![](/screenshots/55474368-9f53-4a32-b17f-7384cd594e83.png)
thanhlapweb.com
Open in
urlscan Pro
123.30.139.93
Malicious Activity!
Public Scan
Effective URL: https://thanhlapweb.com/thuvien/immo2/immo2/signin.immowelt.de/index.html
Submission: On September 21 via manual from IN — Scanned from DE
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on December 27th 2022. Valid for: a year.
This is the only time thanhlapweb.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Immowelt (Real Estate)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 192.185.129.194 192.185.129.194 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
11 | 123.30.139.93 123.30.139.93 | 7643 (VNPT-AS-V...) (VNPT-AS-VN Vietnam Posts and Telecommunications VNPT) | |
7 | 2.16.215.101 2.16.215.101 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
19 | 3 |
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 192-185-129-194.unifiedlayer.com
webprotechnologies.com |
ASN7643 (VNPT-AS-VN Vietnam Posts and Telecommunications VNPT, VN)
PTR: c3.vinahost.vn
thanhlapweb.com |
ASN16625 (AKAMAI-AS, US)
PTR: a2-16-215-101.deploy.static.akamaitechnologies.com
cdnglobal.immowelt.org |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
thanhlapweb.com
thanhlapweb.com |
274 KB |
7 |
immowelt.org
cdnglobal.immowelt.org — Cisco Umbrella Rank: 225380 |
9 KB |
1 |
webprotechnologies.com
webprotechnologies.com |
241 B |
19 | 3 |
Domain | Requested by | |
---|---|---|
11 | thanhlapweb.com |
thanhlapweb.com
|
7 | cdnglobal.immowelt.org |
thanhlapweb.com
|
1 | webprotechnologies.com | |
19 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.immowelt.de |
immowelt.de |
Subject Issuer | Validity | Valid | |
---|---|---|---|
webprotechnologies.com R3 |
2023-08-02 - 2023-10-31 |
3 months | crt.sh |
thanhlapweb.com Sectigo RSA Domain Validation Secure Server CA |
2022-12-27 - 2023-12-27 |
a year | crt.sh |
*.immowelt.org DigiCert TLS RSA SHA256 2020 CA1 |
2023-04-14 - 2024-04-15 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://thanhlapweb.com/thuvien/immo2/immo2/signin.immowelt.de/index.html
Frame ID: 7435482B7792EE9370287ABB3DDF9BEF
Requests: 19 HTTP requests in this frame
Screenshot
![](/screenshots/55474368-9f53-4a32-b17f-7384cd594e83.png)
Page Title
Login | ImmoweltPage URL History Show full URLs
- https://webprotechnologies.com/webpro_bill/addnewtype.php Page URL
- https://thanhlapweb.com/thuvien/immo2/immo2/signin.immowelt.de/index.html Page URL
Page Statistics
8 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: Passwort vergessen?
Search URL Search Domain Scan URL
Title: Jetzt kostenfrei registrieren
Search URL Search Domain Scan URL
Title: Datenschutzerklärung
Search URL Search Domain Scan URL
Title: AGB
Search URL Search Domain Scan URL
Title: Datenschutz
Search URL Search Domain Scan URL
Title: Impressum
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://webprotechnologies.com/webpro_bill/addnewtype.php Page URL
- https://thanhlapweb.com/thuvien/immo2/immo2/signin.immowelt.de/index.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
19 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
addnewtype.php
webprotechnologies.com/webpro_bill/ |
122 B 241 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
index.html
thanhlapweb.com/thuvien/immo2/immo2/signin.immowelt.de/ |
9 KB 10 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main-immowelt.css
thanhlapweb.com/thuvien/immo2/immo2/cdnglobal.immowelt.org/signin-ui/4ea57237727ccb2940892364908fb740108ad38f/ |
16 KB 16 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
navigation.js
thanhlapweb.com/thuvien/immo2/immo2/navigation.immowelt.org/v1/MINIMAL/0/ |
45 KB 45 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo_immowelt.svg
cdnglobal.immowelt.org/global-assets/4.0.1/legacy/0/images/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon-teaser-magnify.svg
cdnglobal.immowelt.org/signin-ui/4ea57237727ccb2940892364908fb740108ad38f/images/icons/icons-iw/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon-teaser-arrows.svg
cdnglobal.immowelt.org/signin-ui/4ea57237727ccb2940892364908fb740108ad38f/images/icons/icons-iw/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
minimal-0-header.css
cdnglobal.immowelt.org/navigation-ui/89bd584411c4c86d5e21fa94e5a5b50d5b120311/css/ |
1006 B 718 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo_immowelt.svg
cdnglobal.immowelt.org/global-assets/4.3.0/legacy/0/images/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
minimal-0-footer.css
cdnglobal.immowelt.org/navigation-ui/89bd584411c4c86d5e21fa94e5a5b50d5b120311/css/ |
463 B 577 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
minimal-0-footer.js
cdnglobal.immowelt.org/navigation-ui/89bd584411c4c86d5e21fa94e5a5b50d5b120311/ |
2 KB 1 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
9c511efd92044f6f6dbf.svg
thanhlapweb.com/thuvien/immo2/immo2/cdnglobal.immowelt.org/signin-ui/4ea57237727ccb2940892364908fb740108ad38f/images/ |
748 B 961 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
5cdd20e6900e0ca47d80.svg
thanhlapweb.com/thuvien/immo2/immo2/cdnglobal.immowelt.org/signin-ui/4ea57237727ccb2940892364908fb740108ad38f/images/ |
801 B 1014 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
8fa38303f99cf0518547.svg
thanhlapweb.com/thuvien/immo2/immo2/cdnglobal.immowelt.org/signin-ui/4ea57237727ccb2940892364908fb740108ad38f/images/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
864e5120f57decbc804c.jpg
thanhlapweb.com/thuvien/immo2/immo2/cdnglobal.immowelt.org/signin-ui/4ea57237727ccb2940892364908fb740108ad38f/images/ |
112 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
0c36eafde177ab546868.woff2
thanhlapweb.com/thuvien/immo2/immo2/cdnglobal.immowelt.org/signin-ui/4ea57237727ccb2940892364908fb740108ad38f/images/ |
45 KB 45 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
967e123ad65de8c5d5c4.woff2
thanhlapweb.com/thuvien/immo2/immo2/cdnglobal.immowelt.org/signin-ui/4ea57237727ccb2940892364908fb740108ad38f/images/ |
46 KB 46 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
1a12317389afca44fc29.woff2
thanhlapweb.com/thuvien/immo2/immo2/cdnglobal.immowelt.org/signin-ui/4ea57237727ccb2940892364908fb740108ad38f/images/ |
46 KB 46 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fb9fdde61d631c58d46c.woff2
thanhlapweb.com/thuvien/immo2/immo2/cdnglobal.immowelt.org/signin-ui/4ea57237727ccb2940892364908fb740108ad38f/images/ |
62 KB 62 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Immowelt (Real Estate)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture object| navigationUI function| __CE_installPolyfill0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
4 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdnglobal.immowelt.org
thanhlapweb.com
webprotechnologies.com
123.30.139.93
192.185.129.194
2.16.215.101
000445d12d9235c469e3fe9caa91d2c44876bed1d97615912c927f0c56baa50b
1e2ca939c8ea6e474d75968c821c6b0e9a7d326dab593bb97478012372b20617
23938eb4314413660e24c2a78dd20ae6bfeff839962ebea8ab2a19dee5ae226a
451770ba091160eee511e9e1ad0ec7681f8d1849614081afa350c8093e9828f2
485fcb7db5c3ee1f69056394634c9d75eecf877b7b9cec7c0a2596ff35b80920
4c1c2e95835201077586a3698cd47806dd18df10d32a1e6cb6aa9e47224a55e3
667e25b67585a8da45125ea470976ef8ae9df1b8c9413388b32fc7a45549b632
76af6a8077afc6b48ed6a030dbda15cd5d73a5354163e1788b13da5c09d0dfdb
7ed2f70842e0d45280ac4926fdf7f4c2ac99b2bbe770b449b68de05203b62440
82f4ee0332972e2ff06e0a60eb98a465865e88e0fbd24ba2a03a4114dfe68fa0
8c643cf092aae00273e2163a89a756093f1a44bb79acefc0421f2d164806498a
95b6af6df04ea28daee05d78c1de48f9b386294a6a87503b9eae94d3e8ceff70
c1c24d6a7ce4bd24b1f3f51ab6f74667c94263fa4b109cc3ff32f4f22848087f
c9b195475a3f38e0828aded7ea31494e35f49052b44644f9718d4946e81c8f63
df0231affb521137bf135898b6ce4c2ce59a79e3e23068a673868366c7ac68bb
ff5a7ccafdf5655b806f5fc619bd47fb43e9858021a5d72e742dd5f647e8ffee