www.vodi.me Open in urlscan Pro
2606:4700:3031::6818:747b Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.vodi.me/content/gmx/gmx.php
Submission Tags: phishing malicious Search All
Submission: On February 28 via api (February 28th 2020, 4:32:27 pm UTC) from JP

Summary HTTP 20 Redirects Links 7 Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 3 domains to perform 20 HTTP transactions. The main IP is 2606:4700:3031::6818:747b, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.vodi.me.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on February 5th 2020. Valid for: 8 months.

This is the only time www.vodi.me was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: GMX (Online)

Domain & IP information

	IP Address	AS Autonomous System
9	2606:4700:303... 2606:4700:3031::6818:747b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:4104	13335 (CLOUDFLAR...) (CLOUDFLARENET)
9	23.210.249.45 23.210.249.45	16625 (AKAMAI-AS) (AKAMAI-AS)
1 2	82.165.229.54 82.165.229.54	8560 (ONEANDONE...) (ONEANDONE-AS Brauerstrasse 48)
20	4

9 2606:4700:3031::6818:747b (United States)

ASN13335 (CLOUDFLARENET, US)

www.vodi.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:4104 (United States)

ASN13335 (CLOUDFLARENET, US)

ajax.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 23.210.249.45 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-249-45.deploy.static.akamaitechnologies.com

img.ui-portal.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 82.165.229.54 (Germany) 1 redirects

ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE)
PTR: wa.ui-portal.de

wa.ui-portal.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	ui-portal.de 1 redirects img.ui-portal.de wa.ui-portal.de	57 KB
9	vodi.me www.vodi.me	78 KB
1	cloudflare.com ajax.cloudflare.com	4 KB
20	3

	Domain	Requested by
9	img.ui-portal.de
9	www.vodi.me	www.vodi.me ajax.cloudflare.com
2	wa.ui-portal.de	1 redirects
1	ajax.cloudflare.com	www.vodi.me
20	4

This site contains links to these domains. Also see Links.

Domain
www.gmx.net
interception1.gmx.net
hilfe.gmx.net
newsroom.gmx.net
agb-server.gmx.net

Subject Issuer	Validity	Valid
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2020-02-05` - `2020-10-09`	8 months	crt.sh
cloudflare.com CloudFlare Inc ECC CA-2	`2020-01-07` - `2020-10-09`	9 months	crt.sh
img.ui-portal.de GeoTrust RSA CA 2018	`2019-08-06` - `2020-11-04`	a year	crt.sh
*.ui-portal.de GeoTrust RSA CA 2018	`2018-07-06` - `2020-07-05`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://www.vodi.me/content/gmx/gmx.php
Frame ID: C830F45A4A44AF38DC5B9D24CA129916
Requests: 20 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^\/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

20
Requests

100 %
HTTPS

50 %
IPv6

3
Domains

4
Subdomains

4
IPs

3
Countries

139 kB
Transfer

349 kB
Size

1
Cookies

7 Outgoing links

These are links going to different origins than the main page.

URL: https://www.gmx.net/
Title: GMX Mein Account

Search URL Search Domain Scan URL

URL: https://interception1.gmx.net/logininterceptionfrontend/?0&interceptiontype=VerifyLogin&service=freemail&successURL=https%3A%2F%2Fnavigator.gmx.net%2Flogin&statistics=xRbXFc8VKmF6s%2Frp6a5qP4z%2FNdyBHKIvfVNtKKZ%2FMIzZ6sV0I7t11UL6HiAYcLrIM%2FUa97LhhoApcfeuwhgCrf8OzhYyHaHNFxpFfXyh%2FgNOFasefWiag2osdLwsoaQUjFgl5KRWNZQn%2FJ%2BVf5Yq1vzDMmvcNacavpkSKc0VdsoMzKeZnxxL%2Fl2FTNDJCnPcIHjxpzAgCgOro1V2sZbBxg%3D%3D&username=ipeter%40gmx.ch&requestSecurityToken=a74443d0-2b89-4431-9ec7-335d9cbeed76
Title: Anderes Wort anzeigen

Search URL Search Domain Scan URL

URL: https://hilfe.gmx.net/
Title: Service

Search URL Search Domain Scan URL

URL: https://newsroom.gmx.net/
Title: Über GMX

Search URL Search Domain Scan URL

URL: https://www.gmx.net/impressum/
Title: Impressum

Search URL Search Domain Scan URL

URL: https://agb-server.gmx.net/gmxagb-de
Title: AGB

Search URL Search Domain Scan URL

URL: https://agb-server.gmx.net/datenschutz
Title: Datenschutz

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 18

https://wa.ui-portal.de/gmx/gmx/s?name=undefined&country=undefined&hid=%20&ts=1582907531752&viewres=1600x1200&viewport_w=1600&viewport_h=1200&title=GMX%20Mein%20Account&pageurl=https%3A//www.vodi.me/content/gmx/gmx.php&referrer= HTTP 302
https://wa.ui-portal.de/gmx/gmx/s?_wa=312f5374ea8506bf8973e8f68c2de4c3&name=undefined&country=undefined&hid=%20&ts=1582907531752&viewres=1600x1200&viewport_w=1600&viewport_h=1200&title=GMX%20Mein%20Account&pageurl=https%3A//www.vodi.me/content/gmx/gmx.php&referrer=

20 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request gmx.php Show response
www.vodi.me/content/gmx/ 10 KB
3 KB 832ms
774ms Document
text/html 2606:4700:3031::6818:747b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.vodi.me/content/gmx/gmx.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::6818:747b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 02b3e88920c164b611eb91e302a1920558505fda972a6008f5da4914e0f817b5

Request headers

:method: GET
:authority: www.vodi.me
:scheme: https
:path: /content/gmx/gmx.php
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: document
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document

Response headers

status: 200
date: Fri, 28 Feb 2020 16:32:10 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=d72a347f5e98b7839e15a0a69dfda75ef1582907530; expires=Sun, 29-Mar-20 16:32:10 GMT; path=/; domain=.vodi.me; HttpOnly; SameSite=Lax
vary: Accept-Encoding
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 56c3caff8dc3dfcb-FRA
content-encoding: br

GET
H2 200 interception-ver-20954B03804E1BE9F69C743EFC55F129.css
www.vodi.me/content/gmx/gmx_files/ 53 KB
9 KB 560ms
559ms Stylesheet
text/css 2606:4700:3031::6818:747b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.vodi.me/content/gmx/gmx_files/interception-ver-20954B03804E1BE9F69C743EFC55F129.css
Requested by: Host: www.vodi.me
URL: https://www.vodi.me/content/gmx/gmx.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::6818:747b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf5e49af5b56bf3d1c765d8c8bb6aa8642cc9dbb8231cbd6aef91d7acb00c6ef

Request headers

Referer: https://www.vodi.me/content/gmx/gmx.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Fri, 28 Feb 2020 16:32:11 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Sun, 08 Sep 2019 13:17:48 GMT
server: cloudflare
cf-polished: origSize=69214
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=14400
cf-ray: 56c3cb045ceedfcb-FRA
cf-bgj: minify

GET
H2 200 traffic_light_global-ver-F8B380184E15E337A3D3C4A4451492EE.css
www.vodi.me/content/gmx/gmx_files/ 731 B
356 B 559ms
558ms Stylesheet
text/css 2606:4700:3031::6818:747b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.vodi.me/content/gmx/gmx_files/traffic_light_global-ver-F8B380184E15E337A3D3C4A4451492EE.css
Requested by: Host: www.vodi.me
URL: https://www.vodi.me/content/gmx/gmx.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::6818:747b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 85f9031f8649f9efb3e0f3f7f063365f0465e19a26a9337f883f78167e99a2c9

Request headers

Referer: https://www.vodi.me/content/gmx/gmx.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Fri, 28 Feb 2020 16:32:11 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Sun, 08 Sep 2019 13:17:48 GMT
server: cloudflare
cf-polished: origSize=1020
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=14400
cf-ray: 56c3cb045cefdfcb-FRA
cf-bgj: minify

GET
H2 200 saved_resource
www.vodi.me/content/gmx/gmx_files/ 4 KB
4 KB 557ms
557ms Image
image/jpeg 2606:4700:3031::6818:747b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.vodi.me/content/gmx/gmx_files/saved_resource
Requested by: Host: www.vodi.me
URL: https://www.vodi.me/content/gmx/gmx.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::6818:747b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 21408131188b509cc83d535d9d205058a7f6d4f333aba939d60750015e9d06ef

Request headers

Referer: https://www.vodi.me/content/gmx/gmx.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Fri, 28 Feb 2020 16:32:11 GMT
cf-cache-status: DYNAMIC
last-modified: Sun, 08 Sep 2019 13:17:50 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status: 200
accept-ranges: bytes
cf-ray: 56c3cb045cf1dfcb-FRA
content-length: 3990

GET
H2 200 rocket-loader.min.js Show response
ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/ 12 KB
4 KB 9ms
8ms Script
application/javascript 2606:4700::6811:4104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js

Requested by

Host: www.vodi.me
URL: https://www.vodi.me/content/gmx/gmx.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:4104 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b08cdbc2d30e656a86b20f8342428d5863f70f4b30135b4f4061f754ce932f5e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.vodi.me/content/gmx/gmx.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 28 Feb 2020 16:32:10 GMT
content-encoding: gzip
last-modified: Wed, 26 Feb 2020 11:08:35 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"5e5651b3-3016"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=172800, public
strict-transport-security: max-age=15780000; includeSubDomains
cf-ray: 56c3cb045c21d70d-FRA
alt-svc: h3-27=":443"; ma=86400, h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
expires: Sun, 01 Mar 2020 16:32:10 GMT

GET
H2 200 traffic_light-ver-6123F10E3FA50D8228A57963D71E6B86.js.download Show response
www.vodi.me/content/gmx/gmx_files/ 3 KB
1 KB 567ms
566ms Script
application/javascript 2606:4700:3031::6818:747b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.vodi.me/content/gmx/gmx_files/traffic_light-ver-6123F10E3FA50D8228A57963D71E6B86.js.download
Requested by: Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::6818:747b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4df2c2441a949ed7ff7426c12c488c0f5506afbb6acad07e81a03a826c120ff5

Request headers

Referer: https://www.vodi.me/content/gmx/gmx.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 28 Feb 2020 16:32:11 GMT
content-encoding: br
cf-cache-status: DYNAMIC
last-modified: Sun, 08 Sep 2019 13:17:50 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cf-ray: 56c3cb047d26dfcb-FRA

GET
H2 200 4006.js.download Show response
www.vodi.me/content/gmx/gmx_files/ 19 KB
7 KB 589ms
588ms Script
application/javascript 2606:4700:3031::6818:747b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.vodi.me/content/gmx/gmx_files/4006.js.download
Requested by: Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::6818:747b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 337b1cd522aac5c61604e40402c0dcc3053de9387d0c2be9c0c27c8503ec4e7d

Request headers

Referer: https://www.vodi.me/content/gmx/gmx.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 28 Feb 2020 16:32:11 GMT
content-encoding: br
cf-cache-status: DYNAMIC
last-modified: Sun, 08 Sep 2019 13:17:48 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cf-ray: 56c3cb047d28dfcb-FRA

GET
H2 200 interception.js.download Show response
www.vodi.me/content/gmx/gmx_files/ 64 KB
14 KB 159ms
158ms Script
application/javascript 2606:4700:3031::6818:747b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.vodi.me/content/gmx/gmx_files/interception.js.download
Requested by: Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::6818:747b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: da5f4b5c081876a3c784d966637d71662bb8a9b5b8a0f742bdc3526c31a7434b

Request headers

Referer: https://www.vodi.me/content/gmx/gmx.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 28 Feb 2020 16:32:11 GMT
content-encoding: br
cf-cache-status: DYNAMIC
last-modified: Sun, 08 Sep 2019 13:17:48 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cf-ray: 56c3cb047d29dfcb-FRA

GET
H2 200 wicket-ajax-jquery-ver-3A8C326A8436172FC95523D517EBC88B.js.download Show response
www.vodi.me/content/gmx/gmx_files/ 43 KB
11 KB 601ms
601ms Script
application/javascript 2606:4700:3031::6818:747b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.vodi.me/content/gmx/gmx_files/wicket-ajax-jquery-ver-3A8C326A8436172FC95523D517EBC88B.js.download
Requested by: Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::6818:747b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 814d708ae7117c643892517043641d0802ae58402b8eacab4b52084321fc9ec4

Request headers

Referer: https://www.vodi.me/content/gmx/gmx.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 28 Feb 2020 16:32:11 GMT
content-encoding: br
cf-cache-status: DYNAMIC
last-modified: Sun, 08 Sep 2019 13:17:48 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cf-ray: 56c3cb047d2bdfcb-FRA

GET
H2 200 jquery-3.4.1-ver-D19AFC7779BBA20E96683BE58B330F62.js.download Show response
www.vodi.me/content/gmx/gmx_files/ 86 KB
30 KB 639ms
639ms Script
application/javascript 2606:4700:3031::6818:747b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.vodi.me/content/gmx/gmx_files/jquery-3.4.1-ver-D19AFC7779BBA20E96683BE58B330F62.js.download
Requested by: Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::6818:747b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c3236f2795c78a26b795a60a972ada5a30cf25eea2c17b56817ed66562084bef

Request headers

Referer: https://www.vodi.me/content/gmx/gmx.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 28 Feb 2020 16:32:11 GMT
content-encoding: br
cf-cache-status: DYNAMIC
last-modified: Sun, 08 Sep 2019 13:17:48 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cf-ray: 56c3cb047d2cdfcb-FRA

GET
H2 200 page_header_2.png
img.ui-portal.de/interception/kontaktadresse/gmx/bg/ 981 B
1 KB 102ms
37ms Image
image/png 23.210.249.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.ui-portal.de/interception/kontaktadresse/gmx/bg/page_header_2.png
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-45.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: f2be4d8456cd0f00e629994338ba6e72068ba5630a0e22cadc8a903d63ad83ed

Request headers

Referer: https://www.vodi.me/content/gmx/gmx_files/interception-ver-20954B03804E1BE9F69C743EFC55F129.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Fri, 28 Feb 2020 16:32:11 GMT
last-modified: Thu, 28 Apr 2016 08:33:18 GMT
server: Apache
etag: "3d5-5318760cdcf80"
content-type: image/png
status: 200
cache-control: public, max-age=452
accept-ranges: bytes
x-robots-tag: noindex
content-length: 981

GET
H2 200 logoCI2018_navigator.png
img.ui-portal.de/ci/gmx/global/ 2 KB
2 KB 177ms
113ms Image
image/png 23.210.249.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.ui-portal.de/ci/gmx/global/logoCI2018_navigator.png
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-45.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 4cb170c47988f5ecd65f2243af51805b0507bb6ca6424da52b8d26475d0f8e16

Request headers

Referer: https://www.vodi.me/content/gmx/gmx_files/interception-ver-20954B03804E1BE9F69C743EFC55F129.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Fri, 28 Feb 2020 16:32:11 GMT
last-modified: Mon, 19 Feb 2018 13:59:12 GMT
server: Apache
etag: "7a5-565911945fc02"
content-type: image/png
status: 200
cache-control: public, max-age=336
accept-ranges: bytes
x-robots-tag: noindex
content-length: 1957

GET
H2 200 content.png
img.ui-portal.de/interception/kontaktadresse/gmx/bg/ 6 KB
7 KB 112ms
48ms Image
image/png 23.210.249.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.ui-portal.de/interception/kontaktadresse/gmx/bg/content.png
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-45.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: f9063c8b0b831e649b6260a0a51a71c1a862911360f11f3ba43414bfc5b06c71

Request headers

Referer: https://www.vodi.me/content/gmx/gmx_files/interception-ver-20954B03804E1BE9F69C743EFC55F129.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Fri, 28 Feb 2020 16:32:11 GMT
last-modified: Mon, 18 Aug 2014 09:33:05 GMT
server: Apache
etag: "19f4-500e40ed5f640"
content-type: image/png
status: 200
cache-control: public, max-age=136
accept-ranges: bytes
x-robots-tag: noindex
content-length: 6644

GET
H2 200 hint_extraWide.png
img.ui-portal.de/interception/gmx/icon/ 1 KB
2 KB 103ms
39ms Image
image/png 23.210.249.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.ui-portal.de/interception/gmx/icon/hint_extraWide.png
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-45.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 7a16dae2ca8b712d3c3f85e2ce7e95b9decc1defa377c03a14f872aea91c8a2f

Request headers

Referer: https://www.vodi.me/content/gmx/gmx_files/interception-ver-20954B03804E1BE9F69C743EFC55F129.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Fri, 28 Feb 2020 16:32:11 GMT
last-modified: Wed, 29 Jun 2016 08:49:20 GMT
server: Apache
etag: "561-53666d44e0400"
content-type: image/png
status: 200
cache-control: public, max-age=1472
accept-ranges: bytes
x-robots-tag: noindex
content-length: 1377

GET
H2 200 hint_16x16.png
img.ui-portal.de/interception/gmx/icon/ 974 B
1 KB 97ms
33ms Image
image/png 23.210.249.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.ui-portal.de/interception/gmx/icon/hint_16x16.png
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-45.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: d5eb5d3724dc0762e05678e16c2a1c893e8f1cee6076ca191914573be5ac3695

Request headers

Referer: https://www.vodi.me/content/gmx/gmx_files/interception-ver-20954B03804E1BE9F69C743EFC55F129.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Fri, 28 Feb 2020 16:32:11 GMT
last-modified: Thu, 23 May 2013 13:29:45 GMT
server: Apache
etag: "3ce-4dd62acf34440"
content-type: image/png
status: 200
cache-control: public, max-age=100
accept-ranges: bytes
x-robots-tag: noindex
content-length: 974

GET
H2 404 password-show-inactive-normal.png
img.ui-portal.de/interception/kontaktadresse/gmx/icon/ 0
0 120ms
57ms Image
text/html 23.210.249.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.ui-portal.de/interception/kontaktadresse/gmx/icon/password-show-inactive-normal.png
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-45.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.vodi.me/content/gmx/gmx_files/interception-ver-20954B03804E1BE9F69C743EFC55F129.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

GET
H2 200 p.gif
img.ui-portal.de/ 42 B
204 B 27ms
27ms Image
image/gif 23.210.249.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.ui-portal.de/p.gif
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-45.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://www.vodi.me/content/gmx/gmx_files/interception-ver-20954B03804E1BE9F69C743EFC55F129.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Fri, 28 Feb 2020 16:32:11 GMT
last-modified: Thu, 08 Aug 2002 13:23:51 GMT
server: Apache
etag: "2a-3a7b33340c7c0"
content-type: image/gif
status: 200
cache-control: public, max-age=931
accept-ranges: bytes
x-robots-tag: noindex
content-length: 42

GET
H2 200 RobotoCondensed-Regular-webfont.woff
img.ui-portal.de/ci/gmx/global/fonts/roboto/ 25 KB
25 KB 95ms
27ms Font
application/font-woff 23.210.249.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://img.ui-portal.de/ci/gmx/global/fonts/roboto/RobotoCondensed-Regular-webfont.woff
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-45.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 7ec51beb961db2999fe41a96a3212edc51d9aeeec5c9d374e39c7313d183d8a6

Request headers

Referer: https://www.vodi.me/content/gmx/gmx_files/interception-ver-20954B03804E1BE9F69C743EFC55F129.css
Origin: https://www.vodi.me
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 28 Feb 2020 16:32:11 GMT
last-modified: Thu, 27 Feb 2014 04:45:48 GMT
server: Apache
access-control-allow-origin: *
etag: "62b4-4f35bfeb9b700"
content-type: application/font-woff
status: 200
cache-control: public, max-age=1368667
accept-ranges: bytes
x-robots-tag: noindex
content-length: 25268

GET
H2 200 RobotoCondensed-Light-webfont.woff
img.ui-portal.de/ci/gmx/global/fonts/roboto/ 18 KB
19 KB 115ms
47ms Font
application/font-woff 23.210.249.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://img.ui-portal.de/ci/gmx/global/fonts/roboto/RobotoCondensed-Light-webfont.woff
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-45.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 4cde34c1e366e3d7625d453914da07e72c137c195ec9191db06f41775e65a01b

Request headers

Referer: https://www.vodi.me/content/gmx/gmx_files/interception-ver-20954B03804E1BE9F69C743EFC55F129.css
Origin: https://www.vodi.me
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 28 Feb 2020 16:32:11 GMT
last-modified: Tue, 18 Jul 2017 09:59:36 GMT
server: Apache
access-control-allow-origin: *
etag: "49c0-5549492a91200"
content-type: application/font-woff
status: 200
cache-control: public, max-age=1366893
accept-ranges: bytes
x-robots-tag: noindex
content-length: 18880

GET
H/1.1

200
OK

s
wa.ui-portal.de/gmx/gmx/
Redirect Chain

https://wa.ui-portal.de/gmx/gmx/s?name=undefined&country=undefined&hid=%20&ts=1582907531752&viewres=1600x1200&viewport_w=1600&viewport_h=1200&title=GMX%20Mein%20Account&pageurl=https%3A//www.vodi.m...
https://wa.ui-portal.de/gmx/gmx/s?_wa=312f5374ea8506bf8973e8f68c2de4c3&name=undefined&country=undefined&hid=%20&ts=1582907531752&viewres=1600x1200&viewport_w=1600&viewport_h=1200&title=GMX%20Mein%2...

43 B
383 B

25ms
25ms

Image
image/gif

82.165.229.54
ONEANDONE-AS Brau...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://wa.ui-portal.de/gmx/gmx/s?_wa=312f5374ea8506bf8973e8f68c2de4c3&name=undefined&country=undefined&hid=%20&ts=1582907531752&viewres=1600x1200&viewport_w=1600&viewport_h=1200&title=GMX%20Mein%20Account&pageurl=https%3A//www.vodi.me/content/gmx/gmx.php&referrer=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 82.165.229.54 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS: wa.ui-portal.de
Software: Apache /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

Referer: https://www.vodi.me/content/gmx/gmx.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 28 Feb 2020 16:32:11 GMT
Server: Apache
P3P: CP="this is not a p3p policy"
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Type: image/gif
Keep-Alive: timeout=3, max=99
Content-Length: 43
Expires: Wed, 11 Jan 1984 05:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 28 Feb 2020 16:32:11 GMT
Server: Apache
P3P: CP="this is not a p3p policy"
Location: https://wa.ui-portal.de/gmx/gmx/s?_wa=312f5374ea8506bf8973e8f68c2de4c3&name=undefined&country=undefined&hid=%20&ts=1582907531752&viewres=1600x1200&viewport_w=1600&viewport_h=1200&title=GMX%20Mein%20Account&pageurl=https%3A//www.vodi.me/content/gmx/gmx.php&referrer=
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
Keep-Alive: timeout=3, max=100
Content-Length: 489
Expires: Wed, 11 Jan 1984 05:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: GMX (Online)

27 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.vodi.me/	1970-01-19 08:24:59	Name: __cfduid Value: d72a347f5e98b7839e15a0a69dfda75ef1582907530

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	warning	URL: https://www.vodi.me/content/gmx/gmx_files/jquery-3.4.1-ver-D19AFC7779BBA20E96683BE58B330F62.js.download(Line 2) Message: jQuery.Deferred exception: $(...).on(...).on(...).on(...).on(...).find(...).andSelf is not a function TypeError: $(...).on(...).on(...).on(...).on(...).find(...).andSelf is not a function at initButtons (https://www.vodi.me/content/gmx/gmx_files/interception.js.download:167:10) at HTMLDocument.<anonymous> (https://www.vodi.me/content/gmx/gmx_files/interception.js.download:178:5) at e (https://www.vodi.me/content/gmx/gmx_files/jquery-3.4.1-ver-D19AFC7779BBA20E96683BE58B330F62.js.download:2:29453) at t (https://www.vodi.me/content/gmx/gmx_files/jquery-3.4.1-ver-D19AFC7779BBA20E96683BE58B330F62.js.download:2:29755) undefined

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.cloudflare.com
img.ui-portal.de
wa.ui-portal.de
www.vodi.me
23.210.249.45
2606:4700:3031::6818:747b
2606:4700::6811:4104
82.165.229.54
02b3e88920c164b611eb91e302a1920558505fda972a6008f5da4914e0f817b5
21408131188b509cc83d535d9d205058a7f6d4f333aba939d60750015e9d06ef
337b1cd522aac5c61604e40402c0dcc3053de9387d0c2be9c0c27c8503ec4e7d
4cb170c47988f5ecd65f2243af51805b0507bb6ca6424da52b8d26475d0f8e16
4cde34c1e366e3d7625d453914da07e72c137c195ec9191db06f41775e65a01b
4df2c2441a949ed7ff7426c12c488c0f5506afbb6acad07e81a03a826c120ff5
7a16dae2ca8b712d3c3f85e2ce7e95b9decc1defa377c03a14f872aea91c8a2f
7ec51beb961db2999fe41a96a3212edc51d9aeeec5c9d374e39c7313d183d8a6
814d708ae7117c643892517043641d0802ae58402b8eacab4b52084321fc9ec4
85f9031f8649f9efb3e0f3f7f063365f0465e19a26a9337f883f78167e99a2c9
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
b08cdbc2d30e656a86b20f8342428d5863f70f4b30135b4f4061f754ce932f5e
c3236f2795c78a26b795a60a972ada5a30cf25eea2c17b56817ed66562084bef
cf5e49af5b56bf3d1c765d8c8bb6aa8642cc9dbb8231cbd6aef91d7acb00c6ef
d5eb5d3724dc0762e05678e16c2a1c893e8f1cee6076ca191914573be5ac3695
da5f4b5c081876a3c784d966637d71662bb8a9b5b8a0f742bdc3526c31a7434b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f2be4d8456cd0f00e629994338ba6e72068ba5630a0e22cadc8a903d63ad83ed
f9063c8b0b831e649b6260a0a51a71c1a862911360f11f3ba43414bfc5b06c71

www.vodi.me Open in urlscan Pro 2606:4700:3031::6818:747b Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

20 Requests

100 %HTTPS

50 %IPv6

3 Domains

4 Subdomains

4 IPs

3 Countries

139 kBTransfer

349 kBSize

1 Cookies

7 Outgoing links

Redirected requests

20 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

27 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

www.vodi.me Open in urlscan Pro
2606:4700:3031::6818:747b Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

20
Requests

100 %
HTTPS

50 %
IPv6

3
Domains

4
Subdomains

4
IPs

3
Countries

139 kB
Transfer

349 kB
Size

1
Cookies

20 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!