mobile.de-request-jg3iw5d.xyz Open in urlscan Pro
45.130.41.7  Malicious Activity! Public Scan

Submitted URL: https://mobile.de-request-jg3iw5d.xyz/
Effective URL: https://mobile.de-request-jg3iw5d.xyz/signin_openid.pape.max_auth_age=0&openid.identity=/auth.php?a=60cd18186adf7&_encoding=UTF8&ignor...
Submission Tags: 7184846
Submission: On June 18 via api from NL

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 1 HTTP transactions. The main IP is 45.130.41.7, located in Russian Federation and belongs to BEGET-AS, RU. The main domain is mobile.de-request-jg3iw5d.xyz.
TLS certificate: Issued by R3 on June 15th 2021. Valid for: 3 months.
This is the only time mobile.de-request-jg3iw5d.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: mobile.de (Marketplace)

Domain & IP information

IP Address AS Autonomous System
1 2 45.130.41.7 198610 (BEGET-AS)
1 2
Apex Domain
Subdomains
Transfer
2 de-request-jg3iw5d.xyz
mobile.de-request-jg3iw5d.xyz
134 KB
1 1
Domain Requested by
2 mobile.de-request-jg3iw5d.xyz 1 redirects
1 1

This site contains links to these domains. Also see Links.

Domain
www.mobile.de
promo.mobile.de
login.mobile.de
Subject Issuer Validity Valid
de-request-jg3iw5d.xyz
R3
2021-06-15 -
2021-09-13
3 months crt.sh

This page contains 1 frames:

Primary Page: https://mobile.de-request-jg3iw5d.xyz/signin_openid.pape.max_auth_age=0&openid.identity=/auth.php?a=60cd18186adf7&_encoding=UTF8&ignoreAuthState=1&openid.assoc_handle=deflex&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.mode=checkid_setup&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&openid.ns.pape=http%3A%2F%2Fspecs.openid.net%2Fextensions%2Fpape%2F1.0&openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.mobile.de%2F%3Fref_%3Dnav_signin&switch_account=
Frame ID: 7F9B61E284B7EC4105CB7A40EE385F13
Requests: 7 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://mobile.de-request-jg3iw5d.xyz/ HTTP 302
    https://mobile.de-request-jg3iw5d.xyz/signin_openid.pape.max_auth_age=0&openid.identity=/auth.php?a=60cd18186adf7&... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Overall confidence: 100%
Detected patterns
  • script /jquery[.-]([\d.]*\d)[^/]*\.js/i
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

1
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

133 kB
Transfer

344 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://mobile.de-request-jg3iw5d.xyz/ HTTP 302
    https://mobile.de-request-jg3iw5d.xyz/signin_openid.pape.max_auth_age=0&openid.identity=/auth.php?a=60cd18186adf7&_encoding=UTF8&ignoreAuthState=1&openid.assoc_handle=deflex&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.mode=checkid_setup&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&openid.ns.pape=http%3A%2F%2Fspecs.openid.net%2Fextensions%2Fpape%2F1.0&openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.mobile.de%2F%3Fref_%3Dnav_signin&switch_account= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

1 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request auth.php
mobile.de-request-jg3iw5d.xyz/signin_openid.pape.max_auth_age=0&openid.identity=/
Redirect Chain
  • https://mobile.de-request-jg3iw5d.xyz/
  • https://mobile.de-request-jg3iw5d.xyz/signin_openid.pape.max_auth_age=0&openid.identity=/auth.php?a=60cd18186adf7&_encoding=UTF8&ignoreAuthState=1&openid.assoc_handle=deflex&openid.claimed_id=http%...
209 KB
133 KB
Document
General
Full URL
https://mobile.de-request-jg3iw5d.xyz/signin_openid.pape.max_auth_age=0&openid.identity=/auth.php?a=60cd18186adf7&_encoding=UTF8&ignoreAuthState=1&openid.assoc_handle=deflex&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.mode=checkid_setup&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&openid.ns.pape=http%3A%2F%2Fspecs.openid.net%2Fextensions%2Fpape%2F1.0&openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.mobile.de%2F%3Fref_%3Dnav_signin&switch_account=
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.130.41.7 , Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS
ssl.bullet.beget.com
Software
nginx-reuseport/1.13.4 / PHP/5.6.40
Resource Hash
2178538ce03478d490eeab95af1d5773fefac9fa34841b21e523170ed25111d7

Request headers

:method
GET
:authority
mobile.de-request-jg3iw5d.xyz
:scheme
https
:path
/signin_openid.pape.max_auth_age=0&openid.identity=/auth.php?a=60cd18186adf7&_encoding=UTF8&ignoreAuthState=1&openid.assoc_handle=deflex&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.mode=checkid_setup&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&openid.ns.pape=http%3A%2F%2Fspecs.openid.net%2Fextensions%2Fpape%2F1.0&openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.mobile.de%2F%3Fref_%3Dnav_signin&switch_account=
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

server
nginx-reuseport/1.13.4
date
Fri, 18 Jun 2021 22:03:04 GMT
content-type
text/html
vary
Accept-Encoding
x-powered-by
PHP/5.6.40
content-encoding
gzip

Redirect headers

server
nginx-reuseport/1.13.4
date
Fri, 18 Jun 2021 22:03:04 GMT
content-type
text/html
content-length
0
x-powered-by
PHP/5.6.40
location
https://mobile.de-request-jg3iw5d.xyz/signin_openid.pape.max_auth_age=0&openid.identity=/auth.php?a=60cd18186adf7&_encoding=UTF8&ignoreAuthState=1&openid.assoc_handle=deflex&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.mode=checkid_setup&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&openid.ns.pape=http%3A%2F%2Fspecs.openid.net%2Fextensions%2Fpape%2F1.0&openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.mobile.de%2F%3Fref_%3Dnav_signin&switch_account=
truncated
/
38 KB
0
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash

Request headers

Origin
https://mobile.de-request-jg3iw5d.xyz
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
text/plain
truncated
/
19 KB
0
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash

Request headers

Origin
https://mobile.de-request-jg3iw5d.xyz
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
text/plain
truncated
/
3 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9438113100ff089d191a01c1b464f86963be589cd06c182b0c8b71fc95bd2200

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=US-ASCII
truncated
/
73 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e572aae1298f3288f49d9c7e876c357c50d21398a2964ebe55f829e62f938bb3

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/
635 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
fdd76cfb61c285606bea4a8662a0b4451e599a80b3847e452bfb5a5b5207131d

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9f4b95b244a872b7788d808d07f036a2eda6e59fedcb8dc82e0948675c23b6fc

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=US-ASCII

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: mobile.de (Marketplace)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| checkform

0 Cookies