kalea-poke.de Open in urlscan Pro
2001:8d8:100f:f000::2c5 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://salahkaarconsultants.com/suchen.fahrzeuge/mobile.de/details/?id=1775106905&source=email
Effective URL:
https://kalea-poke.de/handel.mobile.de/a2/
Submission: On March 16 via automatic, source phishtank (March 16th 2021, 1:40:42 am UTC)

Summary HTTP 21 Redirects Links 7 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 21 HTTP transactions. The main IP is 2001:8d8:100f:f000::2c5, located in Germany and belongs to IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE. The main domain is kalea-poke.de.
TLS certificate: Issued by Encryption Everywhere DV TLS CA - G1 on June 18th 2020. Valid for: a year.

This is the only time kalea-poke.de was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: mobile.de (Marketplace)

Domain & IP information

	IP Address	AS Autonomous System
1	148.66.132.85 148.66.132.85	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC)
6 18	2001:8d8:100f... 2001:8d8:100f:f000::2c5	8560 (IONOS-AS ...) (IONOS-AS This is the joint network for IONOS)
21	3

1 148.66.132.85 (Singapore, Singapore)

ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)

salahkaarconsultants.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 2001:8d8:100f:f000::2c5 (Germany) 6 redirects

ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE)

kalea-poke.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
18	kalea-poke.de 6 redirects kalea-poke.de	637 KB
1	salahkaarconsultants.com salahkaarconsultants.com	274 B
0	classistatic.de Failed static.classistatic.de Failed
21	3

	Domain	Requested by
18	kalea-poke.de	6 redirects kalea-poke.de
1	salahkaarconsultants.com
0	static.classistatic.de Failed	kalea-poke.de
21	3

This site contains links to these domains. Also see Links.

Domain
www.mobile.de
www.mozilla.org
www.google.com
www.microsoft.com
promo.mobile.de
login.mobile.de

Subject Issuer	Validity	Valid
salahkaarconsultants.com Go Daddy Secure Certificate Authority - G2	`2020-06-07` - `2021-06-06`	a year	crt.sh
*.kalea-poke.de Encryption Everywhere DV TLS CA - G1	`2020-06-18` - `2021-07-02`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://kalea-poke.de/handel.mobile.de/a2/
Frame ID: D8BFB76E330A0A61EC0102F427B09CB8
Requests: 23 HTTP requests in this frame

Frame: https://kalea-poke.de/handel.mobile.de/a2/index_files/saved_resource(1).html
Frame ID: F3988943C535D3A4692559A33DCC9A6A
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://salahkaarconsultants.com/suchen.fahrzeuge/mobile.de/details/?id=1775106905&source=email Page URL
https://kalea-poke.de/handel.mobile.de/a2/ Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

21
Requests

62 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

636 kB
Transfer

727 kB
Size

1
Cookies

7 Outgoing links

These are links going to different origins than the main page.

URL: https://www.mobile.de/

Search URL Search Domain Scan URL

URL: https://www.mozilla.org/de/firefox/new/
Title: Mozilla Firefox

Search URL Search Domain Scan URL

URL: https://www.google.com/intl/de/chrome/
Title: Google Chrome

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/de-de/edge
Title: Microsoft Edge

Search URL Search Domain Scan URL

URL: https://promo.mobile.de/b2b/digitalisierung-nutzen/?utm_source=b2b_info&utm_medium=hb_login&utm_campaign=service&utm_content=banner_digitalisierung_nutzen_allgemein

Search URL Search Domain Scan URL

URL: https://login.mobile.de/a2/request_reset_password?locale=de
Title: Passwort vergessen?

Search URL Search Domain Scan URL

URL: https://login.mobile.de/registration/index.html
Title: Jetzt registrieren

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://salahkaarconsultants.com/suchen.fahrzeuge/mobile.de/details/?id=1775106905&source=email Page URL
https://kalea-poke.de/handel.mobile.de/a2/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4

https://kalea-poke.de/handel.mobile.de/a2/index_files/runtime-main.e5fc9b63.js.download HTTP 302
https://kalea-poke.de/404

Request Chain 5

https://kalea-poke.de/handel.mobile.de/a2/index_files/3.ea8136e7.chunk.js.download HTTP 302
https://kalea-poke.de/404

Request Chain 6

https://kalea-poke.de/handel.mobile.de/a2/index_files/2.5f63b955.chunk.js.download HTTP 302
https://kalea-poke.de/404

Request Chain 7

https://kalea-poke.de/handel.mobile.de/a2/index_files/main.bb569e18.chunk.js.download HTTP 302
https://kalea-poke.de/404

Request Chain 20

https://kalea-poke.de/content/fb9a2a1f92rn2605e2cb84abb585104a HTTP 302
https://kalea-poke.de/404

Request Chain 22

https://kalea-poke.de/content/fb9a2a1f92rn2605e2cb84abb585104a HTTP 302
https://kalea-poke.de/404

21 HTTP transactions
3 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ salahkaarconsultants.com/suchen.fahrzeuge/mobile.de/details/	86 B 274 B	789ms 281ms	Document text/html	148.66.132.85 AS-26496-GO-DADDY...
General Check archive.org Show headers Download Go to Full URL https://salahkaarconsultants.com/suchen.fahrzeuge/mobile.de/details/?id=1775106905&source=email Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 148.66.132.85 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US), Reverse DNS Software Apache / Resource Hash Request headers Host salahkaarconsultants.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Tue, 16 Mar 2021 01:40:18 GMT Server Apache Content-Length 86 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html; charset=UTF-8
GET H2	200	Primary Request / Show response kalea-poke.de/handel.mobile.de/a2/	11 KB 4 KB	93ms 19ms	Document text/html	2001:8d8:100f:f000::2c5 IONOS-AS This is ...
General Check archive.org Show headers Download Go to Full URL https://kalea-poke.de/handel.mobile.de/a2/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2001:8d8:100f:f000::2c5 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE), Reverse DNS Software Apache / Resource Hash `40b3322c015c0f1f91e05674a4ae1d8cafd5cca078e20c3c2518f133585d9152` Request headers :method GET :authority kalea-poke.de :scheme https :path /handel.mobile.de/a2/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest document referer https://salahkaarconsultants.com/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Referer https://salahkaarconsultants.com/ Response headers content-type text/html date Tue, 16 Mar 2021 01:40:18 GMT server Apache last-modified Wed, 13 Jan 2021 16:25:50 GMT etag W/"2af3-5b8ca979b5f80" content-encoding gzip
GET H2	200	3.6c709db4.chunk.css kalea-poke.de/handel.mobile.de/a2/index_files/	254 KB 255 KB	30ms 28ms	Stylesheet text/css	2001:8d8:100f:f000::2c5 IONOS-AS This is ...
General Check archive.org Show headers Download Go to Full URL https://kalea-poke.de/handel.mobile.de/a2/index_files/3.6c709db4.chunk.css Requested by Host: kalea-poke.de URL: https://kalea-poke.de/handel.mobile.de/a2/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2001:8d8:100f:f000::2c5 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE), Reverse DNS Software Apache / Resource Hash `c9f67d91418198652afa16581f6a823ab1e9f57e0270f4821d1a6918e5b6cf60` Request headers Referer https://kalea-poke.de/handel.mobile.de/a2/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 16 Mar 2021 01:40:18 GMT last-modified Tue, 12 Jan 2021 21:26:28 GMT server Apache accept-ranges bytes etag "3f9e8-5b8baacea0900" content-length 260584 content-type text/css
GET H2	200	5ada2fd1 Show response kalea-poke.de/handel.mobile.de/a2/index_files/	32 KB 32 KB	78ms 76ms	Script text/plain	2001:8d8:100f:f000::2c5 IONOS-AS This is ...
General Check archive.org Show headers Download Go to Full URL https://kalea-poke.de/handel.mobile.de/a2/index_files/5ada2fd1 Requested by Host: kalea-poke.de URL: https://kalea-poke.de/handel.mobile.de/a2/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2001:8d8:100f:f000::2c5 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE), Reverse DNS Software Apache / Resource Hash `5a610ea302e51b1f21341ba0477397e1eeb9d42544bec172b678023ea519c862` Request headers Referer https://kalea-poke.de/handel.mobile.de/a2/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 16 Mar 2021 01:40:18 GMT last-modified Tue, 12 Jan 2021 21:26:28 GMT server Apache accept-ranges bytes etag "8047-5b8baacea0900" content-length 32839
GET H2	200	Visual_HB_Login@2x.b4a82192.jpg kalea-poke.de/handel.mobile.de/a2/index_files/	241 KB 242 KB	67ms 66ms	Image image/jpeg	2001:8d8:100f:f000::2c5 IONOS-AS This is ...
General Check archive.org Show headers Download Go to Show image Full URL https://kalea-poke.de/handel.mobile.de/a2/index_files/Visual_HB_Login@2x.b4a82192.jpg Requested by Host: kalea-poke.de URL: https://kalea-poke.de/handel.mobile.de/a2/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2001:8d8:100f:f000::2c5 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE), Reverse DNS Software Apache / Resource Hash `ab381ec9e685f25e958b991a2a4c9769ab1bb9d9fcb3654c80c9a7933f559a1d` Request headers Referer https://kalea-poke.de/handel.mobile.de/a2/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 16 Mar 2021 01:40:18 GMT last-modified Tue, 12 Jan 2021 21:24:52 GMT server Apache accept-ranges bytes etag "3c46b-5b8baa7313100" content-length 246891 content-type image/jpeg
GET H2	200	404 Show response kalea-poke.de/ Redirect Chain https://kalea-poke.de/handel.mobile.de/a2/index_files/runtime-main.e5fc9b63.js.download https://kalea-poke.de/404	17 KB 5 KB	251ms 248ms	Script text/html	2001:8d8:100f:f000::2c5 IONOS-AS This is ...
General Check archive.org Show headers Download Go to Full URL https://kalea-poke.de/404 Requested by Host: kalea-poke.de URL: https://kalea-poke.de/handel.mobile.de/a2/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2001:8d8:100f:f000::2c5 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE), Reverse DNS Software Apache / PHP/7.3.27 Resource Hash `35157b96cfe063974a2c6f00a9d19ca0087e890b1d269529178ab263b6616892` Request headers Referer https://kalea-poke.de/handel.mobile.de/a2/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers pragma no-cache date Tue, 16 Mar 2021 01:40:19 GMT content-encoding gzip last-modified Tue, 16 Mar 2021 01:40:19 GMT server Apache x-powered-by PHP/7.3.27 p3p CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 content-type text/html; charset=utf-8 expires Wed, 17 Aug 2005 00:00:00 GMT Redirect headers location /404 date Tue, 16 Mar 2021 01:40:18 GMT server Apache x-powered-by PHP/7.3.27 content-type text/html; charset=UTF-8
GET H2	200	404 Show response kalea-poke.de/ Redirect Chain https://kalea-poke.de/handel.mobile.de/a2/index_files/3.ea8136e7.chunk.js.download https://kalea-poke.de/404	17 KB 5 KB	215ms 213ms	Script text/html	2001:8d8:100f:f000::2c5 IONOS-AS This is ...
General Check archive.org Show headers Download Go to Full URL https://kalea-poke.de/404 Requested by Host: kalea-poke.de URL: https://kalea-poke.de/handel.mobile.de/a2/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2001:8d8:100f:f000::2c5 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE), Reverse DNS Software Apache / PHP/7.3.27 Resource Hash `35157b96cfe063974a2c6f00a9d19ca0087e890b1d269529178ab263b6616892` Request headers Referer https://kalea-poke.de/handel.mobile.de/a2/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers pragma no-cache date Tue, 16 Mar 2021 01:40:19 GMT content-encoding gzip last-modified Tue, 16 Mar 2021 01:40:19 GMT server Apache x-powered-by PHP/7.3.27 p3p CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 content-type text/html; charset=utf-8 expires Wed, 17 Aug 2005 00:00:00 GMT Redirect headers location /404 date Tue, 16 Mar 2021 01:40:18 GMT server Apache x-powered-by PHP/7.3.27 content-type text/html; charset=UTF-8
GET H2	200	404 Show response kalea-poke.de/ Redirect Chain https://kalea-poke.de/handel.mobile.de/a2/index_files/2.5f63b955.chunk.js.download https://kalea-poke.de/404	17 KB 5 KB	225ms 224ms	Script text/html	2001:8d8:100f:f000::2c5 IONOS-AS This is ...
General Check archive.org Show headers Download Go to Full URL https://kalea-poke.de/404 Requested by Host: kalea-poke.de URL: https://kalea-poke.de/handel.mobile.de/a2/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2001:8d8:100f:f000::2c5 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE), Reverse DNS Software Apache / PHP/7.3.27 Resource Hash `35157b96cfe063974a2c6f00a9d19ca0087e890b1d269529178ab263b6616892` Request headers Referer https://kalea-poke.de/handel.mobile.de/a2/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers pragma no-cache date Tue, 16 Mar 2021 01:40:19 GMT content-encoding gzip last-modified Tue, 16 Mar 2021 01:40:19 GMT server Apache x-powered-by PHP/7.3.27 p3p CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 content-type text/html; charset=utf-8 expires Wed, 17 Aug 2005 00:00:00 GMT Redirect headers location /404 date Tue, 16 Mar 2021 01:40:18 GMT server Apache x-powered-by PHP/7.3.27 content-type text/html; charset=UTF-8
GET H2	200	404 Show response kalea-poke.de/ Redirect Chain https://kalea-poke.de/handel.mobile.de/a2/index_files/main.bb569e18.chunk.js.download https://kalea-poke.de/404	17 KB 5 KB	225ms 224ms	Script text/html	2001:8d8:100f:f000::2c5 IONOS-AS This is ...
General Check archive.org Show headers Download Go to Full URL https://kalea-poke.de/404 Requested by Host: kalea-poke.de URL: https://kalea-poke.de/handel.mobile.de/a2/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2001:8d8:100f:f000::2c5 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE), Reverse DNS Software Apache / PHP/7.3.27 Resource Hash `35157b96cfe063974a2c6f00a9d19ca0087e890b1d269529178ab263b6616892` Request headers Referer https://kalea-poke.de/handel.mobile.de/a2/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers pragma no-cache date Tue, 16 Mar 2021 01:40:19 GMT content-encoding gzip last-modified Tue, 16 Mar 2021 01:40:19 GMT server Apache x-powered-by PHP/7.3.27 p3p CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 content-type text/html; charset=utf-8 expires Wed, 17 Aug 2005 00:00:00 GMT Redirect headers location /404 date Tue, 16 Mar 2021 01:40:18 GMT server Apache x-powered-by PHP/7.3.27 content-type text/html; charset=UTF-8
GET H2	200	fb9a2a1f92rn2605e2cb84abb585104a Show response kalea-poke.de/handel.mobile.de/a2/index_files/	70 KB 71 KB	78ms 77ms	Script text/plain	2001:8d8:100f:f000::2c5 IONOS-AS This is ...
General Check archive.org Show headers Download Go to Full URL https://kalea-poke.de/handel.mobile.de/a2/index_files/fb9a2a1f92rn2605e2cb84abb585104a Requested by Host: kalea-poke.de URL: https://kalea-poke.de/handel.mobile.de/a2/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2001:8d8:100f:f000::2c5 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE), Reverse DNS Software Apache / Resource Hash `ca9ee108c9cd3072864c1fcfe42f8fa40f829a33267388e0adbf41fa8b2da9a5` Request headers Referer https://kalea-poke.de/handel.mobile.de/a2/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 16 Mar 2021 01:40:18 GMT last-modified Tue, 12 Jan 2021 21:26:28 GMT server Apache accept-ranges bytes etag "1194c-5b8baacea0900" content-length 72012
GET DATA	200 OK	truncated /	3 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `9438113100ff089d191a01c1b464f86963be589cd06c182b0c8b71fc95bd2200` Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/svg+xml;charset=US-ASCII
GET DATA	200 OK	truncated /	2 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `9f4b95b244a872b7788d808d07f036a2eda6e59fedcb8dc82e0948675c23b6fc` Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/svg+xml;charset=US-ASCII
GET		Gibson-Regular-webfont-v2.woff2 static.classistatic.de/fonts/	0 0

GET		Gibson-SemiBold-webfont-v2.woff2 static.classistatic.de/fonts/	0 0

GET		Gibson-Regular-webfont-v2.woff static.classistatic.de/fonts/	0 0

GET		Gibson-SemiBold-webfont-v2.woff static.classistatic.de/fonts/	0 0

GET		gibson-regular-v3.woff2 static.classistatic.de/fonts/	0 0

GET		gibson-semibold-v3.woff2 static.classistatic.de/fonts/	0 0

GET		gibson-regular-v3.woff static.classistatic.de/fonts/	0 0

GET		gibson-semibold-v3.woff static.classistatic.de/fonts/	0 0

GET H2	200	saved_resource(1).html Show response kalea-poke.de/handel.mobile.de/a2/index_files/ Frame F398	149 B 287 B	19ms 18ms	Document text/html	2001:8d8:100f:f000::2c5 IONOS-AS This is ...
General Check archive.org Show headers Download Go to Full URL https://kalea-poke.de/handel.mobile.de/a2/index_files/saved_resource(1).html Requested by Host: kalea-poke.de URL: https://kalea-poke.de/handel.mobile.de/a2/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2001:8d8:100f:f000::2c5 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE), Reverse DNS Software Apache / Resource Hash `97f9b10039b05e1af4a3c9b778fc72ba44cf68a376e4ec1d55f2558f16cf3e50` Request headers :method GET :authority kalea-poke.de :scheme https :path /handel.mobile.de/a2/index_files/saved_resource(1).html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site same-origin sec-fetch-mode navigate sec-fetch-dest iframe referer https://kalea-poke.de/handel.mobile.de/a2/ accept-encoding gzip, deflate, br accept-language en-US cookie 6746fdf34f25a70438b24b9b581b042b=6d6dc430c7860eb17d60169463d9dab3 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Referer https://kalea-poke.de/handel.mobile.de/a2/ Response headers content-type text/html date Tue, 16 Mar 2021 01:40:19 GMT server Apache last-modified Tue, 12 Jan 2021 21:26:28 GMT etag W/"95-5b8baacea0900" content-encoding gzip
GET H2	200	404 Show response kalea-poke.de/ Redirect Chain https://kalea-poke.de/content/fb9a2a1f92rn2605e2cb84abb585104a https://kalea-poke.de/404	17 KB 5 KB	226ms 226ms	XHR text/html	2001:8d8:100f:f000::2c5 IONOS-AS This is ...
General Check archive.org Show headers Download Go to Full URL https://kalea-poke.de/404 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2001:8d8:100f:f000::2c5 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE), Reverse DNS Software Apache / PHP/7.3.27 Resource Hash `35157b96cfe063974a2c6f00a9d19ca0087e890b1d269529178ab263b6616892` Request headers Referer https://kalea-poke.de/handel.mobile.de/a2/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers pragma no-cache date Tue, 16 Mar 2021 01:40:19 GMT content-encoding gzip last-modified Tue, 16 Mar 2021 01:40:19 GMT server Apache x-powered-by PHP/7.3.27 p3p CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 content-type text/html; charset=utf-8 expires Wed, 17 Aug 2005 00:00:00 GMT Redirect headers location /404 date Tue, 16 Mar 2021 01:40:19 GMT server Apache x-powered-by PHP/7.3.27 content-type text/html; charset=UTF-8
GET DATA	200 OK	truncated /	9 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `586f876503ed4dc63c6ff8567b67dfeb1c84723ef5c7cf218a8ed74ccba6e1ab` Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/png
GET H2	200	404 Show response kalea-poke.de/ Redirect Chain https://kalea-poke.de/content/fb9a2a1f92rn2605e2cb84abb585104a https://kalea-poke.de/404	17 KB 5 KB	218ms 218ms	XHR text/html	2001:8d8:100f:f000::2c5 IONOS-AS This is ...
General Check archive.org Show headers Download Go to Full URL https://kalea-poke.de/404 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2001:8d8:100f:f000::2c5 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE), Reverse DNS Software Apache / PHP/7.3.27 Resource Hash `35157b96cfe063974a2c6f00a9d19ca0087e890b1d269529178ab263b6616892` Request headers Referer https://kalea-poke.de/handel.mobile.de/a2/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers pragma no-cache date Tue, 16 Mar 2021 01:40:20 GMT content-encoding gzip last-modified Tue, 16 Mar 2021 01:40:20 GMT server Apache x-powered-by PHP/7.3.27 p3p CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 content-type text/html; charset=utf-8 expires Wed, 17 Aug 2005 00:00:00 GMT Redirect headers location /404 date Tue, 16 Mar 2021 01:40:20 GMT server Apache x-powered-by PHP/7.3.27 content-type text/html; charset=UTF-8

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: static.classistatic.de
URL: https://static.classistatic.de/fonts/Gibson-Regular-webfont-v2.woff2

Domain: static.classistatic.de
URL: https://static.classistatic.de/fonts/Gibson-SemiBold-webfont-v2.woff2

Domain: static.classistatic.de
URL: https://static.classistatic.de/fonts/Gibson-Regular-webfont-v2.woff

Domain: static.classistatic.de
URL: https://static.classistatic.de/fonts/Gibson-SemiBold-webfont-v2.woff

Domain: static.classistatic.de
URL: https://static.classistatic.de/fonts/gibson-regular-v3.woff2

Domain: static.classistatic.de
URL: https://static.classistatic.de/fonts/gibson-semibold-v3.woff2

Domain: static.classistatic.de
URL: https://static.classistatic.de/fonts/gibson-regular-v3.woff

Domain: static.classistatic.de
URL: https://static.classistatic.de/fonts/gibson-semibold-v3.woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: mobile.de (Marketplace)

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			kalea-poke.de/	1969-12-31 23:59:59	Name: 6746fdf34f25a70438b24b9b581b042b Value: 6d6dc430c7860eb17d60169463d9dab3

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

kalea-poke.de
salahkaarconsultants.com
static.classistatic.de
static.classistatic.de
148.66.132.85
2001:8d8:100f:f000::2c5
35157b96cfe063974a2c6f00a9d19ca0087e890b1d269529178ab263b6616892
40b3322c015c0f1f91e05674a4ae1d8cafd5cca078e20c3c2518f133585d9152
586f876503ed4dc63c6ff8567b67dfeb1c84723ef5c7cf218a8ed74ccba6e1ab
5a610ea302e51b1f21341ba0477397e1eeb9d42544bec172b678023ea519c862
9438113100ff089d191a01c1b464f86963be589cd06c182b0c8b71fc95bd2200
97f9b10039b05e1af4a3c9b778fc72ba44cf68a376e4ec1d55f2558f16cf3e50
9f4b95b244a872b7788d808d07f036a2eda6e59fedcb8dc82e0948675c23b6fc
ab381ec9e685f25e958b991a2a4c9769ab1bb9d9fcb3654c80c9a7933f559a1d
c9f67d91418198652afa16581f6a823ab1e9f57e0270f4821d1a6918e5b6cf60
ca9ee108c9cd3072864c1fcfe42f8fa40f829a33267388e0adbf41fa8b2da9a5

kalea-poke.de Open in urlscan Pro 2001:8d8:100f:f000::2c5 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

21 Requests

62 %HTTPS

50 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

636 kBTransfer

727 kBSize

1 Cookies

7 Outgoing links

Page URL History

Redirected requests

21 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

16 JavaScript Global Variables

1 Cookies

Indicators

kalea-poke.de Open in urlscan Pro
2001:8d8:100f:f000::2c5 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

21
Requests

62 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

636 kB
Transfer

727 kB
Size

1
Cookies

21 HTTP transactions
3 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!