urlscan.io logo urlscan.io
SecurityTrails logo

mobile.de-request-jg3iw5d.xyz Open in urlscan Pro
45.130.41.7  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://data-processor.club/?user_fall_834twjfads
Effective URL: https://mobile.de-request-jg3iw5d.xyz/signin_openid.pape.max_auth_age=0&openid.identity=/auth.php?a=60cd182f62198&_encoding=UTF8&ignor...
Submission Tags: 7184848
Submission: On June 18 via api from NL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 2 HTTP transactions. The main IP is 45.130.41.7, located in Russian Federation and belongs to BEGET-AS, RU. The main domain is mobile.de-request-jg3iw5d.xyz.
TLS certificate: Issued by R3 on June 15th 2021. Valid for: 3 months.
This is the only time mobile.de-request-jg3iw5d.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: mobile.de (Marketplace)

Domain & IP information

IP Address AS Autonomous System
1 3 45.130.41.7 198610 (BEGET-AS)
2 2
Apex Domain
Subdomains		 Transfer
2 de-request-jg3iw5d.xyz
mobile.de-request-jg3iw5d.xyz
134 KB
1 data-processor.club
data-processor.club
232 B
2 2
Domain Requested by
2 mobile.de-request-jg3iw5d.xyz 1 redirects data-processor.club
1 data-processor.club
2 2

This site contains links to these domains. Also see Links.

Domain
www.mobile.de
promo.mobile.de
login.mobile.de
Subject Issuer Validity Valid
data-processor.club
R3		 2021-06-15 -
2021-09-13		 3 months crt.sh
de-request-jg3iw5d.xyz
R3		 2021-06-15 -
2021-09-13		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://mobile.de-request-jg3iw5d.xyz/signin_openid.pape.max_auth_age=0&openid.identity=/auth.php?a=60cd182f62198&_encoding=UTF8&ignoreAuthState=1&openid.assoc_handle=deflex&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.mode=checkid_setup&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&openid.ns.pape=http%3A%2F%2Fspecs.openid.net%2Fextensions%2Fpape%2F1.0&openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.mobile.de%2F%3Fref_%3Dnav_signin&switch_account=
Frame ID: B03F2509DCD0C71E903B65187CD840A6
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://data-processor.club/?user_fall_834twjfads Page URL
  2. https://mobile.de-request-jg3iw5d.xyz/ HTTP 302
    https://mobile.de-request-jg3iw5d.xyz/signin_openid.pape.max_auth_age=0&openid.identity=/auth.php?a=60cd182f62198&... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • script /jquery[.-]([\d.]*\d)[^/]*\.js/i
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

2
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

134 kB
Transfer

344 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://data-processor.club/?user_fall_834twjfads Page URL
  2. https://mobile.de-request-jg3iw5d.xyz/ HTTP 302
    https://mobile.de-request-jg3iw5d.xyz/signin_openid.pape.max_auth_age=0&openid.identity=/auth.php?a=60cd182f62198&_encoding=UTF8&ignoreAuthState=1&openid.assoc_handle=deflex&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.mode=checkid_setup&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&openid.ns.pape=http%3A%2F%2Fspecs.openid.net%2Fextensions%2Fpape%2F1.0&openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.mobile.de%2F%3Fref_%3Dnav_signin&switch_account= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
data-processor.club/ 		103 B
232 B 		Document
General
Check archive.org
Download Go to
Full URL
https://data-processor.club/?user_fall_834twjfads
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.130.41.7 , Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS
ssl.bullet.beget.com
Software
nginx-reuseport/1.13.4 / PHP/5.6.40
Resource Hash
522a7470be1bc33b8551ad9310a8de03b2425532d21a4bad45d27fa8051b4451

Request headers

:method
GET
:authority
data-processor.club
:scheme
https
:path
/?user_fall_834twjfads
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

server
nginx-reuseport/1.13.4
date
Fri, 18 Jun 2021 22:03:27 GMT
content-type
text/html
vary
Accept-Encoding
x-powered-by
PHP/5.6.40
content-encoding
gzip
Primary Request auth.php
mobile.de-request-jg3iw5d.xyz/signin_openid.pape.max_auth_age=0&openid.identity=/
Redirect Chain
  • https://mobile.de-request-jg3iw5d.xyz/
  • https://mobile.de-request-jg3iw5d.xyz/signin_openid.pape.max_auth_age=0&openid.identity=/auth.php?a=60cd182f62198&_encoding=UTF8&ignoreAuthState=1&openid.assoc_handle=deflex&openid.claimed_id=http%...
209 KB
133 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://mobile.de-request-jg3iw5d.xyz/signin_openid.pape.max_auth_age=0&openid.identity=/auth.php?a=60cd182f62198&_encoding=UTF8&ignoreAuthState=1&openid.assoc_handle=deflex&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.mode=checkid_setup&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&openid.ns.pape=http%3A%2F%2Fspecs.openid.net%2Fextensions%2Fpape%2F1.0&openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.mobile.de%2F%3Fref_%3Dnav_signin&switch_account=
Requested by
Host: data-processor.club
URL: https://data-processor.club/?user_fall_834twjfads
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.130.41.7 , Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS
ssl.bullet.beget.com
Software
nginx-reuseport/1.13.4 / PHP/5.6.40
Resource Hash
151109897519bd8eba60ce789073ebc1246ff1842e8832b87a3756001390fb7f

Request headers

:method
GET
:authority
mobile.de-request-jg3iw5d.xyz
:scheme
https
:path
/signin_openid.pape.max_auth_age=0&openid.identity=/auth.php?a=60cd182f62198&_encoding=UTF8&ignoreAuthState=1&openid.assoc_handle=deflex&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.mode=checkid_setup&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&openid.ns.pape=http%3A%2F%2Fspecs.openid.net%2Fextensions%2Fpape%2F1.0&openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.mobile.de%2F%3Fref_%3Dnav_signin&switch_account=
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://data-processor.club/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://data-processor.club/?user_fall_834twjfads

Response headers

server
nginx-reuseport/1.13.4
date
Fri, 18 Jun 2021 22:03:27 GMT
content-type
text/html
vary
Accept-Encoding
x-powered-by
PHP/5.6.40
content-encoding
gzip

Redirect headers

server
nginx-reuseport/1.13.4
date
Fri, 18 Jun 2021 22:03:27 GMT
content-type
text/html
content-length
0
x-powered-by
PHP/5.6.40
location
https://mobile.de-request-jg3iw5d.xyz/signin_openid.pape.max_auth_age=0&openid.identity=/auth.php?a=60cd182f62198&_encoding=UTF8&ignoreAuthState=1&openid.assoc_handle=deflex&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.mode=checkid_setup&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&openid.ns.pape=http%3A%2F%2Fspecs.openid.net%2Fextensions%2Fpape%2F1.0&openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.mobile.de%2F%3Fref_%3Dnav_signin&switch_account=
truncated
/ 		38 KB
0 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash

Request headers

Origin
https://mobile.de-request-jg3iw5d.xyz
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
text/plain
truncated
/ 		19 KB
0 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash

Request headers

Origin
https://mobile.de-request-jg3iw5d.xyz
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
text/plain
truncated
/ 		3 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9438113100ff089d191a01c1b464f86963be589cd06c182b0c8b71fc95bd2200

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=US-ASCII
truncated
/ 		73 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e572aae1298f3288f49d9c7e876c357c50d21398a2964ebe55f829e62f938bb3

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/ 		635 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
fdd76cfb61c285606bea4a8662a0b4451e599a80b3847e452bfb5a5b5207131d

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9f4b95b244a872b7788d808d07f036a2eda6e59fedcb8dc82e0948675c23b6fc

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=US-ASCII

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: mobile.de (Marketplace)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| checkform

0 Cookies