earthreleaf.eu
Open in
urlscan Pro
128.199.128.34
Malicious Activity!
Public Scan
Submission: On October 10 via api from JP — Scanned from SG
Summary
TLS certificate: Issued by R3 on October 9th 2023. Valid for: 3 months.
This is the only time earthreleaf.eu was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: 1&1 Ionos (Telecommunication)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
8 | 128.199.128.34 128.199.128.34 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
1 | 74.125.130.95 74.125.130.95 | 15169 (GOOGLE) (GOOGLE) | |
6 | 213.165.66.58 213.165.66.58 | 8560 (IONOS-AS ...) (IONOS-AS This is the joint network for IONOS) | |
1 | 104.18.114.97 104.18.114.97 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
16 | 5 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
earthreleaf.eu
earthreleaf.eu |
77 KB |
6 |
uicdn.net
ce1.uicdn.net — Cisco Umbrella Rank: 183774 |
308 KB |
1 |
icanhazip.com
www.icanhazip.com — Cisco Umbrella Rank: 78994 |
380 B |
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 405 |
30 KB |
16 | 4 |
Domain | Requested by | |
---|---|---|
8 | earthreleaf.eu |
earthreleaf.eu
|
6 | ce1.uicdn.net |
earthreleaf.eu
|
1 | www.icanhazip.com |
ajax.googleapis.com
|
1 | ajax.googleapis.com |
earthreleaf.eu
|
16 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.ionos.com |
contact.ionos.com |
ias.ionos.com |
my.ionos.com |
hidrive.ionos.com |
archive.ionos.com |
www.ionos-status.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
earthreleaf.eu R3 |
2023-10-09 - 2024-01-07 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-09-18 - 2023-12-11 |
3 months | crt.sh |
ce1.uicdn.net GeoTrust RSA CA 2018 |
2023-03-03 - 2024-04-02 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-04-07 - 2024-04-06 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://earthreleaf.eu/index.html
Frame ID: 8A80B3B3F70A8204FFDE8A1B89FCECF4
Requests: 17 HTTP requests in this frame
Screenshot
Page Title
Webmail Login | IONOSDetected technologies
Zip (Payment processors) ExpandDetected patterns
- zip\.co
jQuery (JavaScript Libraries) Expand
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
17 Outgoing links
These are links going to different origins than the main page.
Title: Webmail
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: Forgot your password?
Search URL Search Domain Scan URL
Title: Remember me
Search URL Search Domain Scan URL
Title: Learn more
Search URL Search Domain Scan URL
Title: iOS
Search URL Search Domain Scan URL
Title: Android
Search URL Search Domain Scan URL
Title: Thunderbird
Search URL Search Domain Scan URL
Title: Outlook
Search URL Search Domain Scan URL
Title: Apple Mail
Search URL Search Domain Scan URL
Title: email programs (POP/IMAP)
Search URL Search Domain Scan URL
Title: My IONOS
Search URL Search Domain Scan URL
Title: HiDrive
Search URL Search Domain Scan URL
Title: Email archiving
Search URL Search Domain Scan URL
Title: Degraded Performance
Search URL Search Domain Scan URL
Title: IONOS Inc. 22 2023
Search URL Search Domain Scan URL
Title: Privacy Policy
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
16 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
index.html
earthreleaf.eu/ |
80 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ionos.min.css
earthreleaf.eu/Webmail%20Login%20_%20IONOS_files/ |
311 KB 32 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login.min.css
earthreleaf.eu/Webmail%20Login%20_%20IONOS_files/ |
15 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
navigation.css
earthreleaf.eu/Webmail%20Login%20_%20IONOS_files/ |
112 KB 21 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
inpagelayer.css
earthreleaf.eu/Webmail%20Login%20_%20IONOS_files/ |
19 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
statuspage.css
earthreleaf.eu/Webmail%20Login%20_%20IONOS_files/ |
5 KB 1023 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
email-marketing.svg
earthreleaf.eu/Webmail%20Login%20_%20IONOS_files/ |
9 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ |
84 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
capture.js
earthreleaf.eu/Webmail%20Login%20_%20IONOS_files/ |
4 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
opensans-regular.woff
ce1.uicdn.net/exos/fonts/open-sans/ |
62 KB 63 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
251 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
exos-icon-font.woff
ce1.uicdn.net/exos/icons/ |
50 KB 50 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
overpass-regular.woff
ce1.uicdn.net/exos/fonts/overpass/ |
42 KB 42 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
opensans-bold.woff
ce1.uicdn.net/exos/fonts/open-sans/ |
62 KB 62 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
overpass-bold.woff
ce1.uicdn.net/exos/fonts/overpass/ |
41 KB 41 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.icanhazip.com/ |
16 B 380 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
exos-icon-font.woff
ce1.uicdn.net/exos/icons/ |
50 KB 50 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: 1&1 Ionos (Telecommunication)9 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery number| submissionCount string| ipAddress function| send1 function| _0x22c9 function| send2 function| _0x1526 function| isValidEmail0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
ce1.uicdn.net
earthreleaf.eu
www.icanhazip.com
104.18.114.97
128.199.128.34
213.165.66.58
74.125.130.95
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
121cc83113b8e6f35952fbe95290cff681bc509d0ee9b5c8d110737095a9132f
1ea897ce746ac3177faaf6be44aa8ea6129a39220bdf122d9973113ae77c8a7a
2e1587380141daff4e10a8e3db8f7ae5887102ab7576bff43049590f637ac20b
35538b399f40d6db114f64b970fb8a612d88d833906f95f4cb8675c0277ecfb3
4290f461370213d9c4102e235cadce7713730e5eb6984d3c10ac46d914cd29fc
46f3bb861233f69273f5624c6e1c5b9fbe2c68fe995e8bdd8d9db6dc6d35f9f9
5c3d0f34046387cec16d3a954c1857007b8f9fb687b49f0f08d1af9cb1108d12
7afccd9150b0fcbf1a1056e6cc6051c9b6d85a55da7bf1a7fb0f475c0b22facc
7d7a1a8ec55f31a6674fd2e2c41bcc6421a9aeb5cf161c6e93363f31347160f9
7f911731fa684ac6d88d5985f8ce8741f4fdb5fc9a1021a155f414fe20b4b52d
9d27c279b8aef5083f4720d71b79ba18519d3f924955d7338932a5252555b669
d78e7ad4838a9fb4db11451b1db78ccd0b0c7b28f5787684ce2870918ce27bb5
dd0afdfec8266c7256255975b9ca2ea8511783cc86a61317e901c00b8e654bda
de1a4dc893507b130b3530a454b87cecbced238ea9bf94650d91d7163770b89c
eb4458afccabd64b15e6294a469185c39d26ef26604eacfc268f46628c15551d