account.1and1.fr Open in urlscan Pro
217.160.86.25  Malicious Activity! Public Scan

Submitted URL: http://2mpg.mj.am/lnk/AMEAAAqB_qIAAAAAAAAAAGeVixkAAAAAAAIAAAAAAAL4YQBbDeUAgQ3EfzLYTOS44d92LbO5qAAC19A/2/-zfCTMud0u...
Effective URL: https://account.1and1.fr/?redirect_url=https%3A%2F%2Fclients.1and1.fr%2FCenterUserdata%3Futm_campaign%3Dinvoice%26utm_sou...
Submission: On June 07 via manual from FR

Summary

This website contacted 9 IPs in 2 countries across 7 domains to perform 19 HTTP transactions. The main IP is 217.160.86.25, located in Germany and belongs to ONEANDONE-AS Brauerstrasse 48, DE. The main domain is account.1and1.fr.
TLS certificate: Issued by GeoTrust EV SSL CA - G4 on July 27th 2017. Valid for: 2 years.
This is the only time account.1and1.fr was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: 1&1 Ionos (Telecommunication)

Domain & IP information

IP Address AS Autonomous System
1 1 104.199.110.216 15169 (GOOGLE)
1 1 217.160.86.105 8560 (ONEANDONE...)
2 217.160.86.25 8560 (ONEANDONE...)
4 217.160.86.60 8560 (ONEANDONE...)
3 217.160.86.61 8560 (ONEANDONE...)
3 217.160.86.74 8560 (ONEANDONE...)
1 195.20.250.237 8560 (ONEANDONE...)
1 217.160.86.16 8560 (ONEANDONE...)
1 217.160.86.156 8560 (ONEANDONE...)
1 217.160.86.204 8560 (ONEANDONE...)
3 217.160.86.27 8560 (ONEANDONE...)
19 9
Domain Requested by
6 frontend-services.1and1.com account.1and1.fr
frontend-services.1and1.com
4 cors.uicdn.net account.1and1.fr
3 media.static-1and1.com
2 account.1and1.fr account.1and1.fr
1 pixel.1und1.de account.1and1.fr
1 ias.1and1.fr frontend-services.1and1.com
1 navigation.1and1.fr frontend-services.1and1.com
1 uir.uimserv.net account.1and1.fr
1 clients.1and1.fr 1 redirects
1 2mpg.mj.am 1 redirects
19 10

This site contains links to these domains. Also see Links.

Domain
clients.1and1.fr
assistance.1and1.fr
ias.1and1.fr
webmail.1and1.fr
www.1and1.fr
Subject Issuer Validity Valid
account.1and1.fr
GeoTrust EV SSL CA - G4
2017-07-27 -
2019-07-27
2 years crt.sh
navigation.1and1.fr
GeoTrust SSL CA - G3
2017-07-31 -
2018-07-31
a year crt.sh
ias.1und1.de
GeoTrust RSA CA 2018
2018-04-17 -
2018-08-28
4 months crt.sh

This page contains 1 frames:

Primary Page: https://account.1and1.fr/?redirect_url=https%3A%2F%2Fclients.1and1.fr%2FCenterUserdata%3Futm_campaign%3Dinvoice%26utm_source%3Dmail
Frame ID: 190BAB1001215337AA0C1C8CEFEB5FE3
Requests: 19 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://2mpg.mj.am/lnk/AMEAAAqB_qIAAAAAAAAAAGeVixkAAAAAAAIAAAAAAAL4YQBbDeUAgQ3EfzLYTOS44d92LbO5... HTTP 302
    https://clients.1and1.fr/CenterUserdata?utm_campaign=invoice&utm_source=mail HTTP 302
    https://account.1and1.fr/?redirect_url=https%3A%2F%2Fclients.1and1.fr%2FCenterUserdata%3Futm_campaign... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

19
Requests

21 %
HTTPS

0 %
IPv6

7
Domains

10
Subdomains

9
IPs

2
Countries

361 kB
Transfer

831 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://2mpg.mj.am/lnk/AMEAAAqB_qIAAAAAAAAAAGeVixkAAAAAAAIAAAAAAAL4YQBbDeUAgQ3EfzLYTOS44d92LbO5qAAC19A/2/-zfCTMud0uElHrbNxRJCkA/aHR0cHM6Ly9jbGllbnRzLjFhbmQxLmZyL0NlbnRlclVzZXJkYXRhP3V0bV9jYW1wYWlnbj1pbnZvaWNlJnV0bV9zb3VyY2U9bWFpbA HTTP 302
    https://clients.1and1.fr/CenterUserdata?utm_campaign=invoice&utm_source=mail HTTP 302
    https://account.1and1.fr/?redirect_url=https%3A%2F%2Fclients.1and1.fr%2FCenterUserdata%3Futm_campaign%3Dinvoice%26utm_source%3Dmail Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

19 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request Cookie set /
account.1and1.fr/
Redirect Chain
  • http://2mpg.mj.am/lnk/AMEAAAqB_qIAAAAAAAAAAGeVixkAAAAAAAIAAAAAAAL4YQBbDeUAgQ3EfzLYTOS44d92LbO5qAAC19A/2/-zfCTMud0uElHrbNxRJCkA/aHR0cHM6Ly9jbGllbnRzLjFhbmQxLmZyL0NlbnRlclVzZXJkYXRhP3V0bV9jYW1wYWlnbj...
  • https://clients.1and1.fr/CenterUserdata?utm_campaign=invoice&utm_source=mail
  • https://account.1and1.fr/?redirect_url=https%3A%2F%2Fclients.1and1.fr%2FCenterUserdata%3Futm_campaign%3Dinvoice%26utm_source%3Dmail
51 KB
12 KB
Document
General
Full URL
https://account.1and1.fr/?redirect_url=https%3A%2F%2Fclients.1and1.fr%2FCenterUserdata%3Futm_campaign%3Dinvoice%26utm_source%3Dmail
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
217.160.86.25 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
account.1and1.fr
Software
Apache /
Resource Hash
46884c75a491b97599a880e70155750e21cdcf022576ed07f5da8c9f84d36b22
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.1and1.fr pet.1and1.com frontend-services.1and1.com pixel.1und1.de; img-src 'self' data: *.1and1.fr ias.static-1and1.com media.static-1and1.com pixel.1und1.de; font-src 'self' cors.uicdn.net; script-src 'self' 'nonce-qYW2EI/LR269amoDkTF+OQ' www.google.com www.gstatic.com uir.uimserv.net ias.1and1.fr as.1and1.fr navigation.1and1.fr frontend-services.1and1.com; style-src 'self' 'unsafe-inline' navigation.1and1.fr frontend-services.1and1.com; frame-src data: 'self' contact.1and1.fr clients.1and1.fr www.google.com; child-src data: 'self' www.google.com; frame-ancestors data: 'self' www.google.com https://clients.1and1.fr; report-uri https://pet.1and1.com/pet/csp/account-webapp
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://clients.1and1.fr:443/
X-Xss-Protection 1; mode=block

Request headers

Host
account.1and1.fr
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id
190BAB1001215337AA0C1C8CEFEB5FE3

Response headers

Date
Thu, 07 Jun 2018 16:35:44 GMT
Content-Type
text/html;charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Keep-Alive
timeout=15
Set-Cookie
DPX=v1:vzrvpDoOaf:D0qEXCc8:5b196cf5:de; Path=/; Expires=Thu, 07-Jun-18 17:35:44 GMT; HttpOnly JSESSIONID=968A960C53D193301D43938F3052A6B9.TCbs1a; Path=/; Secure; HttpOnly _PFXSSL_=true; Path=/
Server
Apache
Strict-Transport-Security
max-age=31536000
Referrer-Policy
strict-origin-when-cross-origin
X-Frame-Options
ALLOW-FROM https://clients.1and1.fr:443/
Cache-Control
no-cache, no-store
X-Content-Type-Options
nosniff
Content-Security-Policy
default-src 'self' *.1and1.fr pet.1and1.com frontend-services.1and1.com pixel.1und1.de; img-src 'self' data: *.1and1.fr ias.static-1and1.com media.static-1and1.com pixel.1und1.de; font-src 'self' cors.uicdn.net; script-src 'self' 'nonce-qYW2EI/LR269amoDkTF+OQ' www.google.com www.gstatic.com uir.uimserv.net ias.1and1.fr as.1and1.fr navigation.1and1.fr frontend-services.1and1.com; style-src 'self' 'unsafe-inline' navigation.1and1.fr frontend-services.1and1.com; frame-src data: 'self' contact.1and1.fr clients.1and1.fr www.google.com; child-src data: 'self' www.google.com; frame-ancestors data: 'self' www.google.com https://clients.1and1.fr; report-uri https://pet.1and1.com/pet/csp/account-webapp
Pragma
no-cache
X-XSS-Protection
1; mode=block
Link
<https://cors.uicdn.net/fonts/opensans-regular.woff2>;rel="preload";as="font";type="font/woff2";crossorigin,<https://cors.uicdn.net/fonts/ciso-styleguide-icons.woff2>;rel="preload";as="font";type="font/woff2";crossorigin
Expires
Mon, 05 Jul 1970 05:07:00 GMT
ETag
ad89d6c5ea3528e099630d0e37027390
Vary
Accept-Encoding
Content-Encoding
gzip

Redirect headers

Date
Thu, 07 Jun 2018 16:35:44 GMT
Content-Type
text/html;charset=UTF-8
Content-Length
0
Connection
keep-alive
Keep-Alive
timeout=15
Set-Cookie
DPX=v1:RUHuOYxbD1:Vo1v9Pm2:5b196cf5:de; Path=/; Expires=Thu, 07-Jun-18 17:35:44 GMT; HttpOnly JSESSIONID=EB4E714B93F111A910B1CC0633E13147.TCbs8a; Path=/; Secure; HttpOnly _PFXSSL_=true; Path=/ variant.configname=2014-07-17; Expires=Tue, 25-Jun-2086 19:49:51 GMT; Path=/ variant="bGVhZA=="; Version=1; Max-Age=2147483647; Expires=Tue, 25-Jun-2086 19:49:51 GMT; Path=/
Server
Apache
Strict-Transport-Security
max-age=31536000
X-Request-Id
zKtb6EMsTb+1Bg7RRTG54A
Location
https://account.1and1.fr/?redirect_url=https%3A%2F%2Fclients.1and1.fr%2FCenterUserdata%3Futm_campaign%3Dinvoice%26utm_source%3Dmail
Expires
Mon, 05 Jul 1970 05:07:00 GMT
Cache-Control
private
opensans-regular.woff2
cors.uicdn.net/fonts/
46 KB
46 KB
Font
General
Full URL
https://cors.uicdn.net/fonts/opensans-regular.woff2
Protocol
HTTP/1.1
Server
217.160.86.60 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
cors.uicdn.net
Software
Apache /
Resource Hash
4c1c2e95835201077586a3698cd47806dd18df10d32a1e6cb6aa9e47224a55e3

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Referer
https://account.1and1.fr/
Origin
https://account.1and1.fr

Response headers

Date
Thu, 07 Jun 2018 16:35:44 GMT
Content-Encoding
gzip
Last-Modified
Fri, 12 May 2017 09:04:39 GMT
Server
Apache
Transfer-Encoding
chunked
Content-Type
text/html
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000
Connection
keep-alive
Keep-Alive
timeout=15
Expires
Fri, 07 Jun 2019 16:35:44 GMT
ciso-styleguide-icons.woff2
cors.uicdn.net/fonts/
26 KB
26 KB
Font
General
Full URL
https://cors.uicdn.net/fonts/ciso-styleguide-icons.woff2
Protocol
HTTP/1.1
Server
217.160.86.60 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
cors.uicdn.net
Software
Apache /
Resource Hash
974971550334f44672d7e69ddd4a0bc3dd39c0afe499ee1a2e4b4ff91868eeb6

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Referer
https://account.1and1.fr/
Origin
https://account.1and1.fr

Response headers

Date
Thu, 07 Jun 2018 16:35:44 GMT
Content-Encoding
gzip
Last-Modified
Fri, 12 May 2017 09:04:39 GMT
Server
Apache
Transfer-Encoding
chunked
Content-Type
text/html
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000
Connection
keep-alive
Keep-Alive
timeout=15
Expires
Fri, 07 Jun 2019 16:35:44 GMT
account-webapp.js
frontend-services.1and1.com/t/tag/ONEANDONE/
28 KB
9 KB
Script
General
Full URL
https://frontend-services.1and1.com/t/tag/ONEANDONE/account-webapp.js
Requested by
Host: account.1and1.fr
URL: https://account.1and1.fr/?redirect_url=https%3A%2F%2Fclients.1and1.fr%2FCenterUserdata%3Futm_campaign%3Dinvoice%26utm_source%3Dmail
Protocol
HTTP/1.1
Server
217.160.86.61 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
frontend-services.1and1.com
Software
Apache /
Resource Hash
fb44f840138d1031df1d0130b88f0ffe0c9d19aced37145feb82686edd3fd9b5

Request headers

Referer
https://account.1and1.fr/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date
Thu, 07 Jun 2018 16:35:44 GMT
Content-Encoding
gzip
Last-Modified
Wed, 06 Jun 2018 10:43:28 GMT
Server
Apache
ETag
W/"28732-1528281808000-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
public, max-age=1800, s-maxage=900
Transfer-Encoding
chunked
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
main.js
account.1and1.fr/assets/js/
142 KB
48 KB
Script
General
Full URL
https://account.1and1.fr/assets/js/main.js?1.7.101
Requested by
Host: account.1and1.fr
URL: https://account.1and1.fr/?redirect_url=https%3A%2F%2Fclients.1and1.fr%2FCenterUserdata%3Futm_campaign%3Dinvoice%26utm_source%3Dmail
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
217.160.86.25 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
account.1and1.fr
Software
Apache /
Resource Hash
c480ffde73447a875f3978f8579ae7bf8dedb69b058b6b098561c82246372e62
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
account.1and1.fr
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept
*/*
Referer
https://account.1and1.fr/?redirect_url=https%3A%2F%2Fclients.1and1.fr%2FCenterUserdata%3Futm_campaign%3Dinvoice%26utm_source%3Dmail
Cookie
DPX=v1:vzrvpDoOaf:D0qEXCc8:5b196cf5:de; JSESSIONID=968A960C53D193301D43938F3052A6B9.TCbs1a; _PFXSSL_=true
Connection
keep-alive
Cache-Control
no-cache
Referer
https://account.1and1.fr/?redirect_url=https%3A%2F%2Fclients.1and1.fr%2FCenterUserdata%3Futm_campaign%3Dinvoice%26utm_source%3Dmail
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date
Thu, 07 Jun 2018 16:35:44 GMT
Content-Encoding
gzip
Last-Modified
Thu, 07 Jun 2018 08:05:58 GMT
Server
Apache
ETag
7549f88869f019477e22f40f32edf673
Vary
Accept-Encoding
Connection
keep-alive
Content-Type
application/javascript
Cache-Control
max-age=31449600
Transfer-Encoding
chunked
Strict-Transport-Security
max-age=31536000
Keep-Alive
timeout=15
globalnavigation.woff
cors.uicdn.net/fonts/
6 KB
7 KB
Font
General
Full URL
https://cors.uicdn.net/fonts/globalnavigation.woff
Requested by
Host: account.1and1.fr
URL: https://account.1and1.fr/?redirect_url=https%3A%2F%2Fclients.1and1.fr%2FCenterUserdata%3Futm_campaign%3Dinvoice%26utm_source%3Dmail
Protocol
HTTP/1.1
Server
217.160.86.60 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
cors.uicdn.net
Software
Apache /
Resource Hash
8b3470966c5fcb3ef0b57a56c29d35d48e188fb37030fb274cffd9374306fe12

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Referer
https://account.1and1.fr/
Origin
https://account.1and1.fr

Response headers

Date
Thu, 07 Jun 2018 16:35:44 GMT
Last-Modified
Mon, 10 Apr 2017 13:30:08 GMT
Server
Apache
Content-Type
application/font-woff
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
6556
Expires
Fri, 07 Jun 2019 16:35:44 GMT
navigation.js
frontend-services.1and1.com/t/navi/js/
235 KB
65 KB
Script
General
Full URL
https://frontend-services.1and1.com/t/navi/js/navigation.js?v=1.0.1
Requested by
Host: frontend-services.1and1.com
URL: https://frontend-services.1and1.com/t/tag/ONEANDONE/account-webapp.js
Protocol
HTTP/1.1
Server
217.160.86.61 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
frontend-services.1and1.com
Software
Apache /
Resource Hash
adf2f6eb6888d4ffd9e82363f3e4db4de5b582bc659df627143b56a6a016ff32

Request headers

Referer
https://account.1and1.fr/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date
Thu, 07 Jun 2018 16:35:44 GMT
Content-Encoding
gzip
Last-Modified
Wed, 06 Jun 2018 10:42:54 GMT
Server
Apache
ETag
W/"240421-1528281774000-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
public, max-age=86400, s-maxage=900
Transfer-Encoding
chunked
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
inpagelayer.js
frontend-services.1and1.com/t/inpagelayer/js/
52 KB
14 KB
Script
General
Full URL
https://frontend-services.1and1.com/t/inpagelayer/js/inpagelayer.js?v=1.0.1
Requested by
Host: frontend-services.1and1.com
URL: https://frontend-services.1and1.com/t/tag/ONEANDONE/account-webapp.js
Protocol
HTTP/1.1
Server
217.160.86.61 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
frontend-services.1and1.com
Software
Apache /
Resource Hash
d844f367597b21aa7ee975714797ddd048e2316db53076295c9e7d89ae11f00d

Request headers

Referer
https://account.1and1.fr/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date
Thu, 07 Jun 2018 16:35:44 GMT
Content-Encoding
gzip
Last-Modified
Wed, 06 Jun 2018 10:42:54 GMT
Server
Apache
ETag
W/"53432-1528281774000-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
public, max-age=86400, s-maxage=900
Transfer-Encoding
chunked
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
ias.js
frontend-services.1and1.com/t/
65 KB
20 KB
Script
General
Full URL
https://frontend-services.1and1.com/t/ias.js?v=1
Requested by
Host: frontend-services.1and1.com
URL: https://frontend-services.1and1.com/t/tag/ONEANDONE/account-webapp.js
Protocol
HTTP/1.1
Server
217.160.86.74 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
frontend-services.1and1.com
Software
Apache /
Resource Hash
cf1c2954d5ae1b447835b7569e6471e79bc74fa5cd6f9ba4e962894c814540d2

Request headers

Referer
https://account.1and1.fr/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date
Thu, 07 Jun 2018 16:35:44 GMT
Content-Encoding
gzip
Last-Modified
Wed, 06 Jun 2018 10:43:28 GMT
Server
Apache
ETag
W/"66509-1528281808000-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
public, max-age=86400, s-maxage=900
Transfer-Encoding
chunked
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
inpagelayer.css
frontend-services.1and1.com/t/inpagelayer/css/
22 KB
4 KB
Stylesheet
General
Full URL
https://frontend-services.1and1.com/t/inpagelayer/css/inpagelayer.css?v=0.0.19
Requested by
Host: frontend-services.1and1.com
URL: https://frontend-services.1and1.com/t/inpagelayer/js/inpagelayer.js?v=1.0.1
Protocol
HTTP/1.1
Server
217.160.86.74 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
frontend-services.1and1.com
Software
Apache /
Resource Hash
4903ee4be30302bb874b36aa08a7964f65d472f2b0fda76281d31d37056ea233

Request headers

Referer
https://account.1and1.fr/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date
Thu, 07 Jun 2018 16:35:44 GMT
Content-Encoding
gzip
Last-Modified
Wed, 06 Jun 2018 10:42:54 GMT
Server
Apache
ETag
W/"22221-1528281774000-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
public, max-age=86400, s-maxage=900
Transfer-Encoding
chunked
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
/
uir.uimserv.net/sid/
45 B
601 B
Script
General
Full URL
https://uir.uimserv.net/sid/
Requested by
Host: account.1and1.fr
URL: https://account.1and1.fr/assets/js/main.js?1.7.101
Protocol
HTTP/1.1
Server
195.20.250.237 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
x.uimserv.net
Software
POPS-Web/2 /
Resource Hash
a6c2f542b445dcd1ab4fb5f34e310a13d319e2cde7987950922ce406127ae8fb

Request headers

Referer
https://account.1and1.fr/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 07 Jun 2018 16:35:44 GMT
Server
POPS-Web/2
P3P
P3P=policyref="http://adimg.uimserv.net/UIM/netgravity/p3p/p3p.xml", CP="NON DSP NID CURa ADMa DEVa TAIa PSAa PSDa OUR STP BUS UNI COM NAV INT"
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0, max-age=0
Content-Type
text/javascript;charset=utf-8
Content-Length
45
Expires
Wed, 20 Oct 2010 20:10:20 GMT
navigation.css
frontend-services.1and1.com/t/navi/css/
68 KB
20 KB
Stylesheet
General
Full URL
https://frontend-services.1and1.com/t/navi/css/navigation.css?v=1.0.39
Requested by
Host: frontend-services.1and1.com
URL: https://frontend-services.1and1.com/t/navi/js/navigation.js?v=1.0.1
Protocol
HTTP/1.1
Server
217.160.86.74 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
frontend-services.1and1.com
Software
Apache /
Resource Hash
fb701e197045ebc60636de2447c9b96b91c60cc40ca797a13b34442f865affec

Request headers

Referer
https://account.1and1.fr/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date
Thu, 07 Jun 2018 16:35:44 GMT
Content-Encoding
gzip
Last-Modified
Wed, 06 Jun 2018 10:42:54 GMT
Server
Apache
ETag
W/"69340-1528281774000-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
public, max-age=86400, s-maxage=900
Transfer-Encoding
chunked
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
/
navigation.1and1.fr/2.0/navi/FR/
377 B
820 B
XHR
General
Full URL
https://navigation.1and1.fr/2.0/navi/FR/
Requested by
Host: frontend-services.1and1.com
URL: https://frontend-services.1and1.com/t/navi/js/navigation.js?v=1.0.1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
217.160.86.16 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
navigation.1und1.de
Software
Apache /
Resource Hash
44d8e5673dd643b84bf9e2a3ad1950067ce87e0d3d9807ef9f6f85c379d51e09
Security Headers
Name Value
Strict-Transport-Security max-age=31536000 ; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Origin
https://account.1and1.fr
Accept-Encoding
gzip, deflate
Host
navigation.1and1.fr
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept
*/*
Referer
https://account.1and1.fr/
Connection
keep-alive
Cache-Control
no-cache
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Referer
https://account.1and1.fr/
Origin
https://account.1and1.fr

Response headers

Date
Thu, 07 Jun 2018 16:35:44 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Transfer-Encoding
chunked
Connection
Keep-Alive
Vary
Origin,Accept-Encoding
X-XSS-Protection
1; mode=block
Pragma
no-cache
Server
Apache
X-Frame-Options
DENY
Strict-Transport-Security
max-age=31536000 ; includeSubDomains
Content-Type
application/json
Access-Control-Allow-Origin
https://account.1and1.fr
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Keep-Alive
timeout=5, max=100
Expires
0
ciso-styleguide-icons.woff
cors.uicdn.net/fonts/
65 KB
66 KB
Font
General
Full URL
https://cors.uicdn.net/fonts/ciso-styleguide-icons.woff
Requested by
Host: account.1and1.fr
URL: https://account.1and1.fr/assets/js/main.js?1.7.101
Protocol
HTTP/1.1
Server
217.160.86.60 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
cors.uicdn.net
Software
Apache /
Resource Hash
e902f78d9c596c6b135c83ec1c44ae4b221dcb3dfc5fffcfe007cbf83b24ad45

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Referer
https://account.1and1.fr/
Origin
https://account.1and1.fr

Response headers

Date
Thu, 07 Jun 2018 16:35:44 GMT
Last-Modified
Mon, 27 Nov 2017 12:14:49 GMT
Server
Apache
Content-Type
application/font-woff
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
66952
Expires
Fri, 07 Jun 2019 16:35:44 GMT
Cookie set zones
ias.1and1.fr/ias/
6 KB
2 KB
Script
General
Full URL
https://ias.1and1.fr/ias/zones?zones=%5B%7B%22zoneId%22%3A%22login_offerlink%22%2C%22container%22%3A%22ias.zone0%22%7D%2C%7B%22zoneId%22%3A%22login_teaser_slot1%22%2C%22container%22%3A%22ias.zone1%22%7D%2C%7B%22zoneId%22%3A%22login_teaser_slot2%22%2C%22container%22%3A%22ias.zone2%22%7D%2C%7B%22zoneId%22%3A%22login_teaser_slot3%22%2C%22container%22%3A%22ias.zone3%22%7D%5D&nc=1528389345056&v=2.1.39&subset=false&application=ACCOUNT_WEBAPP&page=login&pageCategories=%5B%5D&lang=fr_FR&data=%7B%22domainCount%22%3A0%2C%22subdomainCount%22%3A0%7D&screenWidth=1600&screenHeight=1200&callback=__iascbvLMuU
Requested by
Host: frontend-services.1and1.com
URL: https://frontend-services.1and1.com/t/ias.js?v=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
217.160.86.156 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
ias.1and1.fr
Software
Apache /
Resource Hash
5ab14d1d73fad55bee68fdca51073c4f2dfb6035b504f5e2897302341dc66735

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
ias.1and1.fr
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept
*/*
Referer
https://account.1and1.fr/
Cookie
NG_USERID=ac13e481-5756-1528389344-0
Connection
keep-alive
Cache-Control
no-cache
Referer
https://account.1and1.fr/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date
Thu, 07 Jun 2018 16:35:45 GMT
Content-Encoding
gzip
Server
Apache
X-Cache-Status
MISS
Vary
Accept-Encoding
Content-Type
application/x-javascript
Set-Cookie
DPX=v1:+ZG620hHln:uHBoU3fO:5b196cf6:de; Path=/; Expires=Thu, 07-Jun-18 17:35:45 GMT; HttpOnly variant.configname=2017-04-18;Version=1;Comment=;Path=/;Max-Age=16070400 icnt="{"c":{},"v":"2018-06-01"}";Version=1;Comment=;Path=/;Max-Age=2678400 variant="lead:test";Version=1;Comment=;Path=/;Max-Age=16070400 fcnt="{"c":[{"z":1016,"c":{"320":1}},{"z":43,"c":{"146":1}},{"z":44,"c":{"795":1}},{"z":45,"c":{"147":1}}],"v":"2018-06-01"}";Version=1;Comment=;Path=/;Max-Age=2678400
Cache-Control
no-cache, no-store, private, must-revalidate
Transfer-Encoding
chunked
Connection
keep-alive
Keep-Alive
timeout=15
rum
pixel.1und1.de/
126 B
492 B
XHR
General
Full URL
https://pixel.1und1.de/rum?dom_serial=1528389344158&application=PU.LO.FR&page=login&node_elements=140&page_size=57199&browser=chrome&browser_version=66&browser_locale=en-US&os=linux&market=FR&variant=&referer=&device_type=desktop&unload_time=0&navigation_time=303&browser_time=872&page_load_time=1184&redirect_time=0&app_cache_time=-112&dns_time=23&tcp_time=34&request_time=47&response_time=8&resources=16&interactive_time=14&speedIndex=295&startRender=295&ttfb=-8&pfx_get_dom=8&pfx_hdl_doc=3&pfx_rex_doc=0&pfx_pre_proc=1&ng_userid=ac13e481-5756-1528389344-0&application_group=account&request_method=GET&request_id=&application_version=1.7.101&had_data=false&visit_id=
Requested by
Host: account.1and1.fr
URL: https://account.1and1.fr/assets/js/main.js?1.7.101
Protocol
HTTP/1.1
Server
217.160.86.204 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
pixel.1und1.de
Software
Apache /
Resource Hash
a607b3c3e0d09d7f339e0035f16f99bf93637dee0eb27b2b9c447701fefa2ace
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept
*/*
Referer
https://account.1and1.fr/
Origin
https://account.1and1.fr
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date
Thu, 07 Jun 2018 16:35:45 GMT
Server
Apache
Strict-Transport-Security
max-age=31536000
Content-Type
image/png
Access-Control-Allow-Origin
https://account.1and1.fr
Cache-Control
no-cache, no-store, must-revalidate
Connection
Keep-Alive
Keep-Alive
timeout=5, max=100
Content-Length
126
Expires
Mon, 05 Jul 1970 05:07:00 GMT
LOGIN_DOMAIN_DEFAULT_domain_fr_2014_11.png
media.static-1and1.com/fileadmin/ONEANDONE_HOSTING/import/
5 KB
6 KB
Image
General
Full URL
https://media.static-1and1.com/fileadmin/ONEANDONE_HOSTING/import/LOGIN_DOMAIN_DEFAULT_domain_fr_2014_11.png?h=b69148374e850c8d20c147fff8cedcc069085d1f
Protocol
HTTP/1.1
Server
217.160.86.27 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
media.static-1and1.com
Software
Apache /
Resource Hash
2ab01becc8e7ef1c9f32732aabbb7de574b21df8f7bbb66ab36287b5c7c24682
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://account.1and1.fr/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date
Thu, 07 Jun 2018 16:35:45 GMT
X-Content-Type-Options
nosniff
Last-Modified
Tue, 02 Jan 2018 13:51:17 GMT
Server
Apache
X-Cache-Status
MISS
Strict-Transport-Security
max-age=31536000
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
5477
LOGIN_OFFICE365_DEFAULT_office-small.png
media.static-1and1.com/fileadmin/ONEANDONE_HOSTING/import/
4 KB
4 KB
Image
General
Full URL
https://media.static-1and1.com/fileadmin/ONEANDONE_HOSTING/import/LOGIN_OFFICE365_DEFAULT_office-small.png?h=0c15c06ccb274fcba817bbcfd9929e8ea7d595bc
Protocol
HTTP/1.1
Server
217.160.86.27 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
media.static-1and1.com
Software
Apache /
Resource Hash
98d317e0d147338e6f290512b85f5ff97578b943c1c992f8398895ca06852a3e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://account.1and1.fr/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date
Thu, 07 Jun 2018 16:35:45 GMT
X-Content-Type-Options
nosniff
Last-Modified
Thu, 11 Jan 2018 11:20:15 GMT
Server
Apache
X-Cache-Status
MISS
Strict-Transport-Security
max-age=31536000
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
4023
LOGIN_DIY_DEFAULT_BKS_kachel_eshop_INT.png
media.static-1and1.com/fileadmin/ONEANDONE_HOSTING/import/
9 KB
9 KB
Image
General
Full URL
https://media.static-1and1.com/fileadmin/ONEANDONE_HOSTING/import/LOGIN_DIY_DEFAULT_BKS_kachel_eshop_INT.png?h=8bb0fb1ceb477133a884871039371fe80cb750ab
Protocol
HTTP/1.1
Server
217.160.86.27 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
media.static-1and1.com
Software
Apache /
Resource Hash
be5612cdee078f1c15a27ab82fa8e94de681db9ea0e0351f2ab19bd1aabc722d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://account.1and1.fr/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date
Thu, 07 Jun 2018 16:35:45 GMT
X-Content-Type-Options
nosniff
Last-Modified
Tue, 02 Jan 2018 13:51:17 GMT
Server
Apache
X-Cache-Status
MISS
Strict-Transport-Security
max-age=31536000
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
9209

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: 1&1 Ionos (Telecommunication)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| OAO object| jQBrowser object| core object| __core-js_shared__ object| global object| System function| asap function| Observable function| setImmediate function| clearImmediate function| Dict function| delay object| _ string| __UI_nguserid object| IAS

1 Cookies

Domain/Path Name / Value
.1and1.fr/ Name: NG_USERID
Value: ac13e481-5756-1528389344-0

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'self' *.1and1.fr pet.1and1.com frontend-services.1and1.com pixel.1und1.de; img-src 'self' data: *.1and1.fr ias.static-1and1.com media.static-1and1.com pixel.1und1.de; font-src 'self' cors.uicdn.net; script-src 'self' 'nonce-qYW2EI/LR269amoDkTF+OQ' www.google.com www.gstatic.com uir.uimserv.net ias.1and1.fr as.1and1.fr navigation.1and1.fr frontend-services.1and1.com; style-src 'self' 'unsafe-inline' navigation.1and1.fr frontend-services.1and1.com; frame-src data: 'self' contact.1and1.fr clients.1and1.fr www.google.com; child-src data: 'self' www.google.com; frame-ancestors data: 'self' www.google.com https://clients.1and1.fr; report-uri https://pet.1and1.com/pet/csp/account-webapp
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://clients.1and1.fr:443/
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

2mpg.mj.am
account.1and1.fr
clients.1and1.fr
cors.uicdn.net
frontend-services.1and1.com
ias.1and1.fr
media.static-1and1.com
navigation.1and1.fr
pixel.1und1.de
uir.uimserv.net
104.199.110.216
195.20.250.237
217.160.86.105
217.160.86.156
217.160.86.16
217.160.86.204
217.160.86.25
217.160.86.27
217.160.86.60
217.160.86.61
217.160.86.74
2ab01becc8e7ef1c9f32732aabbb7de574b21df8f7bbb66ab36287b5c7c24682
44d8e5673dd643b84bf9e2a3ad1950067ce87e0d3d9807ef9f6f85c379d51e09
46884c75a491b97599a880e70155750e21cdcf022576ed07f5da8c9f84d36b22
4903ee4be30302bb874b36aa08a7964f65d472f2b0fda76281d31d37056ea233
4c1c2e95835201077586a3698cd47806dd18df10d32a1e6cb6aa9e47224a55e3
5ab14d1d73fad55bee68fdca51073c4f2dfb6035b504f5e2897302341dc66735
8b3470966c5fcb3ef0b57a56c29d35d48e188fb37030fb274cffd9374306fe12
974971550334f44672d7e69ddd4a0bc3dd39c0afe499ee1a2e4b4ff91868eeb6
98d317e0d147338e6f290512b85f5ff97578b943c1c992f8398895ca06852a3e
a607b3c3e0d09d7f339e0035f16f99bf93637dee0eb27b2b9c447701fefa2ace
a6c2f542b445dcd1ab4fb5f34e310a13d319e2cde7987950922ce406127ae8fb
adf2f6eb6888d4ffd9e82363f3e4db4de5b582bc659df627143b56a6a016ff32
be5612cdee078f1c15a27ab82fa8e94de681db9ea0e0351f2ab19bd1aabc722d
c480ffde73447a875f3978f8579ae7bf8dedb69b058b6b098561c82246372e62
cf1c2954d5ae1b447835b7569e6471e79bc74fa5cd6f9ba4e962894c814540d2
d844f367597b21aa7ee975714797ddd048e2316db53076295c9e7d89ae11f00d
e902f78d9c596c6b135c83ec1c44ae4b221dcb3dfc5fffcfe007cbf83b24ad45
fb44f840138d1031df1d0130b88f0ffe0c9d19aced37145feb82686edd3fd9b5
fb701e197045ebc60636de2447c9b96b91c60cc40ca797a13b34442f865affec