tiepolt-online.de Open in urlscan Pro
94.102.218.220  Malicious Activity! Public Scan

URL: http://tiepolt-online.de/gmail/Gmail.htm
Submission Tags: @ipnigh
Submission: On July 22 via api from GB

Summary

This website contacted 4 IPs in 1 countries across 4 domains to perform 10 HTTP transactions. The main IP is 94.102.218.220, located in Germany and belongs to CRONON-AS Obermuensterstr. 9, DE. The main domain is tiepolt-online.de.
This is the only time tiepolt-online.de was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Google (Online)

Domain & IP information

IP Address AS Autonomous System
6 94.102.218.220 25504 (CRONON-AS...)
2 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
10 4
Domain Requested by
6 tiepolt-online.de tiepolt-online.de
2 fonts.gstatic.com tiepolt-online.de
1 mail.google.com
1 accounts.youtube.com tiepolt-online.de
10 4

This site contains links to these domains. Also see Links.

Domain
support.google.com
accounts.google.com
www.google.com
Subject Issuer Validity Valid

1970-01-01 -
1970-01-01
a few seconds crt.sh
*.google.com
Google Internet Authority G3
2019-06-18 -
2019-09-10
3 months crt.sh
mail.google.com
Google Internet Authority G3
2019-06-18 -
2019-09-10
3 months crt.sh

This page contains 3 frames:

Primary Page: http://tiepolt-online.de/gmail/Gmail.htm
Frame ID: 4C105F807B92C185BF937369706B37AC
Requests: 8 HTTP requests in this frame

Frame: http://tiepolt-online.de/gmail/Gmail_files/CheckConnection.htm
Frame ID: 7CE1B74FE9ADC5CEDC181D49060D80BF
Requests: 1 HTTP requests in this frame

Frame: https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-457291498&timestamp=1563764627788
Frame ID: 1E668D90A3AE4B731AD8E975FD8ECA1F
Requests: 1 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /php\/?([\d.]+)?/i

Overall confidence: 100%
Detected patterns
  • headers server /Debian/i

Overall confidence: 100%
Detected patterns
  • headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

Overall confidence: 100%
Detected patterns
  • headers server /\b(?:mod_)?DAV\b(?:\/([\d.]+))?/i

Overall confidence: 100%
Detected patterns
  • headers server /mod_ssl(?:\/([\d.]+))?/i

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
  • headers server /\b(?:mod_)?DAV\b(?:\/([\d.]+))?/i
  • headers server /mod_ssl(?:\/([\d.]+))?/i

Page Statistics

10
Requests

20 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

4
IPs

1
Countries

84 kB
Transfer

127 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request Gmail.htm
tiepolt-online.de/gmail/
68 KB
23 KB
Document
General
Full URL
http://tiepolt-online.de/gmail/Gmail.htm
Protocol
HTTP/1.1
Server
94.102.218.220 , Germany, ASN25504 (CRONON-AS Obermuensterstr. 9, DE),
Reverse DNS
ketax.netbeat.de
Software
Apache/2.2.9 (Debian) DAV/2 mod_ssl/2.2.9 OpenSSL/0.9.8g PHP/5.2.6-1+lenny10 with Suhosin-Patch /
Resource Hash
a21ab873b34eba0b78a19e487a9b81e33bb978b17ec5a7bec2b9a53e6fcb34fc

Request headers

Host
tiepolt-online.de
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 22 Jul 2019 03:03:47 GMT
Server
Apache/2.2.9 (Debian) DAV/2 mod_ssl/2.2.9 OpenSSL/0.9.8g PHP/5.2.6-1+lenny10 with Suhosin-Patch
Last-Modified
Mon, 23 Jan 2017 13:26:23 GMT
ETag
"311d47f1-10e66-546c2f21b939a"
Accept-Ranges
bytes
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
23475
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html
logo_2x.png
tiepolt-online.de/gmail/Gmail_files/
9 KB
9 KB
Image
General
Full URL
http://tiepolt-online.de/gmail/Gmail_files/logo_2x.png
Requested by
Host: tiepolt-online.de
URL: http://tiepolt-online.de/gmail/Gmail.htm
Protocol
HTTP/1.1
Security
, ,
Server
94.102.218.220 , Germany, ASN25504 (CRONON-AS Obermuensterstr. 9, DE),
Reverse DNS
ketax.netbeat.de
Software
Apache/2.2.9 (Debian) DAV/2 mod_ssl/2.2.9 OpenSSL/0.9.8g PHP/5.2.6-1+lenny10 with Suhosin-Patch /
Resource Hash
691b769a33e9fdb816f5094e96f5097db9e8a8724b13c04dc247f6189a51ad15

Request headers

Referer
http://tiepolt-online.de/gmail/Gmail.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 22 Jul 2019 03:03:47 GMT
Last-Modified
Mon, 23 Jan 2017 13:26:23 GMT
Server
Apache/2.2.9 (Debian) DAV/2 mod_ssl/2.2.9 OpenSSL/0.9.8g PHP/5.2.6-1+lenny10 with Suhosin-Patch
ETag
"a49d4b-232d-546c2f21bd21a"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
9005
avatar_2x.png
tiepolt-online.de/gmail/Gmail_files/
2 KB
2 KB
Image
General
Full URL
http://tiepolt-online.de/gmail/Gmail_files/avatar_2x.png
Requested by
Host: tiepolt-online.de
URL: http://tiepolt-online.de/gmail/Gmail.htm
Protocol
HTTP/1.1
Security
, ,
Server
94.102.218.220 , Germany, ASN25504 (CRONON-AS Obermuensterstr. 9, DE),
Reverse DNS
ketax.netbeat.de
Software
Apache/2.2.9 (Debian) DAV/2 mod_ssl/2.2.9 OpenSSL/0.9.8g PHP/5.2.6-1+lenny10 with Suhosin-Patch /
Resource Hash
82a1bcb1c93487bf352338b8753e7e4ae962155fc7c813c03f5f0a5b723d77fe

Request headers

Referer
http://tiepolt-online.de/gmail/Gmail.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 22 Jul 2019 03:03:47 GMT
Last-Modified
Mon, 23 Jan 2017 13:26:23 GMT
Server
Apache/2.2.9 (Debian) DAV/2 mod_ssl/2.2.9 OpenSSL/0.9.8g PHP/5.2.6-1+lenny10 with Suhosin-Patch
ETag
"a49d49-653-546c2f21bd21a"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
1619
logo_strip_2x.png
tiepolt-online.de/gmail/Gmail_files/
14 KB
15 KB
Image
General
Full URL
http://tiepolt-online.de/gmail/Gmail_files/logo_strip_2x.png
Requested by
Host: tiepolt-online.de
URL: http://tiepolt-online.de/gmail/Gmail.htm
Protocol
HTTP/1.1
Security
, ,
Server
94.102.218.220 , Germany, ASN25504 (CRONON-AS Obermuensterstr. 9, DE),
Reverse DNS
ketax.netbeat.de
Software
Apache/2.2.9 (Debian) DAV/2 mod_ssl/2.2.9 OpenSSL/0.9.8g PHP/5.2.6-1+lenny10 with Suhosin-Patch /
Resource Hash
40142b3aa80b9557a739a4ede404518f4dfabd92eabf3828cb17d791d7d7c9df

Request headers

Referer
http://tiepolt-online.de/gmail/Gmail.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 22 Jul 2019 03:03:47 GMT
Last-Modified
Mon, 23 Jan 2017 13:26:23 GMT
Server
Apache/2.2.9 (Debian) DAV/2 mod_ssl/2.2.9 OpenSSL/0.9.8g PHP/5.2.6-1+lenny10 with Suhosin-Patch
ETag
"a49d4c-39da-546c2f21bd21a"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=96
Content-Length
14810
universal_language_settings-21.png
tiepolt-online.de/gmail/Gmail_files/
199 B
562 B
Image
General
Full URL
http://tiepolt-online.de/gmail/Gmail_files/universal_language_settings-21.png
Requested by
Host: tiepolt-online.de
URL: http://tiepolt-online.de/gmail/Gmail.htm
Protocol
HTTP/1.1
Security
, ,
Server
94.102.218.220 , Germany, ASN25504 (CRONON-AS Obermuensterstr. 9, DE),
Reverse DNS
ketax.netbeat.de
Software
Apache/2.2.9 (Debian) DAV/2 mod_ssl/2.2.9 OpenSSL/0.9.8g PHP/5.2.6-1+lenny10 with Suhosin-Patch /
Resource Hash
59404af2d92c53ad1ee9e21b252c07c77dcba810b248a79d6ae989b1ff63c7d6

Request headers

Referer
http://tiepolt-online.de/gmail/Gmail.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 22 Jul 2019 03:03:47 GMT
Last-Modified
Mon, 23 Jan 2017 13:26:23 GMT
Server
Apache/2.2.9 (Debian) DAV/2 mod_ssl/2.2.9 OpenSSL/0.9.8g PHP/5.2.6-1+lenny10 with Suhosin-Patch
ETag
"a49d4d-c7-546c2f21bd21a"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=95
Content-Length
199
CheckConnection.htm
tiepolt-online.de/gmail/Gmail_files/ Frame 7CE1
3 KB
2 KB
Document
General
Full URL
http://tiepolt-online.de/gmail/Gmail_files/CheckConnection.htm
Requested by
Host: tiepolt-online.de
URL: http://tiepolt-online.de/gmail/Gmail.htm
Protocol
HTTP/1.1
Server
94.102.218.220 , Germany, ASN25504 (CRONON-AS Obermuensterstr. 9, DE),
Reverse DNS
ketax.netbeat.de
Software
Apache/2.2.9 (Debian) DAV/2 mod_ssl/2.2.9 OpenSSL/0.9.8g PHP/5.2.6-1+lenny10 with Suhosin-Patch /
Resource Hash
f810fc13ccce528499a4b8b1fc894654380f24f00af8594efe332697db2fc9e3

Request headers

Host
tiepolt-online.de
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer
http://tiepolt-online.de/gmail/Gmail.htm
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
http://tiepolt-online.de/gmail/Gmail.htm

Response headers

Date
Mon, 22 Jul 2019 03:03:47 GMT
Server
Apache/2.2.9 (Debian) DAV/2 mod_ssl/2.2.9 OpenSSL/0.9.8g PHP/5.2.6-1+lenny10 with Suhosin-Patch
Last-Modified
Mon, 23 Jan 2017 13:26:23 GMT
ETag
"a49d4a-b53-546c2f21bd21a"
Accept-Ranges
bytes
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
1383
Keep-Alive
timeout=5, max=99
Connection
Keep-Alive
Content-Type
text/html
DXI1ORHCpsQm3Vp6mXoaTegdm0LZdjqr5-oayXSOefg.woff2
fonts.gstatic.com/s/opensans/v10/
16 KB
16 KB
Font
General
Full URL
http://fonts.gstatic.com/s/opensans/v10/DXI1ORHCpsQm3Vp6mXoaTegdm0LZdjqr5-oayXSOefg.woff2
Requested by
Host: tiepolt-online.de
URL: http://tiepolt-online.de/gmail/Gmail.htm
Protocol
HTTP/1.1
Security
, ,
Server
2a00:1450:4001:81e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
30427ab021a9d28d0f9724a8565c2463ee5a3938417dd0750d58ab79ac07cf12
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
http://tiepolt-online.de/gmail/Gmail.htm
Origin
http://tiepolt-online.de

Response headers

Date
Thu, 13 Jun 2019 22:55:12 GMT
X-Content-Type-Options
nosniff
Last-Modified
Thu, 21 Aug 2014 18:08:10 GMT
Server
sffe
Age
3298115
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
16212
X-XSS-Protection
0
Expires
Fri, 12 Jun 2020 22:55:12 GMT
cJZKeOuBrn4kERxqtaUH3VtXRa8TVwTICgirnJhmVJw.woff2
fonts.gstatic.com/s/opensans/v10/
15 KB
16 KB
Font
General
Full URL
http://fonts.gstatic.com/s/opensans/v10/cJZKeOuBrn4kERxqtaUH3VtXRa8TVwTICgirnJhmVJw.woff2
Requested by
Host: tiepolt-online.de
URL: http://tiepolt-online.de/gmail/Gmail.htm
Protocol
HTTP/1.1
Security
, ,
Server
2a00:1450:4001:81e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
3135160ee3b34e2d1e58bf80944a1ed2cef3f073528ea98f11916a397b4c6ac9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
http://tiepolt-online.de/gmail/Gmail.htm
Origin
http://tiepolt-online.de

Response headers

Date
Sat, 01 Jun 2019 08:35:24 GMT
X-Content-Type-Options
nosniff
Last-Modified
Thu, 21 Aug 2014 18:06:58 GMT
Server
sffe
Age
4386503
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
15556
X-XSS-Protection
0
Expires
Sun, 31 May 2020 08:35:24 GMT
CheckConnection
accounts.youtube.com/accounts/ Frame 1E66
0
0
Document
General
Full URL
https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-457291498&timestamp=1563764627788
Requested by
Host: tiepolt-online.de
URL: http://tiepolt-online.de/gmail/Gmail.htm
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-iaeYF0UZvmUAYQNi5UGQYw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport;worker-src 'self' script-src 'nonce-iaeYF0UZvmUAYQNi5UGQYw' 'self' 'unsafe-eval' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com;report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport;frame-ancestors https://accounts.google.com
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
accounts.youtube.com
:scheme
https
:path
/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-457291498&timestamp=1563764627788
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
referer
http://tiepolt-online.de/gmail/Gmail.htm
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
http://tiepolt-online.de/gmail/Gmail.htm

Response headers

status
200
content-type
text/html; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
pragma
no-cache
expires
Mon, 01 Jan 1990 00:00:00 GMT
date
Mon, 22 Jul 2019 03:03:47 GMT
content-security-policy
script-src 'report-sample' 'nonce-iaeYF0UZvmUAYQNi5UGQYw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport;worker-src 'self' script-src 'nonce-iaeYF0UZvmUAYQNi5UGQYw' 'self' 'unsafe-eval' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com;report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport;frame-ancestors https://accounts.google.com
content-encoding
gzip
server
ESF
x-xss-protection
0
x-content-type-options
nosniff
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
cleardot.gif
mail.google.com/mail/images/
43 B
255 B
Image
General
Full URL
https://mail.google.com/mail/images/cleardot.gif?t=1563764627822
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2005 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
GSE /
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
http://tiepolt-online.de/gmail/Gmail.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 22 Jul 2019 03:03:47 GMT
x-content-type-options
nosniff
server
GSE
x-frame-options
SAMEORIGIN
content-type
image/gif; charset=UTF-8
status
200
cache-control
public, max-age=31536000
alt-svc
clear
x-xss-protection
1; mode=block
expires
Tue, 21 Jul 2020 03:03:47 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Google (Online)

74 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| gaia_attachEvent object| G function| Gb function| Ga object| Gc function| Gf function| Gg function| Gh function| Gd function| Ge function| Gi function| Gj function| Gl function| Gk object| Gm object| Gn function| Go function| Gp object| Gq object| Gr object| Gs object| Gt function| Gu function| Gv function| Gw function| Gx function| G_checkConnectionMain function| G_setPostMessageSupportFlag object| __CHECK_CONNECTION_CONFIG object| botguard function| gaia_parseFragment function| gaia_prefillEmail object| hashParams function| gaia_setFocus function| gaia_scrollToElement object| f function| g function| h function| k function| m object| n function| p function| q function| r object| gaia function| gaia_onLoginSubmit object| BrowserSupport_ boolean| is_browser_supported number| start_time function| SetGmailCookie function| lg function| StripParam number| fixed function| FixForm function| el object| CP object| quota_elem string| ONE_PX function| LogRoundtripTime function| GetRoundtripTimeFunction function| MaybePingUser function| OnLoad function| updateQuota string| PAD function| format string| google_conversion_type number| google_conversion_id string| google_conversion_language string| google_conversion_format string| google_conversion_color function| LoadConversionScript

1 Cookies

Domain/Path Name / Value
tiepolt-online.de/gmail/Gmail_files Name: CheckConnectionTempCookie880
Value: 771067