t-mobile.com-qwv.top
Open in
urlscan Pro
104.21.55.18
Malicious Activity!
Unlisted Scan
Effective URL: https://t-mobile.com-qwv.top/?IRCQ=GNzbaU
Submission Tags: dragonfire
Submission: On November 07 via manual from US — Scanned from US
Summary
TLS certificate: Issued by WE1 on November 6th 2025. Valid for: 3 months.
This is the only time t-mobile.com-qwv.top was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Telekom (Telecommunication)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 23 | 104.21.55.18 104.21.55.18 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
| 1 | 208.95.112.1 208.95.112.1 | 53334 (TUT-AS) (TUT-AS) | |
| 26 | 3 |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 23 |
com-qwv.top
t-mobile.com-qwv.top |
1 MB |
| 1 |
ip-api.com
ip-api.com — Cisco Umbrella Rank: 4216 |
291 B |
| 0 |
ipinfo.io
Failed
ipinfo.io Failed |
|
| 0 |
ipapi.co
Failed
ipapi.co Failed |
|
| 26 | 4 |
| Domain | Requested by | |
|---|---|---|
| 23 | t-mobile.com-qwv.top |
t-mobile.com-qwv.top
|
| 1 | ip-api.com |
t-mobile.com-qwv.top
|
| 0 | ipinfo.io Failed |
t-mobile.com-qwv.top
|
| 0 | ipapi.co Failed |
t-mobile.com-qwv.top
|
| 26 | 4 |
This site contains links to these domains. Also see Links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| com-qwv.top WE1 |
2025-11-06 - 2026-02-04 |
3 months | crt.sh |
| *.ip-api.com Sectigo RSA Domain Validation Secure Server CA |
2025-01-09 - 2026-02-09 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://t-mobile.com-qwv.top/?IRCQ=GNzbaU
Frame ID: FFFEFD7D7362B8626969C52BDBFDD2EE
Requests: 26 HTTP requests in this frame
Screenshot
Page Title
T-Mobile Tuesdays - Get Free Stuff & Great Deals | T-MobilePage URL History Show full URLs
-
http://t-mobile.com-qwv.top/?IRCQ=GNzbaU
HTTP 307
https://t-mobile.com-qwv.top/?IRCQ=GNzbaU Page URL
Detected technologies
Detected patterns
- <a[^>]*href=[^>]*/Cart
Detected patterns
- <[^>]+[^\w-]x-data[^\w-][^<]+
Detected patterns
- (?:/([\d.]+))?/vue(?:\.min)?\.js
Page Statistics
94 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: Cart
Search URL Search Domain Scan URL
Title: Plans
Search URL Search Domain Scan URL
Title: Unlimited Phone Plans
Search URL Search Domain Scan URL
Title: Unlimited Age 55+
Search URL Search Domain Scan URL
Title: Military & Veterans
Search URL Search Domain Scan URL
Title: First Responder
Search URL Search Domain Scan URL
Title: Home Internet Plans
Search URL Search Domain Scan URL
Title: Watch & Tablet Plans
Search URL Search Domain Scan URL
Title: Prepaid Phone Plans
Search URL Search Domain Scan URL
Title: Business Phone Plans
Search URL Search Domain Scan URL
Title: Phones & devices
Search URL Search Domain Scan URL
Title: Cell phones
Search URL Search Domain Scan URL
Title: 5G phones
Search URL Search Domain Scan URL
Title: Tablets
Search URL Search Domain Scan URL
Title: Smartwatches
Search URL Search Domain Scan URL
Title: Hotspots & more
Search URL Search Domain Scan URL
Title: Accessories
Search URL Search Domain Scan URL
Title: Bring your own device
Search URL Search Domain Scan URL
Title: Deals
Search URL Search Domain Scan URL
Title: See all deals
Search URL Search Domain Scan URL
Title: Apple
Search URL Search Domain Scan URL
Title: Samsung
Search URL Search Domain Scan URL
Title: Motorola
Search URL Search Domain Scan URL
Title: Google
Search URL Search Domain Scan URL
Title: Revvl
Search URL Search Domain Scan URL
Title: Free & Zero Down Phones
Search URL Search Domain Scan URL
Title: Coverage
Search URL Search Domain Scan URL
Title: Our network
Search URL Search Domain Scan URL
Title: 4G & 5G Coverage map
Search URL Search Domain Scan URL
Title: What is 5G
Search URL Search Domain Scan URL
Title: Satellite Phone Service
Search URL Search Domain Scan URL
Title: Rural & Small Towns
Search URL Search Domain Scan URL
Title: Try our network
Search URL Search Domain Scan URL
Title: 5G news
Search URL Search Domain Scan URL
Title: Home Internet
Search URL Search Domain Scan URL
Title: Join Us
Search URL Search Domain Scan URL
Title: How to switch
Search URL Search Domain Scan URL
Title: Help me pick a plan & phone
Search URL Search Domain Scan URL
Title: What makes us different
Search URL Search Domain Scan URL
Title: Bring your own phone
Search URL Search Domain Scan URL
Title: Keep your number
Search URL Search Domain Scan URL
Title: Keep & switch
Search URL Search Domain Scan URL
Title: Family Freedom
Search URL Search Domain Scan URL
Title: Try our network
Search URL Search Domain Scan URL
Title: See all benefits
Search URL Search Domain Scan URL
Title: TV & streaming
Search URL Search Domain Scan URL
Title: Travel benefits
Search URL Search Domain Scan URL
Title: Music & concert perks
Search URL Search Domain Scan URL
Title: Block scam calls
Search URL Search Domain Scan URL
Title: T-Mobile Tuesdays
Search URL Search Domain Scan URL
Title: Find a store
Search URL Search Domain Scan URL
Title: Contact & support
Search URL Search Domain Scan URL
Title: Check order status
Search URL Search Domain Scan URL
Title: Help & support
Search URL Search Domain Scan URL
Title: Login
Search URL Search Domain Scan URL
Title: Back to my account
Search URL Search Domain Scan URL
Title: Bill pay
Search URL Search Domain Scan URL
Title: Add a line
Search URL Search Domain Scan URL
Title: Upgrade
Search URL Search Domain Scan URL
Title: Check order status
Search URL Search Domain Scan URL
Title: Ask the Community
Search URL Search Domain Scan URL
Title: Wireless
Search URL Search Domain Scan URL
Title: Business
Search URL Search Domain Scan URL
Title: Prepaid
Search URL Search Domain Scan URL
Title: Internet
Search URL Search Domain Scan URL
Title: Privacy Policy
Search URL Search Domain Scan URL
Title: Do Not Sell or Share My Personal Information
Search URL Search Domain Scan URL
Title: Privacy Center
Search URL Search Domain Scan URL
Title: Book your trip
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: Explore our benefits
Search URL Search Domain Scan URL
Title: Instagram
Search URL Search Domain Scan URL
Title: Facebook
Search URL Search Domain Scan URL
Title: X
Search URL Search Domain Scan URL
Title: You Tube
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: About
Search URL Search Domain Scan URL
Title: Investor relations
Search URL Search Domain Scan URL
Title: Press
Search URL Search Domain Scan URL
Title: Careers
Search URL Search Domain Scan URL
Title: Deutsche Telekom
Search URL Search Domain Scan URL
Title: Puerto Rico
Search URL Search Domain Scan URL
Title: Privacy Notice
Search URL Search Domain Scan URL
Title: Trust Center
Search URL Search Domain Scan URL
Title: Consumer information
Search URL Search Domain Scan URL
Title: Public safety/911
Search URL Search Domain Scan URL
Title: Terms & conditions
Search URL Search Domain Scan URL
Title: Terms of use
Search URL Search Domain Scan URL
Title: Accessibility
Search URL Search Domain Scan URL
Title: Open Internet
Search URL Search Domain Scan URL
Title: Licenses & Patents
Search URL Search Domain Scan URL
Title: Consumer Health Data Privacy Notice
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://t-mobile.com-qwv.top/?IRCQ=GNzbaU
HTTP 307
https://t-mobile.com-qwv.top/?IRCQ=GNzbaU Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
26 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H3 |
Primary Request
/
t-mobile.com-qwv.top/ Redirect Chain
|
1 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
common.js
t-mobile.com-qwv.top/static/js/ |
967 B 909 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
axios.js
t-mobile.com-qwv.top/static/js/ |
42 KB 12 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
index.js
t-mobile.com-qwv.top/static/js/ |
10 KB 4 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
a_index.html
t-mobile.com-qwv.top/api/open/getTemplateData/US-Points-T-Mobile/ |
114 KB 22 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
favicon.ico
t-mobile.com-qwv.top/ |
1 KB 1 KB |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
docaflld7944.css
t-mobile.com-qwv.top/static/css/ |
136 KB 21 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
common.js
t-mobile.com-qwv.top/static/js/ |
967 B 0 |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
axios.js
t-mobile.com-qwv.top/static/js/ |
42 KB 0 |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
vue.js
t-mobile.com-qwv.top/static/js/ |
334 KB 92 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
main.js
t-mobile.com-qwv.top/static/js/ |
138 KB 41 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
check.js
t-mobile.com-qwv.top/static/js/ |
34 KB 11 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
img_4f8a997287f0_enw7i2.svg
t-mobile.com-qwv.top/static/img/ |
619 B 852 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
img_fbdeddb7a6d1_w37hxq.webp
t-mobile.com-qwv.top/static/img/ |
22 KB 23 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
img_12b4cf3cd4ac_74bqpd.svg
t-mobile.com-qwv.top/static/img/ |
7 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
img_326865703d0f_4uk8ra.svg
t-mobile.com-qwv.top/static/img/ |
6 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
img_04ff157e5d9e_kaldad.svg
t-mobile.com-qwv.top/static/img/ |
576 B 844 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
img_703fe0b04e0a_kgxkvs.woff2
t-mobile.com-qwv.top/static/font/ |
52 KB 52 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
img_be96930b1854_2tmghh.webp
t-mobile.com-qwv.top/static/img/ |
2 KB 3 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
img_d898cec47e5b_7ixrsy.webp
t-mobile.com-qwv.top/static/img/ |
483 KB 484 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
img_8d39235f2450_f2fh4t.webp
t-mobile.com-qwv.top/static/img/ |
276 KB 276 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
img_85951218b056_ebofvu.webp
t-mobile.com-qwv.top/static/img/ |
169 KB 170 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
img_4f8a997287f0_enw7i2.svg
t-mobile.com-qwv.top/static/img/ |
619 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
/
ipapi.co/json/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
json
ip-api.com/ |
107 B 291 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
json
ipinfo.io/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- ipapi.co
- URL
- https://ipapi.co/json/
- Domain
- ipinfo.io
- URL
- https://ipinfo.io/json
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Telekom (Telecommunication)13 JavaScript Window variables
These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.
object| cfg function| axios function| _0x2eb1 function| _0xa449 function| showLoading function| hideLoading function| reloadPage function| Vue function| _0x107a function| _0x2080 function| _0xf2c9 function| _0x3e6a function| AutoValidator0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
4 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ip-api.com
ipapi.co
ipinfo.io
t-mobile.com-qwv.top
ipapi.co
ipinfo.io
104.21.55.18
208.95.112.1
0f221ad66cae9746442f73eb2645ef00ed66102c0c73aed2a9c9eb591dae8f0c
159f0ac0c8f517aaa736003b6e13ebc959b5f7129db87e4e56bf2eec8d6d02d7
17a06184dbc0b0299323783d58f41d42a9bdccfffff22c79aa9c4369a2582d54
19ba22f5d6650afc5884daad69cfddb453d8e81ba9300360781d9c3b4580f6a1
35c7dab49ed926b15da52e696311911e95d9a3a44ccfea0896b61e25eabefaa0
3cce84d34c3f04a3d2f337e6c9fca5f2daac9bbf26b1139cb2c7afb209900b06
61fd702060224daad1fa949b448fcbebb9d3bc8628ffb942b44e8fa63dbd4c87
63136b6d11c9d34b26d0cc8a2674f8dfb6ba7822dc86d681a980e25f111946b3
6b4a725e775f6181cd9dff4a9079339f59b68e395430ec1d6e1e0a8b26dae3b2
6e22bb7eb268a4f17b22ac79ad535c779d257af8a32d8f71ff5dbdfa2b39c2ac
7148ba8c0c50e6b7a35101b70573f98d82e260bfbee700e2b2d0a95e09c6b492
724a616c4b09edb590278189979e33e564d2750da1a7406f156f3653ccfc8c5a
96b65382c74cd6255d4628044c5394f2ef3f0662d7d72b10f1bceb50b6ee5455
998eb6e8bbbdefebd59b4aefc8774d207dc078843cbd7de9af63c61429beed59
9ccb9c18720ffef78469805e7fe8f1c80daa2eb4502c854cfdbfb055064ff650
a58df955d1e5f78fafe028b6b404ecdc558bbba91a7d5b508f13e5ddffc5d2c9
c71a1aed463745d39ba361341c9274210142537418e4129708fdf83e20807ed5
d668fe7e2cb2720b0a3f77f441a0b9e8045ced8de9e25726f8586cd35a27e270
d862077db5fcdaf33c1e6226d80c31aaf2f1a721f06eeda4f088d831f8e71b7f
eae272e0f2329cd4d8e87ef4d2a97b94f09dc1b61f64a4472bacec250899ccb0
