handler.mobilea2.de
Open in
urlscan Pro
162.0.232.223
Malicious Activity!
Public Scan
Effective URL: https://handler.mobilea2.de/email.html
Submission: On September 30 via api from QA
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on September 23rd 2020. Valid for: a year.
This is the only time handler.mobilea2.de was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: mobile.de (Marketplace)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 9 | 162.0.232.223 162.0.232.223 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
8 | 1 |
ASN22612 (NAMECHEAP-NET, US)
PTR: premium141-3.web-hosting.com
handler.mobilea2.de |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
mobilea2.de
1 redirects
handler.mobilea2.de |
157 KB |
8 | 1 |
Domain | Requested by | |
---|---|---|
9 | handler.mobilea2.de |
1 redirects
handler.mobilea2.de
|
8 | 1 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.mobile.de |
handel.mobile.de |
login.mobile.de |
Subject Issuer | Validity | Valid | |
---|---|---|---|
handler.mobilea2.de Sectigo RSA Domain Validation Secure Server CA |
2020-09-23 - 2021-09-23 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://handler.mobilea2.de/email.html
Frame ID: 53F7258EA271AFFC9CA20514C8247482
Requests: 8 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://handler.mobilea2.de/email.html
HTTP 301
https://handler.mobilea2.de/email.html Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
10 Outgoing links
These are links going to different origins than the main page.
Title:
Search URL Search Domain Scan URL
Title: mobile.de AGB
Search URL Search Domain Scan URL
Title: Datenschutzerklärung
Search URL Search Domain Scan URL
Title: Zum Händler-Login
Search URL Search Domain Scan URL
Title: Zur Händler-Registrierung
Search URL Search Domain Scan URL
Title: Impressum
Search URL Search Domain Scan URL
Title: AGB
Search URL Search Domain Scan URL
Title: Nutzungbasierte Online-Werbung
Search URL Search Domain Scan URL
Title: Datenschutzeinstellungen
Search URL Search Domain Scan URL
Title: Hinweise zu Cookies
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://handler.mobilea2.de/email.html
HTTP 301
https://handler.mobilea2.de/email.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
8 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
email.html
handler.mobilea2.de/ Redirect Chain
|
13 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
632057350myCasLoginView.css
handler.mobilea2.de/email_files/ |
52 KB 17 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1498099001jquery-prod-3.download
handler.mobilea2.de/email_files/ |
87 KB 87 KB |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
788095033mobile.download
handler.mobilea2.de/email_files/ |
1 KB 1 KB |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1247043761loginView.download
handler.mobilea2.de/email_files/ |
44 KB 44 KB |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mobile-logo.svg
handler.mobilea2.de/images/shared/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
promobullets-m.svg
handler.mobilea2.de/images/shared/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
bga-tracking
handler.mobilea2.de/mycas/ |
315 B 413 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: mobile.de (Marketplace)8 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| trustedTypes function| $ function| jQuery function| define function| require function| sm_callTracker object| mobile function| checkfunc0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
handler.mobilea2.de
162.0.232.223
04ae3f473d2e0585bdd5a7be9506161b85d7e74bc1fd89a1512e4c1d49099699
08eab0f9fa25b274b572c2f1cad0032acb79b7138a01741cf9ed49ec4b9a8fa9
250bc7bbe0c8a549979faf8a9837a59a2cd776fd32caaba0ca6dd82ddef04925
8a383fac5b62bbc37f354f9f8d5731b688ceed8b88bd24cd5b1cd626fc2f07b0
beaf00a46205879f90db36379d1f2e76105f047684117f26a02ce9da809fceee
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3