![](/screenshots/55ebbfb1-cd15-46ef-96cb-853d0b200d1a.png)
email.colombiatek.com
Open in
urlscan Pro
144.126.134.207
Malicious Activity!
Public Scan
Submission: On June 04 via api from CH — Scanned from DE
Summary
TLS certificate: Issued by R3 on March 31st 2024. Valid for: 3 months.
This is the only time email.colombiatek.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: 1&1 Ionos (Telecommunication)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
6 | 144.126.134.207 144.126.134.207 | 40021 (NL-811-40021) (NL-811-40021) | |
1 | 2a00:1450:400... 2a00:1450:4001:81d::200a | 15169 (GOOGLE) (GOOGLE) | |
4 | 213.165.66.58 213.165.66.58 | 8560 (IONOS-AS ...) (IONOS-AS This is the joint network for IONOS) | |
12 | 4 |
ASN40021 (NL-811-40021, US)
PTR: server1.colombiatek.com
email.colombiatek.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
colombiatek.com
email.colombiatek.com |
81 KB |
4 |
uicdn.net
ce1.uicdn.net — Cisco Umbrella Rank: 238577 |
222 KB |
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 613 |
31 KB |
12 | 3 |
Domain | Requested by | |
---|---|---|
6 | email.colombiatek.com |
email.colombiatek.com
|
4 | ce1.uicdn.net |
email.colombiatek.com
|
1 | ajax.googleapis.com |
email.colombiatek.com
|
12 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
id.ionos.com |
www.ionos.com |
ias.ionos.com |
login.ionos.com |
hidrive.ionos.com |
archive.ionos.com |
www.ionos.co.uk |
www.ionos-status.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
email.colombiatek.com R3 |
2024-03-31 - 2024-06-29 |
3 months | crt.sh |
upload.video.google.com WR2 |
2024-05-13 - 2024-08-05 |
3 months | crt.sh |
ce1.uicdn.net GeoTrust RSA CA 2018 |
2024-03-20 - 2025-03-09 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://email.colombiatek.com/1n1ionos/loginionoscomindex.html
Frame ID: 4282B72FE40DF08CF00E73D0CCFE981F
Requests: 17 HTTP requests in this frame
13 Outgoing links
These are links going to different origins than the main page.
Title: Webmail Login
Search URL Search Domain Scan URL
Title: Learn more
Search URL Search Domain Scan URL
Title: private browsing mode
Search URL Search Domain Scan URL
Title: Learn more
Search URL Search Domain Scan URL
Title: My IONOS
Search URL Search Domain Scan URL
Title: HiDrive
Search URL Search Domain Scan URL
Title: Email Archiving
Search URL Search Domain Scan URL
Title: Learn more
Search URL Search Domain Scan URL
Title: Forgot Your Password?
Search URL Search Domain Scan URL
Title: All Systems Operational
Search URL Search Domain Scan URL
Title: IONOS Inc.
Search URL Search Domain Scan URL
Title: Privacy Policy
Search URL Search Domain Scan URL
Title: T&Cs
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
loginionoscomindex.html
email.colombiatek.com/1n1ionos/ |
733 KB 80 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.4.1/ |
86 KB 31 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
starter-main.min.css
email.colombiatek.com/style/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
starter-main.min.js
email.colombiatek.com/script/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
opensans-regular.woff
ce1.uicdn.net/exos/fonts/open-sans/ |
62 KB 63 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
exos-icon-font.woff
ce1.uicdn.net/exos/icons/ |
50 KB 50 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
overpass-semibold.woff
ce1.uicdn.net/exos/fonts/overpass/ |
40 KB 40 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
opensans-semibold.woff
ce1.uicdn.net/exos/fonts/open-sans/ |
68 KB 69 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
email.colombiatek.com/image/ |
315 B 389 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon-32px.png
email.colombiatek.com/image/ |
315 B 389 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon-16px.png
email.colombiatek.com/image/ |
315 B 389 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon-48px.png
email.colombiatek.com/image/ |
315 B 389 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- email.colombiatek.com
- URL
- https://email.colombiatek.com/style/starter-main.min.css
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: 1&1 Ionos (Telecommunication)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery number| counter0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
9 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
ce1.uicdn.net
email.colombiatek.com
email.colombiatek.com
144.126.134.207
213.165.66.58
2a00:1450:4001:81d::200a
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
25b7fa002e922f781b313eec1c5c03784099b116ad67f9c788b162b94bc168c6
2e1587380141daff4e10a8e3db8f7ae5887102ab7576bff43049590f637ac20b
3152b621420e1b2f8801f16a5565a4084d712a6584f732d75a2fa9321303812a
45391d9751140b55d5fe79594d8164842b62b319b47dcd6eefc2b173748d140c
4f5a525581e2acdcca719b8bfba6bc706603265c457369a96b78e24d5de9a7f1
82a3b507d88d0bf1ae099818e5e4754081e05a915408c22ec6db3cda9b96afd4
b0390aa3e137e3e49d7d6ed5d86c208fec1dd45ff8a56836c3f86c2e32cd2d7a
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
db4f875bd60c7c59abb060b14e38f9473adcd4b3913208ba2fa3cb498a6dcd6d
e344e2c6aba0832a922e2f163f50c9fc0a5b14979f21f07bd723db0f1e76a36b
f67a28da95dadf626feb317f37c4a7b34ff65bec700fce21bc2f6eaed4b85fd6