|---|---|
1 | userservices.vip.symantec.com |
208.54.142.197
|
21 | 1 |
This site contains links to these domains. Also see Links.
Domain |
---|
passwordreset.t-mobile.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
workspace35px.euv01.t-mobile.com Entrust Certification Authority - L1K |
2019-11-07 - 2020-11-08 |
a year | crt.sh |
userservices.vip.symantec.com DigiCert SHA2 Secure Server CA |
2020-01-10 - 2022-01-09 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://208.54.142.197/vpn/index.html
Frame ID: 811425B3CE26503BE59BE346862B550E
Requests: 21 HTTP requests in this frame
1 Outgoing links
These are links going to different origins than the main page.
Title: Click here to reset your password.
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
21 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
Cookie set
index.html
208.54.142.197/vpn/ |
5 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
rdx.css
208.54.142.197/vpn/js/rdx/core/css/ |
397 KB 73 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
base.css
208.54.142.197/logon/themes/Default/css/ |
35 KB 36 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
citrix-fonts.css
208.54.142.197/logon/fonts/ |
5 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
custom.css
208.54.142.197/logon/themes/Default/css/ |
4 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
rdx.js
208.54.142.197/vpn/js/ |
3 MB 762 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login.js
208.54.142.197/vpn/ |
3 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
views.js
208.54.142.197/vpn/js/ |
6 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
gateway_login_view.js
208.54.142.197/vpn/js/ |
4 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
gateway_login_form_view.js
208.54.142.197/vpn/js/ |
8 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
resources.js
208.54.142.197/vpn/ |
19 KB 19 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
nsshare.js
208.54.142.197/vpn/ |
24 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
vip
userservices.vip.symantec.com/vipuserservices/resources/js/v_1_0/ |
352 KB 353 KB |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
TMobile_Background_Web.jpg
208.54.142.197/logon/themes/Default/custom_media/ |
115 KB 116 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
config.xml
208.54.142.197/logon/themes/EULA/resources/ |
270 B 761 B |
XHR
application/xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
en.xml
208.54.142.197/logon/themes/EULA/resources/ |
819 B 1 KB |
XHR
application/xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
header_gradient.png
208.54.142.197/vpn/js/rdx/core/css/ |
139 KB 139 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
citrixsans_regular.woff
208.54.142.197/vpn/js/rdx/core/css/fonts/citrix_sans/ |
26 KB 26 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
config.xml
208.54.142.197/logon/themes/Default/resources/ |
270 B 761 B |
XHR
application/xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
en.xml
208.54.142.197/logon/themes/Default/resources/ |
50 KB 51 KB |
XHR
application/xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
citrixsans_semibold.woff
208.54.142.197/vpn/js/rdx/core/css/fonts/citrix_sans/ |
26 KB 26 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Telekom (Telecommunication)142 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate object| lastTap boolean| tapValid object| tapTimeout function| cancelTap boolean| rightClickPending object| rightClickEvent object| holdTimeout boolean| cancelMouseUp function| cancelHold function| startHold function| doRightClick function| iPadTouchStart function| iPadTouchHandler boolean| _canLog function| _log function| logMsg function| getDynaTreePersistData number| DTNodeStatus_Error number| DTNodeStatus_Loading number| DTNodeStatus_Ok object| jvm object| rdx function| saveAs string| search_tooltip_learn_more_content function| $ function| jQuery object| Highcharts object| HighchartsAdapter object| jsBezier object| jsPlumbUtil object| jsPlumbAdapter function| jsPlumbUIComponent function| OverlayCapableJsPlumbUIComponent function| jsPlumbInstance object| jsPlumb function| CanvasMouseAdapter function| CanvasComponent function| SvgEndpoint function| VmlEndpoint function| tinycolor object| d3 object| jQuery15207735467664146916 object| jquery_currentMenu boolean| loginPrefilled function| setCookie function| UnsetCookie string| pwc function| ns_check function| ns_disperrmsg function| ns_getcookie function| ns_fillName function| loginFieldCheck function| clean_name_cookie number| begin number| end object| login object| logout undefined| logout_url object| choices function| changePage function| setFocus function| browserSupportCheck function| ResourceManager function| _ object| Resources object| eula function| CreateMainTable function| CreateBannerI function| CreateBannerII function| AddHeaderAndBar function| AddHeaderAndBarForTM function| AddHeaderAndBarForCitrix function| AddFooter function| AddBanner boolean| suitable_browser_to_use_png function| canShowPNGWell function| documentWriteGlowBoxUpper function| documentWriteGlowBoxLower function| documentWriteActionPane function| DialogueBodyTop function| DialogueBodyBottom function| DialogInclude function| DialogueBodyI function| DialogueBodyII function| validate_entry function| TransferInclude function| TransferOnesessBodyI function| TransferMultsessBodyI function| changeTransfervalue function| TransferBodyII function| resize object| allOriName function| createRandName function| revertNames function| randomize object| util number| winAgentPortForLauncher string| cobrandingUrl string| ticketServerLocation string| moTicketServerLocation string| chromeExtensionDownloadUrl string| messagingServerLocation string| entSspUrl string| idpUrl string| parentDomainToBeTagged string| isTrustedDeviceEnabled string| entVipsUrl boolean| isLogEnabled string| safariExtensionUrl string| firefoxExtensionBaseUrl boolean| isMOFallbackEnabled object| catalogFromUserServices string| g_userCredArray string| g_isRDAllowed boolean| g_hasGroupPolicy object| PlatformBrowserSupport object| BrowserDetect object| MobilePushApi object| DeviceFingerprintApi object| symcVipUtils object| vCreds function| VIPError object| vipIaIntegrationProperties function| displayErrorMessage object| vip object| Backbone function| vipjQuery function| vipUnderscore object| vipBackbone object| underi18n function| provscInitializer function| rcInitializer function| tdInitializer object| tbVipDetect number| len function| genTicket_internal function| underscore function| vipAuth object| jQuery111005180110190622313 string| margin_top0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Frame-Options | SAMEORIGIN |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
userservices.vip.symantec.com
18.208.22.38
208.54.142.197
00589e4f2db873c06375c085e9bf04f40cf63a1f2575ff2d8a29b4d87892295a
13fc4b7a465f3458acaa898b644fca2092fc73ab128a166644ebe56f49debf2a
1e3ec2f8f39970fa0536478aa80d3b7986c3ec6b02ee0505ae3b90630e68fc52
27ee70ce18bcf32186a329b86d3c4da1ae92d69f67434f0d017b5771cc611e52
2817043a87ef7679c8f52b7dc70a81d306da35190c2d4fa40fa341600d4b2dd9
8686f46e6d8479e3bb713b89aef09f5caaf4671caeb85cb42a66bd2bb4353687
86e7d27908a1e8f073270209229f4f71d57020f7a3b38327665abcfa99681448
87124f6c3518887e888a669e4ae156f8da68d367f59821671d98ac2490f466f1
9809c675eeefe3a83665986c98d8068a5abd90af39f9ed31aa64b84f8e0f8331
bbc92e5fcbead02d5bb8049434d03337d15e8d81d1d450acbe6b3c76f2f74970
bbccc623ee882a223af0fc6ae7cffde5ea3c97d936357d33439dfbc1b45ac2e8
bd4d5f23336beb3b603af3bcaedb1944361755757ad50616d83d9147ba4cf56d
ca1380a0ea86871de23f3768f34b7dd728462606e0031558a240d3f115d909c5
cee53685632517b614ae9438fc7b149ffd11046a004d11c377d3ab1140fd1336
ecfd13da41536d8d87502b2d9e9253ad58eeafa910258d616de5c6b97eeb4806
ee96581381cd6b5cafefb9f2d2cc77be78d7e769c9fcd7aa083468e43087ba93
efec9771b0b46ab60b946cf17f2119818f4cddec3a36e1f1c19de1d47ca20a44
f512b1c7b49a4d1af362ebd101a2051a6648a7a369a24c52534f38bbc63e1d83
fb6455f06c95c961b4a965627019882ebdc0d653eec63da650583ee42baa7490
fda74a8027991dc6f4a9edf50988ab1a3fe691addab3d42080fffbe616030b21