www-kundencenter.net
Open in
urlscan Pro
2606:4700:30::681b:8fc4
Malicious Activity!
Public Scan
Effective URL: https://www-kundencenter.net/.deutsch/account/login/idm/oauth2/login.php?sessionID=1Jl8ftbs2M4314DICjuaV5O9AkiUTeeEPT5epu1Cq6...
Submission: On December 03 via manual from DE
Summary
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on December 2nd 2019. Valid for: 10 months.
This is the only time www-kundencenter.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Telekom (Telecommunication)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 75.126.100.11 75.126.100.11 | 36351 (SOFTLAYER) (SOFTLAYER - SoftLayer Technologies Inc.) | |
1 1 | 2606:4700:30:... 2606:4700:30::681b:adbf | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 19 | 2606:4700:30:... 2606:4700:30::681b:8fc4 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
18 | 1 |
ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US)
PTR: b.64.7e4b.ip4.static.sl-reverse.com
c6rp0pmy3vz.visitmacapa.com |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
goldmanndir.com |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
www-kundencenter.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
19 |
www-kundencenter.net
1 redirects
www-kundencenter.net |
328 KB |
1 |
goldmanndir.com
1 redirects
goldmanndir.com |
382 B |
1 |
visitmacapa.com
1 redirects
c6rp0pmy3vz.visitmacapa.com |
222 B |
18 | 3 |
Domain | Requested by | |
---|---|---|
19 | www-kundencenter.net |
1 redirects
www-kundencenter.net
|
1 | goldmanndir.com | 1 redirects |
1 | c6rp0pmy3vz.visitmacapa.com | 1 redirects |
18 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com CloudFlare Inc ECC CA-2 |
2019-12-02 - 2020-10-09 |
10 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://www-kundencenter.net/.deutsch/account/login/idm/oauth2/login.php?sessionID=1Jl8ftbs2M4314DICjuaV5O9AkiUTeeEPT5epu1Cq6UTtk0RslMCB1KPHx8t4F65NE9nnHEt07q4zLKALxQwtIMUFfrdtlArMTO7
Frame ID: 260DC7B993473ECB64B79D4DA75E4439
Requests: 18 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://c6rp0pmy3vz.visitmacapa.com/
HTTP 301
https://goldmanndir.com/msn.com/ HTTP 302
https://www-kundencenter.net/.deutsch/account/login/idm/oauth2/ HTTP 302
https://www-kundencenter.net/.deutsch/account/login/idm/oauth2/login.php?sessionID=1Jl8ftbs2M4314DICjuaV5... Page URL
Detected technologies
CloudFlare (CDN) ExpandDetected patterns
- headers server /^cloudflare$/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery[.-]([\d.]*\d)[^\/]*\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://c6rp0pmy3vz.visitmacapa.com/
HTTP 301
https://goldmanndir.com/msn.com/ HTTP 302
https://www-kundencenter.net/.deutsch/account/login/idm/oauth2/ HTTP 302
https://www-kundencenter.net/.deutsch/account/login/idm/oauth2/login.php?sessionID=1Jl8ftbs2M4314DICjuaV5O9AkiUTeeEPT5epu1Cq6UTtk0RslMCB1KPHx8t4F65NE9nnHEt07q4zLKALxQwtIMUFfrdtlArMTO7 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
18 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
login.php
www-kundencenter.net/.deutsch/account/login/idm/oauth2/ Redirect Chain
|
11 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
components.min.css
www-kundencenter.net/.deutsch/account/login/idm/oauth2/css/ |
112 KB 17 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login-20.28.0.css
www-kundencenter.net/.deutsch/account/login/idm/oauth2/css/ |
17 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.2.1.min.js
www-kundencenter.net/.deutsch/account/login/idm/oauth2/js/ |
85 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-matchheight-0.7.2.min.js
www-kundencenter.net/.deutsch/account/login/idm/oauth2/js/ |
3 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
components.min.js
www-kundencenter.net/.deutsch/account/login/idm/oauth2/js/ |
76 KB 22 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login.js
www-kundencenter.net/.deutsch/account/login/idm/oauth2/js/ |
11 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
import-event.asc
www-kundencenter.net/.deutsch/account/login/idm/oauth2/ |
808 B 808 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wt.gif
www-kundencenter.net/.deutsch/account/login/idm/oauth2/ |
808 B 808 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
services.png
www-kundencenter.net/.deutsch/account/login/idm/oauth2/css/ |
22 KB 22 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
telegroteskscreen-regular.woff
www-kundencenter.net/.deutsch/account/login/idm/oauth2/css/ |
53 KB 54 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
data_protection.svg
www-kundencenter.net/.deutsch/account/login/idm/oauth2/css/ |
713 B 521 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
teleicon-outline.woff
www-kundencenter.net/.deutsch/account/login/idm/oauth2/css/ |
9 KB 9 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
telegroteskscreen-ultra.woff
www-kundencenter.net/.deutsch/account/login/idm/oauth2/css/ |
52 KB 52 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
telegroteskscreen-bold.woff
www-kundencenter.net/.deutsch/account/login/idm/oauth2/css/ |
52 KB 52 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
telegroteskscreen-thin.woff
www-kundencenter.net/.deutsch/account/login/idm/oauth2/css/ |
57 KB 57 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
teleicon-ui.woff
www-kundencenter.net/.deutsch/account/login/idm/oauth2/css/ |
3 KB 2 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
finger.php
www-kundencenter.net/.deutsch/account/login/idm/oauth2/ |
0 56 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Telekom (Telecommunication)13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate boolean| accountLocked boolean| accountLockedPermanent number| accountLockExpiration boolean| loginFailed function| $ function| jQuery object| Login function| getWebGL function| getWindowScreen function| getNavigator object| xhr2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
www-kundencenter.net/ | Name: PHPSESSID Value: 1kc1k2da3n8th0dhn1plovkk1p |
|
.www-kundencenter.net/ | Name: __cfduid Value: d46f8ea7715eabb44be81919c145f688e1575375755 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
c6rp0pmy3vz.visitmacapa.com
goldmanndir.com
www-kundencenter.net
2606:4700:30::681b:8fc4
2606:4700:30::681b:adbf
75.126.100.11
01fa42140c7fd1e43496b320027681e75123e8121c4ff52e7a390a4ec37d9379
13be304d3959cb753d99087f4507716b90b7bfdde18818361d866db28479cec2
14977cb7057352ad7715b93dec52f4993fc16980836d03b64f79566e8c9bec22
3b6317d7c6288f6380f182e8bdc16b4cea82df91bc0f0209dfbce457b3e16910
3c3cff57406992d5b880806e120965b2a77f6a9ac1bbe7a781bfc9f752b4ab5c
3cf35b128c4c5dcd9bb0a12bcc009f2e46e382edec4737360a623d0052a6fe34
42d274b3c3f7c6565c2f3cc9b009770f143ceca121b91bc25f844f7040f18c94
6a5dfa460646f43a53d43ff6422b80caac9592ad9b854e381b6ded4992f4120a
6ebd3995a2d04fc1550f8d025400411954fdb51dcaa24def899d8fc33b2504a7
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
870c62606d520eb179f4bfe0edc1258a454811c692487cdb3ed9838582c5a22f
88f82759b9fe3bfd5ee2ee3041757b18dd8c93004c21866e13017aeed614857e
8fb4dacc85198fcdab2b59b4b744d2c125a79e0ffd39f34cfe2593bfbd2ddea0
b80effdb6b1baee7ad8a926a027a9f085d0b91a1b52e3a8cf34e9a6b087aad97
b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187
dff75c72abbd5b70b8cf2acb31155760116d14517cc89b81d00285da85306497
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855