it-goethe-partner.de
Open in
urlscan Pro
2001:8d8:100f:f000::2cc
Malicious Activity!
Public Scan
URL:
http://it-goethe-partner.de/a2/login/
Submission: On February 05 via automatic, source openphish
Submission: On February 05 via automatic, source openphish
Summary
This website contacted 3 IPs
in 2 countries
across 3 domains to perform 7 HTTP transactions.
The main IP is 2001:8d8:100f:f000::2cc, located in
Germany and
belongs to ONEANDONE-AS Brauerstrasse 48, DE.
The main domain is it-goethe-partner.de.
This is the only time it-goethe-partner.de was scanned on urlscan.io!
This is the only time it-goethe-partner.de was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: mobile.de (Marketplace)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 | 2001:8d8:100f... 2001:8d8:100f:f000::2cc | 8560 (ONEANDONE...) (ONEANDONE-AS Brauerstrasse 48) | |
| 2 | 2a02:26f0:f1:... 2a02:26f0:f1:18f::1703 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
| 7 | 3 |
1
2001:8d8:100f:f000::2cc
(Germany)
ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE)
ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE)
| it-goethe-partner.de |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 2 |
mobile.de
login.mobile.de |
43 KB |
| 1 |
it-goethe-partner.de
it-goethe-partner.de |
2 KB |
| 0 |
classistatic.de
Failed
static.classistatic.de Failed |
|
| 7 | 3 |
| Domain | Requested by | |
|---|---|---|
| 2 | login.mobile.de |
it-goethe-partner.de
|
| 1 | it-goethe-partner.de | |
| 0 | static.classistatic.de Failed | |
| 7 | 3 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| www.mobile.de DigiCert ECC Extended Validation Server CA |
2018-03-22 - 2020-03-21 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
http://it-goethe-partner.de/a2/login/
Frame ID: 2A42B60CBBF9236BF897A79B314DA431
Requests: 8 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
it-goethe-partner.de/a2/login/ |
6 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
icons.logo.data.svg.css
login.mobile.de/a2/css/icons/logo/ |
24 KB 12 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
a2Main.css
login.mobile.de/a2/css/ |
247 KB 31 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
Gibson-SemiBold-webfont-v2.woff2
static.classistatic.de/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
Gibson-Regular-webfont-v2.woff2
static.classistatic.de/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
Gibson-Regular-webfont-v2.woff
static.classistatic.de/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
Gibson-SemiBold-webfont-v2.woff
static.classistatic.de/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- static.classistatic.de
- URL
- https://static.classistatic.de/fonts/Gibson-SemiBold-webfont-v2.woff2
- Domain
- static.classistatic.de
- URL
- https://static.classistatic.de/fonts/Gibson-Regular-webfont-v2.woff2
- Domain
- static.classistatic.de
- URL
- https://static.classistatic.de/fonts/Gibson-Regular-webfont-v2.woff
- Domain
- static.classistatic.de
- URL
- https://static.classistatic.de/fonts/Gibson-SemiBold-webfont-v2.woff
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: mobile.de (Marketplace)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
it-goethe-partner.de
login.mobile.de
static.classistatic.de
static.classistatic.de
2001:8d8:100f:f000::2cc
2a02:26f0:f1:18f::1703
2de444c40005515d31e45edf5df5751a8e06910dd078d64ecec12364272a5f93
5cbb1b182882ae8a2d6c7f76a37a80fcbd337f32f6ad3a399443805cca53b99c
9438113100ff089d191a01c1b464f86963be589cd06c182b0c8b71fc95bd2200
f35f64cd5c4c85ec8111161f4a307468121975e5beb08a15bcec8011399b60d0