bangggb-dot-domain-server-rf.ue.r.appspot.com Open in urlscan Pro
2a00:1450:4010:c0b::99 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://bangggb-dot-domain-server-rf.ue.r.appspot.com/
Submission: On October 07 via manual (October 7th 2020, 7:06:03 am UTC) from DE

Summary HTTP 14 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 14 HTTP transactions. The main IP is 2a00:1450:4010:c0b::99, located in Lappeenranta, Finland and belongs to GOOGLE, US. The main domain is bangggb-dot-domain-server-rf.ue.r.appspot.com.
TLS certificate: Issued by GTS CA 1O1 on September 3rd 2020. Valid for: 3 months.

This is the only time bangggb-dot-domain-server-rf.ue.r.appspot.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Telekom (Telecommunication)

Domain & IP information

	IP Address	AS Autonomous System
1	2a00:1450:401... 2a00:1450:4010:c0b::99	15169 (GOOGLE) (GOOGLE)
12	2003:2:2:140:... 2003:2:2:140:62:157:140:200	3320 (DTAG Inte...) (DTAG Internet service provider operations)
1	80.158.67.40 80.158.67.40	34086 (SCZN-AS) (SCZN-AS)
14	3

1 2a00:1450:4010:c0b::99 (Lappeenranta, Finland)

ASN15169 (GOOGLE, US)

bangggb-dot-domain-server-rf.ue.r.appspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2003:2:2:140:62:157:140:200 (Germany)

ASN3320 (DTAG Internet service provider operations, DE)

accounts.login.idm.telekom.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 80.158.67.40 (Germany)

ASN34086 (SCZN-AS, DE)

www.telekom.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	telekom.com accounts.login.idm.telekom.com	275 KB
1	telekom.de www.telekom.de
1	appspot.com bangggb-dot-domain-server-rf.ue.r.appspot.com	3 KB
14	3

	Domain	Requested by
12	accounts.login.idm.telekom.com	bangggb-dot-domain-server-rf.ue.r.appspot.com accounts.login.idm.telekom.com
1	www.telekom.de	bangggb-dot-domain-server-rf.ue.r.appspot.com
1	bangggb-dot-domain-server-rf.ue.r.appspot.com
14	3

This site contains links to these domains. Also see Links.

Domain
meinkonto.telekom-dienste.de
www.telekom.de
www.telekom.com

Subject Issuer	Validity	Valid
*.appspot.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
accounts.login.idm.telekom.com TeleSec ServerPass Extended Validation Class 3 CA	`2018-11-06` - `2020-11-11`	2 years	crt.sh
www.telekom.de TeleSec ServerPass Class 2 CA	`2020-08-11` - `2022-08-16`	2 years	crt.sh

This page contains 2 frames:

Primary Page: https://bangggb-dot-domain-server-rf.ue.r.appspot.com/
Frame ID: B4AC52453877B7165EF7B8E838CD322B
Requests: 13 HTTP requests in this frame

Frame: https://www.telekom.de/resources/tbs-config/phoenix_login_tracking?page=login&mode=web&context=auth&status=first_attempt
Frame ID: 2C9D735F00CE3DD1A15B0F1FC6B01EC2
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Google App Engine (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /Google Frontend/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

14
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

278 kB
Transfer

469 kB
Size

0
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://meinkonto.telekom-dienste.de/wiederherstellung/passwort/index.xhtml
Title: Benutzername oder Passwort vergessen?

Search URL Search Domain Scan URL

URL: https://www.telekom.de/hilfe/vertrag-meine-daten/login-daten-passwoerter
Title: Brauchen Sie Hilfe?

Search URL Search Domain Scan URL

URL: https://meinkonto.telekom-dienste.de/telekom/account/registration/assistant/index.xhtml?sid=telekomde
Title: Jetzt für Telekom.de registrieren

Search URL Search Domain Scan URL

URL: https://www.telekom.com/impressum
Title: Impressum

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
bangggb-dot-domain-server-rf.ue.r.appspot.com/ 8 KB
3 KB 297ms
180ms Document
text/html 2a00:1450:4010:c0b::99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://bangggb-dot-domain-server-rf.ue.r.appspot.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4010:c0b::99 Lappeenranta, Finland, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend /
Resource Hash: 00aaf456cd2a94a17e7ca4a65a8eef9ecb94fa2c8cc620c88a4e4efe7ed22ac8

Request headers

:method: GET
:authority: bangggb-dot-domain-server-rf.ue.r.appspot.com
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
content-type: text/html
content-encoding: gzip
x-cloud-trace-context: c9cfa3bbaf2e99c28ad8b42e06a822ee;o=1
vary: Accept-Encoding
date: Wed, 07 Oct 2020 07:05:46 GMT
server: Google Frontend
cache-control: private
content-length: 2549
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK components.min.css
accounts.login.idm.telekom.com/static/vdplus/css/ 85 KB
16 KB 148ms
18ms Stylesheet
text/css 2003:2:2:140:62:157:140:200
DTAG Internet ser...

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.login.idm.telekom.com/static/vdplus/css/components.min.css

Requested by

Host: bangggb-dot-domain-server-rf.ue.r.appspot.com
URL: https://bangggb-dot-domain-server-rf.ue.r.appspot.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2003:2:2:140:62:157:140:200 , Germany, ASN3320 (DTAG Internet service provider operations, DE),

Reverse DNS

Software

Apache /

Resource Hash

d9e120fd2798b90e1a4aed8b465d891de4ee81ee43cfc6a417ad2015bd3c6be3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://bangggb-dot-domain-server-rf.ue.r.appspot.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 07 Oct 2020 07:05:46 GMT
Content-Encoding: gzip
SH: 48a2a2f8015144cc8362d02caadc02cf
Last-Modified: Fri, 09 Feb 2018 10:23:53 GMT
Server: Apache
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains
P3P: CP="NOI CURa TAIa OUR NOR UNI"
Cache-Control: public
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Type: text/css; charset=utf-8
Keep-Alive: timeout=2, max=1000
Content-Length: 16024
Expires: Wed, 14 Oct 2020 07:05:46 GMT

GET
H/1.1 200
OK login.css
accounts.login.idm.telekom.com/static/factorx/vdplus/css/ 14 KB
3 KB 144ms
14ms Stylesheet
text/css 2003:2:2:140:62:157:140:200
DTAG Internet ser...

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.login.idm.telekom.com/static/factorx/vdplus/css/login.css

Requested by

Host: bangggb-dot-domain-server-rf.ue.r.appspot.com
URL: https://bangggb-dot-domain-server-rf.ue.r.appspot.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2003:2:2:140:62:157:140:200 , Germany, ASN3320 (DTAG Internet service provider operations, DE),

Reverse DNS

Software

Apache /

Resource Hash

8cdd18e870fddcc944d55829b4fd7181845a7dd76163fd8a609bcc581fba53a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://bangggb-dot-domain-server-rf.ue.r.appspot.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 07 Oct 2020 07:05:46 GMT
Content-Encoding: gzip
SH: 21ab42450f1ffff128f95f820c6189a5
Last-Modified: Thu, 08 Nov 2018 06:28:04 GMT
Server: Apache
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains
P3P: CP="NOI CURa TAIa OUR NOR UNI"
Cache-Control: public
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Type: text/css; charset=utf-8
Keep-Alive: timeout=2, max=1000
Content-Length: 3035
Expires: Wed, 14 Oct 2020 07:05:46 GMT

GET
H/1.1 200
OK services.png
accounts.login.idm.telekom.com/static/factorx/vdplus/images/ 22 KB
23 KB 145ms
16ms Image
image/png 2003:2:2:140:62:157:140:200
DTAG Internet ser...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://accounts.login.idm.telekom.com/static/factorx/vdplus/images/services.png

Requested by

Host: bangggb-dot-domain-server-rf.ue.r.appspot.com
URL: https://bangggb-dot-domain-server-rf.ue.r.appspot.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2003:2:2:140:62:157:140:200 , Germany, ASN3320 (DTAG Internet service provider operations, DE),

Reverse DNS

Software

Apache /

Resource Hash

14977cb7057352ad7715b93dec52f4993fc16980836d03b64f79566e8c9bec22

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://bangggb-dot-domain-server-rf.ue.r.appspot.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 07 Oct 2020 07:05:46 GMT
SH: 24bd52440b59a9c54a04fab4442b7384
Last-Modified: Tue, 20 Mar 2018 06:48:00 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000; includeSubDomains
P3P: CP="NOI CURa TAIa OUR NOR UNI"
Cache-Control: public
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Type: image/png
Keep-Alive: timeout=2, max=1000
Content-Length: 22647
Expires: Wed, 14 Oct 2020 07:05:46 GMT

GET
H/1.1 200
OK jquery-3.2.1.min.js Show response
accounts.login.idm.telekom.com/static/vdplus/js/ 85 KB
30 KB 152ms
22ms Script
text/javascript 2003:2:2:140:62:157:140:200
DTAG Internet ser...

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.login.idm.telekom.com/static/vdplus/js/jquery-3.2.1.min.js

Requested by

Host: bangggb-dot-domain-server-rf.ue.r.appspot.com
URL: https://bangggb-dot-domain-server-rf.ue.r.appspot.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2003:2:2:140:62:157:140:200 , Germany, ASN3320 (DTAG Internet service provider operations, DE),

Reverse DNS

Software

Apache /

Resource Hash

87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://bangggb-dot-domain-server-rf.ue.r.appspot.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 07 Oct 2020 07:05:46 GMT
Content-Encoding: gzip
SH: 094f0c8ad1c1f32f93e30becb4ca542a
Last-Modified: Tue, 20 Mar 2018 06:47:55 GMT
Server: Apache
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains
P3P: CP="NOI CURa TAIa OUR NOR UNI"
Cache-Control: public
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Type: text/javascript
Keep-Alive: timeout=2, max=1000
Content-Length: 30138
Expires: Wed, 14 Oct 2020 07:05:46 GMT

GET
H/1.1 200
OK components.min.js Show response
accounts.login.idm.telekom.com/static/vdplus/js/ 66 KB
21 KB 150ms
20ms Script
text/javascript 2003:2:2:140:62:157:140:200
DTAG Internet ser...

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.login.idm.telekom.com/static/vdplus/js/components.min.js

Requested by

Host: bangggb-dot-domain-server-rf.ue.r.appspot.com
URL: https://bangggb-dot-domain-server-rf.ue.r.appspot.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2003:2:2:140:62:157:140:200 , Germany, ASN3320 (DTAG Internet service provider operations, DE),

Reverse DNS

Software

Apache /

Resource Hash

e5a1bef74748388cadf99777549feff118627b888816a6f57fc0fb36e3cad57f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://bangggb-dot-domain-server-rf.ue.r.appspot.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 07 Oct 2020 07:05:46 GMT
Content-Encoding: gzip
SH: 094f0c8ad1c1f32f93e30becb4ca542a
Last-Modified: Wed, 07 Feb 2018 12:35:59 GMT
Server: Apache
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains
P3P: CP="NOI CURa TAIa OUR NOR UNI"
Cache-Control: public
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Type: text/javascript
Keep-Alive: timeout=2, max=1000
Content-Length: 20741
Expires: Wed, 14 Oct 2020 07:05:46 GMT

GET
H/1.1 200
OK login.js Show response
accounts.login.idm.telekom.com/static/factorx/vdplus/js/ 13 KB
4 KB 144ms
14ms Script
text/javascript 2003:2:2:140:62:157:140:200
DTAG Internet ser...

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.login.idm.telekom.com/static/factorx/vdplus/js/login.js

Requested by

Host: bangggb-dot-domain-server-rf.ue.r.appspot.com
URL: https://bangggb-dot-domain-server-rf.ue.r.appspot.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2003:2:2:140:62:157:140:200 , Germany, ASN3320 (DTAG Internet service provider operations, DE),

Reverse DNS

Software

Apache /

Resource Hash

4f45d9883e3e19f7eaf72e99e614335bf13d68446a9a09a6cd777940ad9597da

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://bangggb-dot-domain-server-rf.ue.r.appspot.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 07 Oct 2020 07:05:46 GMT
Content-Encoding: gzip
SH: 9291c7b1a9bd46c8c999944c8eb3a0fa
Last-Modified: Wed, 29 Apr 2020 06:11:57 GMT
Server: Apache
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains
P3P: CP="NOI CURa TAIa OUR NOR UNI"
Cache-Control: public
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Type: text/javascript
Keep-Alive: timeout=2, max=1000
Content-Length: 3222
Expires: Wed, 14 Oct 2020 07:05:46 GMT

GET
H/1.1 200
OK data_protection.svg
accounts.login.idm.telekom.com/static/factorx/vdplus/images/ 713 B
1 KB 14ms
13ms Image
image/svg+xml 2003:2:2:140:62:157:140:200
DTAG Internet ser...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://accounts.login.idm.telekom.com/static/factorx/vdplus/images/data_protection.svg

Requested by

Host: accounts.login.idm.telekom.com
URL: https://accounts.login.idm.telekom.com/static/factorx/vdplus/css/login.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2003:2:2:140:62:157:140:200 , Germany, ASN3320 (DTAG Internet service provider operations, DE),

Reverse DNS

Software

Apache /

Resource Hash

870c62606d520eb179f4bfe0edc1258a454811c692487cdb3ed9838582c5a22f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://accounts.login.idm.telekom.com/static/factorx/vdplus/css/login.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 07 Oct 2020 07:05:46 GMT
SH: 094f0c8ad1c1f32f93e30becb4ca542a
Last-Modified: Thu, 07 Mar 2019 14:49:19 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000; includeSubDomains
P3P: CP="NOI CURa TAIa OUR NOR UNI"
Cache-Control: public
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Type: image/svg+xml
Keep-Alive: timeout=2, max=999
Content-Length: 713
Expires: Wed, 07 Oct 2020 08:05:46 GMT

GET
H/1.1 200
OK telekomicon-outline.woff
accounts.login.idm.telekom.com/static/vdplus/fonts/ 9 KB
9 KB 38ms
12ms Font
application/x-font-woff 2003:2:2:140:62:157:140:200
DTAG Internet ser...

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.login.idm.telekom.com/static/vdplus/fonts/telekomicon-outline.woff

Requested by

Host: accounts.login.idm.telekom.com
URL: https://accounts.login.idm.telekom.com/static/vdplus/css/components.min.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2003:2:2:140:62:157:140:200 , Germany, ASN3320 (DTAG Internet service provider operations, DE),

Reverse DNS

Software

Apache /

Resource Hash

e185aceb03040c947c211bc9e972ce427f11c5801338fd8f943e3b53e229eb3e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://bangggb-dot-domain-server-rf.ue.r.appspot.com
Referer: https://accounts.login.idm.telekom.com/static/vdplus/css/components.min.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 07 Oct 2020 07:05:46 GMT
SH: 62334c584583da8666d3dfbba4a10381
Last-Modified: Wed, 07 Feb 2018 12:36:00 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000; includeSubDomains
P3P: CP="NOI CURa TAIa OUR NOR UNI"
Access-Control-Allow-Origin: https://bangggb-dot-domain-server-rf.ue.r.appspot.com
Cache-Control: public
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Type: application/x-font-woff
Keep-Alive: timeout=2, max=1000
Content-Length: 8756
Expires: Wed, 14 Oct 2020 07:05:46 GMT

GET
H/1.1 200
OK telegroteskscreen-bold.woff
accounts.login.idm.telekom.com/static/vdplus/fonts/ 53 KB
53 KB 43ms
13ms Font
application/x-font-woff 2003:2:2:140:62:157:140:200
DTAG Internet ser...

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.login.idm.telekom.com/static/vdplus/fonts/telegroteskscreen-bold.woff

Requested by

Host: accounts.login.idm.telekom.com
URL: https://accounts.login.idm.telekom.com/static/vdplus/css/components.min.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2003:2:2:140:62:157:140:200 , Germany, ASN3320 (DTAG Internet service provider operations, DE),

Reverse DNS

Software

Apache /

Resource Hash

e1b1f6b64573c86c3b9f5f023ab7e791a074dbccb87d61e886cb6fa659ba9485

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://bangggb-dot-domain-server-rf.ue.r.appspot.com
Referer: https://accounts.login.idm.telekom.com/static/vdplus/css/components.min.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 07 Oct 2020 07:05:46 GMT
SH: e9435748c17293f4a27bd767c73f3198
Last-Modified: Mon, 12 Feb 2018 10:52:54 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000; includeSubDomains
P3P: CP="NOI CURa TAIa OUR NOR UNI"
Access-Control-Allow-Origin: https://bangggb-dot-domain-server-rf.ue.r.appspot.com
Cache-Control: public
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Type: application/x-font-woff
Keep-Alive: timeout=2, max=1000
Content-Length: 53864
Expires: Wed, 14 Oct 2020 07:05:46 GMT

GET
H/1.1 200
OK telegroteskscreen-thin.woff
accounts.login.idm.telekom.com/static/vdplus/fonts/ 57 KB
58 KB 43ms
12ms Font
application/x-font-woff 2003:2:2:140:62:157:140:200
DTAG Internet ser...

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.login.idm.telekom.com/static/vdplus/fonts/telegroteskscreen-thin.woff

Requested by

Host: accounts.login.idm.telekom.com
URL: https://accounts.login.idm.telekom.com/static/vdplus/css/components.min.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2003:2:2:140:62:157:140:200 , Germany, ASN3320 (DTAG Internet service provider operations, DE),

Reverse DNS

Software

Apache /

Resource Hash

43493c8fdfe7935a395920ef619a4dc56c440479ce190ad2ac1df8e23acc5595

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://bangggb-dot-domain-server-rf.ue.r.appspot.com
Referer: https://accounts.login.idm.telekom.com/static/vdplus/css/components.min.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 07 Oct 2020 07:05:46 GMT
SH: 4194a5e2d0d7b40759d719349ca67bb4
Last-Modified: Mon, 12 Feb 2018 13:07:34 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000; includeSubDomains
P3P: CP="NOI CURa TAIa OUR NOR UNI"
Access-Control-Allow-Origin: https://bangggb-dot-domain-server-rf.ue.r.appspot.com
Cache-Control: public
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Type: application/x-font-woff
Keep-Alive: timeout=2, max=1000
Content-Length: 58656
Expires: Wed, 14 Oct 2020 07:05:46 GMT

GET
H/1.1 200
OK telegroteskscreen-regular.woff
accounts.login.idm.telekom.com/static/vdplus/fonts/ 54 KB
54 KB 45ms
14ms Font
application/x-font-woff 2003:2:2:140:62:157:140:200
DTAG Internet ser...

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.login.idm.telekom.com/static/vdplus/fonts/telegroteskscreen-regular.woff

Requested by

Host: accounts.login.idm.telekom.com
URL: https://accounts.login.idm.telekom.com/static/vdplus/css/components.min.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2003:2:2:140:62:157:140:200 , Germany, ASN3320 (DTAG Internet service provider operations, DE),

Reverse DNS

Software

Apache /

Resource Hash

21d4dc49ec496581969051f9f542afee01f9029e7db6112bff99e7be2942de53

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://bangggb-dot-domain-server-rf.ue.r.appspot.com
Referer: https://accounts.login.idm.telekom.com/static/vdplus/css/components.min.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 07 Oct 2020 07:05:46 GMT
SH: 4105aead3b7c66615611eecd9f02c7e5
Last-Modified: Mon, 12 Feb 2018 09:30:21 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000; includeSubDomains
P3P: CP="NOI CURa TAIa OUR NOR UNI"
Access-Control-Allow-Origin: https://bangggb-dot-domain-server-rf.ue.r.appspot.com
Cache-Control: public
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Type: application/x-font-woff
Keep-Alive: timeout=2, max=1000
Content-Length: 55044
Expires: Wed, 14 Oct 2020 07:05:46 GMT

GET
H2 200 phoenix_login_tracking
www.telekom.de/resources/tbs-config/ Frame 2C9D 0
0 116ms
38ms Document
text/html 80.158.67.40
SCZN-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.telekom.de/resources/tbs-config/phoenix_login_tracking?page=login&mode=web&context=auth&status=first_attempt
Requested by: Host: bangggb-dot-domain-server-rf.ue.r.appspot.com
URL: https://bangggb-dot-domain-server-rf.ue.r.appspot.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 80.158.67.40 , Germany, ASN34086 (SCZN-AS, DE),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

:method: GET
:authority: www.telekom.de
:scheme: https
:path: /resources/tbs-config/phoenix_login_tracking?page=login&mode=web&context=auth&status=first_attempt
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://bangggb-dot-domain-server-rf.ue.r.appspot.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://bangggb-dot-domain-server-rf.ue.r.appspot.com/

Response headers

status: 200
date: Wed, 07 Oct 2020 06:29:01 GMT
server: Apache
content-disposition: inline; filename="phoenix_login_tracking.html"
etag: "8bc87a15f4a7ebacfcf91ab31f7682be"
cache-control: max-age=3600
xkey: 301466
content-type: text/html;charset=UTF-8
content-language: de
x-varnish: 266640968 266782339
age: 2205
x-cache: HIT
accept-ranges: bytes
set-cookie: www.telekom.de=!LxD6NOu2a2ZVb28P114zXks+FUdEO3KuQkYr72x0TY1KxQhY1XlKw1VhfiYrtUftqXNmGBw2mdBsgCW3+WrDgjLql/U27orUWsvWQEQ3e2k=; path=/; Httponly; Secure
vary: Accept-Encoding
content-encoding: gzip
content-length: 1233

GET
H/1.1 200
OK telekomicon-ui.woff
accounts.login.idm.telekom.com/static/vdplus/fonts/ 3 KB
3 KB 13ms
13ms Font
application/x-font-woff 2003:2:2:140:62:157:140:200
DTAG Internet ser...

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.login.idm.telekom.com/static/vdplus/fonts/telekomicon-ui.woff

Requested by

Host: accounts.login.idm.telekom.com
URL: https://accounts.login.idm.telekom.com/static/vdplus/css/components.min.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2003:2:2:140:62:157:140:200 , Germany, ASN3320 (DTAG Internet service provider operations, DE),

Reverse DNS

Software

Apache /

Resource Hash

345466d497966801ab4b5390c09e49d03f2ede8539bd35a56e25ed15bb2dc80e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://bangggb-dot-domain-server-rf.ue.r.appspot.com
Referer: https://accounts.login.idm.telekom.com/static/vdplus/css/components.min.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 07 Oct 2020 07:05:47 GMT
SH: 4105aead3b7c66615611eecd9f02c7e5
Last-Modified: Mon, 12 Feb 2018 09:30:21 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000; includeSubDomains
P3P: CP="NOI CURa TAIa OUR NOR UNI"
Access-Control-Allow-Origin: https://bangggb-dot-domain-server-rf.ue.r.appspot.com
Cache-Control: public
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Type: application/x-font-woff
Keep-Alive: timeout=2, max=999
Content-Length: 2676
Expires: Wed, 14 Oct 2020 07:05:47 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Telekom (Telecommunication)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

accounts.login.idm.telekom.com
bangggb-dot-domain-server-rf.ue.r.appspot.com
www.telekom.de
2003:2:2:140:62:157:140:200
2a00:1450:4010:c0b::99
80.158.67.40
00aaf456cd2a94a17e7ca4a65a8eef9ecb94fa2c8cc620c88a4e4efe7ed22ac8
14977cb7057352ad7715b93dec52f4993fc16980836d03b64f79566e8c9bec22
21d4dc49ec496581969051f9f542afee01f9029e7db6112bff99e7be2942de53
345466d497966801ab4b5390c09e49d03f2ede8539bd35a56e25ed15bb2dc80e
43493c8fdfe7935a395920ef619a4dc56c440479ce190ad2ac1df8e23acc5595
4f45d9883e3e19f7eaf72e99e614335bf13d68446a9a09a6cd777940ad9597da
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
870c62606d520eb179f4bfe0edc1258a454811c692487cdb3ed9838582c5a22f
8cdd18e870fddcc944d55829b4fd7181845a7dd76163fd8a609bcc581fba53a3
d9e120fd2798b90e1a4aed8b465d891de4ee81ee43cfc6a417ad2015bd3c6be3
e185aceb03040c947c211bc9e972ce427f11c5801338fd8f943e3b53e229eb3e
e1b1f6b64573c86c3b9f5f023ab7e791a074dbccb87d61e886cb6fa659ba9485
e5a1bef74748388cadf99777549feff118627b888816a6f57fc0fb36e3cad57f

bangggb-dot-domain-server-rf.ue.r.appspot.com Open in urlscan Pro 2a00:1450:4010:c0b::99 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

14 Requests

100 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

278 kBTransfer

469 kBSize

0 Cookies

4 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

0 Cookies

Indicators

bangggb-dot-domain-server-rf.ue.r.appspot.com Open in urlscan Pro
2a00:1450:4010:c0b::99 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

278 kB
Transfer

469 kB
Size

0
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!