www.logins.account.ionos.es.colegare.com
Open in
urlscan Pro
198.54.115.108
Malicious Activity!
Public Scan
Submission: On January 24 via automatic, source certstream-suspicious
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on January 24th 2021. Valid for: a year.
This is the only time www.logins.account.ionos.es.colegare.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: 1&1 Ionos (Telecommunication)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
6 | 198.54.115.108 198.54.115.108 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
1 | 217.160.86.27 217.160.86.27 | 8560 (IONOS-AS ...) (IONOS-AS This is the joint network for IONOS) | |
5 | 213.165.66.58 213.165.66.58 | 8560 (IONOS-AS ...) (IONOS-AS This is the joint network for IONOS) | |
12 | 4 |
ASN22612 (NAMECHEAP-NET, US)
PTR: server119-2.web-hosting.com
www.logins.account.ionos.es.colegare.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
uicdn.net
ias.uicdn.net ce1.uicdn.net |
259 KB |
6 |
colegare.com
www.logins.account.ionos.es.colegare.com |
78 KB |
12 | 2 |
Domain | Requested by | |
---|---|---|
6 | www.logins.account.ionos.es.colegare.com |
www.logins.account.ionos.es.colegare.com
|
5 | ce1.uicdn.net |
www.logins.account.ionos.es.colegare.com
|
1 | ias.uicdn.net |
www.logins.account.ionos.es.colegare.com
|
12 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
logins.account.ionos.es.colegare.com Sectigo RSA Domain Validation Secure Server CA |
2021-01-24 - 2022-01-24 |
a year | crt.sh |
ias.uicdn.net GeoTrust RSA CA 2018 |
2020-06-19 - 2022-06-24 |
2 years | crt.sh |
ce1.uicdn.net GeoTrust RSA CA 2018 |
2020-03-03 - 2022-03-08 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.logins.account.ionos.es.colegare.com/
Frame ID: 6944AFB7F641436894518AF1817DF0F3
Requests: 13 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
www.logins.account.ionos.es.colegare.com/ |
20 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css.min.css
www.logins.account.ionos.es.colegare.com/css/ |
184 KB 26 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login.min.css
www.logins.account.ionos.es.colegare.com/css/ |
15 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
navigation.css
www.logins.account.ionos.es.colegare.com/css/ |
132 KB 33 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
inpagelayer.css
www.logins.account.ionos.es.colegare.com/css/ |
26 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
statuspage.css
www.logins.account.ionos.es.colegare.com/css/ |
5 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mail-archiving-de-warning-promo.svg
ias.uicdn.net/fileadmin/ONEANDONE_HOSTING/user_upload/ |
7 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
opensans-regular.woff
ce1.uicdn.net/exos/fonts/open-sans/ |
62 KB 63 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
320 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
exos-icon-font.woff
ce1.uicdn.net/exos/icons/ |
48 KB 48 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
overpass-regular.woff
ce1.uicdn.net/exos/fonts/overpass/ |
42 KB 42 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
opensans-bold.woff
ce1.uicdn.net/exos/fonts/open-sans/ |
62 KB 62 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
overpass-bold.woff
ce1.uicdn.net/exos/fonts/overpass/ |
41 KB 41 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: 1&1 Ionos (Telecommunication)9 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ce1.uicdn.net
ias.uicdn.net
www.logins.account.ionos.es.colegare.com
198.54.115.108
213.165.66.58
217.160.86.27
295d52c2f31e06944ddf0e866fdbfc975a6e6717cdd3f564c4a1bcd11c22c494
2e1587380141daff4e10a8e3db8f7ae5887102ab7576bff43049590f637ac20b
3dd524de91f42f0589153cae2d0c4764b445b345f6cc3667aa84beb575609ac1
5deacfa144234f91827ce11e1b52042a8fb54a4e91a3ad641bbe4790bfc8a66b
63f46c1caaf763f77428c0421451580d509416da327613ecffe3009962534b11
7afccd9150b0fcbf1a1056e6cc6051c9b6d85a55da7bf1a7fb0f475c0b22facc
7d7a1a8ec55f31a6674fd2e2c41bcc6421a9aeb5cf161c6e93363f31347160f9
8039fa7e658abaa1a484042391d70143fa581e2535340fd6901585666ef945b0
89c964e03155b72a17f17d877ce96b4644b6cfd4715bb0cf5032fc195aec0c0d
9d27c279b8aef5083f4720d71b79ba18519d3f924955d7338932a5252555b669
a2324d78fa23878b6ad03de16af33e37576a1b76e1d722c3822f8099ea17f9c0
c8e1724edab4d29c68d698c71f04db98774a5ba4fb432e4d37bfb0beecdac987
d78e7ad4838a9fb4db11451b1db78ccd0b0c7b28f5787684ce2870918ce27bb5