urlscan.io logo urlscan.io
SecurityTrails logo

optus-id6868.4lima.de Open in urlscan Pro
2a00:f48:2000:affe::50  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://helminsurance.com.au/wp-admin/js/css/index1.html
Effective URL: https://optus-id6868.4lima.de/
Submission Tags: 7466600
Submission: On March 18 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 3 countries across 4 domains to perform 13 HTTP transactions. The main IP is 2a00:f48:2000:affe::50, located in Germany and belongs to TTM, DE. The main domain is optus-id6868.4lima.de.
TLS certificate: Issued by R3 on February 18th 2022. Valid for: 3 months.
This is the only time optus-id6868.4lima.de was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Optus (Telecommunication)

Domain & IP information

IP Address AS Autonomous System
1 103.18.109.187 132680 (SYNERGYWH...)
1 151.101.64.64 54113 (FASTLY)
4 2a00:f48:2000... 47447 (TTM)
1 13.225.80.2 16509 (AMAZON-02)
6 13.225.80.29 16509 (AMAZON-02)
13 6
1    103.18.109.187 (Sydney, Australia)

ASN132680 (SYNERGYWHOLESALE-AP SYNERGY WHOLESALE PTY LTD, AU)
PTR: r11.cpcloud.com.au
helminsurance.com.au
1    151.101.64.64 (United States)

ASN54113 (FASTLY, US)
disq.us
4    2a00:f48:2000:affe::50 (Germany)

ASN47447 (TTM, DE)
optus-id6868.4lima.de
1    13.225.80.2 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-80-2.fra2.r.cloudfront.net
cdn.optusdigital.com
6    13.225.80.29 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-80-29.fra2.r.cloudfront.net
1.cdn.optusdigital.com
cdn.optusdigital.com
Apex Domain
Subdomains		 Transfer
7 optusdigital.com
cdn.optusdigital.com — Cisco Umbrella Rank: 988537
1.cdn.optusdigital.com
435 KB
4 4lima.de
optus-id6868.4lima.de
98 KB
1 disq.us
disq.us — Cisco Umbrella Rank: 19814
629 B
1 helminsurance.com.au
helminsurance.com.au
371 B
13 4
Domain Requested by
4 1.cdn.optusdigital.com optus-id6868.4lima.de
4 optus-id6868.4lima.de disq.us
optus-id6868.4lima.de
3 cdn.optusdigital.com optus-id6868.4lima.de
cdn.optusdigital.com
1 disq.us
1 helminsurance.com.au
13 5

This site contains links to these domains. Also see Links.

Domain
www.optus.com.au
www.singtel.com
go.microsoft.com
www.bing.com
Subject Issuer Validity Valid
*.helminsurance.com.au
R3		 2022-01-18 -
2022-04-18		 3 months crt.sh
disq.us
GlobalSign Atlas R3 DV TLS CA 2022 Q1		 2022-01-28 -
2023-03-01		 a year crt.sh
*.4lima.de
R3		 2022-02-18 -
2022-05-19		 3 months crt.sh
cdn.optusdigital.com
Amazon		 2021-11-08 -
2022-12-06		 a year crt.sh

This page contains 1 frames:

Primary Page: https://optus-id6868.4lima.de/
Frame ID: 3342EF4C9849106E86B7450D4D791F1F
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

My Account Login - Optus

Page URL History Show full URLs

  1. https://helminsurance.com.au/wp-admin/js/css/index1.html Page URL
  2. https://disq.us/?url=https%3A%2F%2Foptus-id6868.4lima.de%2F&key=UEnRPdoWuEHmiHgt596tmA Page URL
  3. https://optus-id6868.4lima.de/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /etc/designs/

Page Statistics

13
Requests

100 %
HTTPS

20 %
IPv6

4
Domains

5
Subdomains

6
IPs

3
Countries

534 kB
Transfer

1566 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://helminsurance.com.au/wp-admin/js/css/index1.html Page URL
  2. https://disq.us/?url=https%3A%2F%2Foptus-id6868.4lima.de%2F&key=UEnRPdoWuEHmiHgt596tmA Page URL
  3. https://optus-id6868.4lima.de/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
index1.html
helminsurance.com.au/wp-admin/js/css/ 		134 B
371 B 		Document
General
Check archive.org
Download Go to
Full URL
https://helminsurance.com.au/wp-admin/js/css/index1.html
Protocol
H2
Security
TLS 1.3, , CHACHA20_POLY1305
Server
103.18.109.187 Sydney, Australia, ASN132680 (SYNERGYWHOLESALE-AP SYNERGY WHOLESALE PTY LTD, AU),
Reverse DNS
r11.cpcloud.com.au
Software
LiteSpeed /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

content-type
text/html
last-modified
Fri, 18 Mar 2022 03:30:53 GMT
accept-ranges
bytes
content-length
134
date
Fri, 18 Mar 2022 05:26:17 GMT
server
LiteSpeed
alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
/
disq.us/ 		255 B
629 B 		Document
General
Check archive.org
Download Go to
Full URL
https://disq.us/?url=https%3A%2F%2Foptus-id6868.4lima.de%2F&key=UEnRPdoWuEHmiHgt596tmA
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.64.64 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://helminsurance.com.au/

Response headers

Connection
keep-alive
Content-Length
189
Server
nginx
Content-Type
text/html
X-Content-Type-Options
nosniff
X-XSS-Protection
1; mode=block
Expires
Fri, 18 Mar 2022 06:25:20 GMT
Cache-Control
max-age=3600
Content-Encoding
gzip
X-Backend
shortener
Disqus-Cachetype
TTL
Disqus-NoCache
1
Date
Fri, 18 Mar 2022 05:26:18 GMT
Age
57
Vary
Accept-Encoding
Cross-Origin-Resource-Policy
cross-origin
Primary Request /
optus-id6868.4lima.de/ 		118 KB
18 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://optus-id6868.4lima.de/
Requested by
Host: disq.us
URL: https://disq.us/?url=https%3A%2F%2Foptus-id6868.4lima.de%2F&key=UEnRPdoWuEHmiHgt596tmA
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),
Reverse DNS
Software
openresty / PHP/7.4.28
Resource Hash
853044bbf2616fba0613111d97fa4d228dedaf9c396961aa0bd6597e71468844
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://disq.us/

Response headers

server
openresty
date
Fri, 18 Mar 2022 05:26:18 GMT
content-type
text/html; charset=UTF-8
vary
Accept-Encoding Accept-Encoding
x-lima-id
arjC9RPmq0fdhqxxDh
x-powered-by
PHP/7.4.28
content-security-policy
upgrade-insecure-requests
content-encoding
gzip
lux.base.50b3d4d3488ad779a49fcece0f6c4d06.css
cdn.optusdigital.com/etc/designs/springd/clientlibs/osg/ 		499 KB
50 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdn.optusdigital.com/etc/designs/springd/clientlibs/osg/lux.base.50b3d4d3488ad779a49fcece0f6c4d06.css
Requested by
Host: optus-id6868.4lima.de
URL: https://optus-id6868.4lima.de/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.80.2 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-80-2.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
960cb8583a7b2a787da1670e1ce1658fdb8c45a21b4e40a2788936b272256828

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://optus-id6868.4lima.de/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 14 Mar 2022 02:25:19 GMT
content-encoding
gzip
last-modified
Wed, 16 Feb 2022 01:35:39 GMT
server
AmazonS3
age
356459
etag
W/"50b3d4d3488ad779a49fcece0f6c4d06"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/css
via
1.1 91ba7c34719cd9c69e0357c149b94b90.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C2
x-amz-cf-id
Jb40gn6iJZuO27UKtpQ0xYqxaCAMG2NaInoa1DbjkZvrq4iwwTj6xg==
markpro-bold.woff
1.cdn.optusdigital.com/LUX2/assets/fonts/ 		66 KB
67 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://1.cdn.optusdigital.com/LUX2/assets/fonts/markpro-bold.woff
Requested by
Host: optus-id6868.4lima.de
URL: https://optus-id6868.4lima.de/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.80.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-80-29.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
06e6ac46fef95be90de802cbf8f07aefa9d2c9416ea8e32bccef5d526bb96e5f

Request headers

Referer
https://optus-id6868.4lima.de/
Origin
https://optus-id6868.4lima.de
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Fri, 18 Mar 2022 03:17:09 GMT
via
1.1 ccfe5851ecd4194e2d976fb32dec7538.cloudfront.net (CloudFront)
age
7749
x-cache
Hit from cloudfront
content-length
67824
last-modified
Thu, 10 Jun 2021 23:48:31 GMT
server
AmazonS3
etag
"507b76aa0351c57ece90f02239b62ba3"
vary
Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods
GET
content-type
binary/octet-stream
access-control-allow-origin
*
cache-control
max-age=31536000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
Kq4JGLrGAAFAQRjQ4Ez0uo_BDT1Xbz52KJEq2VwwxkZ2IyC59k4-9g==
markpro-heavy.woff
1.cdn.optusdigital.com/LUX2/assets/fonts/ 		66 KB
67 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://1.cdn.optusdigital.com/LUX2/assets/fonts/markpro-heavy.woff
Requested by
Host: optus-id6868.4lima.de
URL: https://optus-id6868.4lima.de/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.80.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-80-29.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
4447d75f8502cc1989762d2281eb12cf991055b71f94215ad2b3d6aca6295ab7

Request headers

Referer
https://optus-id6868.4lima.de/
Origin
https://optus-id6868.4lima.de
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Fri, 18 Mar 2022 03:17:09 GMT
via
1.1 ccfe5851ecd4194e2d976fb32dec7538.cloudfront.net (CloudFront)
age
7749
x-cache
Hit from cloudfront
content-length
67808
last-modified
Thu, 10 Jun 2021 23:48:34 GMT
server
AmazonS3
etag
"b7b268c962e2855acf62186c96a55466"
vary
Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods
GET
content-type
binary/octet-stream
access-control-allow-origin
*
cache-control
max-age=31536000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
KXPH7ruUHEwgkw0FGa7-TNAI-ZeHjoMZGqfwYcolyQ-l_ZDwkdB9qg==
markpro-medium.woff
1.cdn.optusdigital.com/LUX2/assets/fonts/ 		62 KB
63 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://1.cdn.optusdigital.com/LUX2/assets/fonts/markpro-medium.woff
Requested by
Host: optus-id6868.4lima.de
URL: https://optus-id6868.4lima.de/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.80.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-80-29.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
5576c66b220ae8ee5288c5483174ab06ce19583f41dce09f3ee836f7a24e7bc9

Request headers

Referer
https://optus-id6868.4lima.de/
Origin
https://optus-id6868.4lima.de
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Fri, 18 Mar 2022 03:17:09 GMT
via
1.1 ccfe5851ecd4194e2d976fb32dec7538.cloudfront.net (CloudFront)
age
7749
x-cache
Hit from cloudfront
content-length
63644
last-modified
Thu, 10 Jun 2021 23:48:37 GMT
server
AmazonS3
etag
"e8d148d9b31626f122da0039b97cbdf5"
vary
Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods
GET
content-type
binary/octet-stream
access-control-allow-origin
*
cache-control
max-age=31536000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
1eOc3gohDwsTiog8c-5QkaWd1Kg2F9gqEfedEz7IqLavIuZEZXHP8w==
markpro.woff
1.cdn.optusdigital.com/LUX2/assets/fonts/ 		65 KB
66 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://1.cdn.optusdigital.com/LUX2/assets/fonts/markpro.woff
Requested by
Host: optus-id6868.4lima.de
URL: https://optus-id6868.4lima.de/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.80.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-80-29.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
7b1443ccd9f5702ad832d5f8f58cd7955da80b6be466208e37900863097dbb12

Request headers

Referer
https://optus-id6868.4lima.de/
Origin
https://optus-id6868.4lima.de
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Fri, 18 Mar 2022 03:17:09 GMT
via
1.1 ccfe5851ecd4194e2d976fb32dec7538.cloudfront.net (CloudFront)
age
7749
x-cache
Hit from cloudfront
content-length
66552
last-modified
Thu, 10 Jun 2021 23:48:43 GMT
server
AmazonS3
etag
"ee10f7196c1b125a3b8222341465bf5e"
vary
Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods
GET
content-type
binary/octet-stream
access-control-allow-origin
*
cache-control
max-age=31536000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
ACOSbM8DYiGaT9WdVYb61VKw86-T2aSIGK7Hhv0Cka4DUnicESGGCQ==
lux.865b8f6d73733e01f46049f4d7740f0a.css
optus-id6868.4lima.de/etc/designs/springd/clientlibs/page-bundle/content/optus/en/my-account-login/ 		447 KB
61 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://optus-id6868.4lima.de/etc/designs/springd/clientlibs/page-bundle/content/optus/en/my-account-login/lux.865b8f6d73733e01f46049f4d7740f0a.css
Requested by
Host: optus-id6868.4lima.de
URL: https://optus-id6868.4lima.de/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),
Reverse DNS
Software
openresty /
Resource Hash
7c109c4810644cde7d578a088c97f91392251a959e1615191af6a9ea67602249
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://optus-id6868.4lima.de/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Fri, 18 Mar 2022 05:26:18 GMT
content-encoding
gzip
last-modified
Thu, 24 Feb 2022 00:01:08 GMT
server
openresty
etag
W/"6fb75-5d8b847753900"
vary
Accept-Encoding, Accept-Encoding
content-type
text/css
x-lima-id
arirKOWz3AkjA5vgQA
cache-control
max-age=2592000
content-security-policy
upgrade-insecure-requests
expires
Sun, 17 Apr 2022 05:26:18 GMT
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
eea41981c12ea68bbb642bc6fccdcfce8ce0c6ac21f998c6621a486db6f8e004

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type
image/png
ee10f7196c1b125a3b8222341465bf5e.woff
cdn.optusdigital.com/etc/designs/springd/clientlibs/osg/assets/fonts/markpro/ 		65 KB
65 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://cdn.optusdigital.com/etc/designs/springd/clientlibs/osg/assets/fonts/markpro/ee10f7196c1b125a3b8222341465bf5e.woff
Requested by
Host: cdn.optusdigital.com
URL: https://cdn.optusdigital.com/etc/designs/springd/clientlibs/osg/lux.base.50b3d4d3488ad779a49fcece0f6c4d06.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.80.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-80-29.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
7b1443ccd9f5702ad832d5f8f58cd7955da80b6be466208e37900863097dbb12

Request headers

Referer
https://cdn.optusdigital.com/etc/designs/springd/clientlibs/osg/lux.base.50b3d4d3488ad779a49fcece0f6c4d06.css
Origin
https://optus-id6868.4lima.de
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Fri, 18 Mar 2022 03:17:10 GMT
via
1.1 ccfe5851ecd4194e2d976fb32dec7538.cloudfront.net (CloudFront)
last-modified
Wed, 02 Mar 2022 01:40:04 GMT
server
AmazonS3
age
7749
etag
"ee10f7196c1b125a3b8222341465bf5e"
vary
Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods
GET
content-type
binary/octet-stream
access-control-allow-origin
*
x-cache
Hit from cloudfront
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-length
66552
x-amz-cf-id
jKYjpsurbfL1RnR96eWOZrGQLvEr7g3QC9x5wA5lZ3sRa07cawq8rQ==
57d7b446c53b36cb99656354d6cbd2b7.woff
optus-id6868.4lima.de/etc/designs/springd/clientlibs/page-bundle/content/optus/en/my-account-login/assets/fonts/lux-icons/ 		174 B
379 B 		Font
General
Check archive.org
Download Go to
Full URL
https://optus-id6868.4lima.de/etc/designs/springd/clientlibs/page-bundle/content/optus/en/my-account-login/assets/fonts/lux-icons/57d7b446c53b36cb99656354d6cbd2b7.woff
Requested by
Host: optus-id6868.4lima.de
URL: https://optus-id6868.4lima.de/etc/designs/springd/clientlibs/page-bundle/content/optus/en/my-account-login/lux.865b8f6d73733e01f46049f4d7740f0a.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),
Reverse DNS
Software
openresty /
Resource Hash
be10b82a375833ed19e0474216862b4f3c631fabcb704a38d17d7443cac6e079
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

Referer
https://optus-id6868.4lima.de/etc/designs/springd/clientlibs/page-bundle/content/optus/en/my-account-login/lux.865b8f6d73733e01f46049f4d7740f0a.css
Origin
https://optus-id6868.4lima.de
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Fri, 18 Mar 2022 05:26:18 GMT
last-modified
Thu, 24 Feb 2022 00:01:08 GMT
server
openresty
etag
"ae-5d8b847753900"
content-type
application/font-woff
x-lima-id
arEruIHMzf2QTsA9sg
content-security-policy
upgrade-insecure-requests
accept-ranges
bytes
content-length
174
6b6792eb1ab5c78cbd100f3e24acd22d.ttf
optus-id6868.4lima.de/etc/designs/springd/clientlibs/page-bundle/content/optus/en/my-account-login/assets/fonts/lux-icons/ 		118 KB
18 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://optus-id6868.4lima.de/etc/designs/springd/clientlibs/page-bundle/content/optus/en/my-account-login/assets/fonts/lux-icons/6b6792eb1ab5c78cbd100f3e24acd22d.ttf
Requested by
Host: optus-id6868.4lima.de
URL: https://optus-id6868.4lima.de/etc/designs/springd/clientlibs/page-bundle/content/optus/en/my-account-login/lux.865b8f6d73733e01f46049f4d7740f0a.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a00:f48:2000:affe::50 , Germany, ASN47447 (TTM, DE),
Reverse DNS
Software
openresty / PHP/7.4.28
Resource Hash
4545c050cb69c960041a32083f22ea53bf35fe7e30004d9db6de97f6017c11fb
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

Referer
https://optus-id6868.4lima.de/etc/designs/springd/clientlibs/page-bundle/content/optus/en/my-account-login/lux.865b8f6d73733e01f46049f4d7740f0a.css
Origin
https://optus-id6868.4lima.de
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Fri, 18 Mar 2022 05:26:18 GMT
content-encoding
gzip
server
openresty
x-powered-by
PHP/7.4.28
vary
Accept-Encoding, Accept-Encoding
content-type
text/html; charset=UTF-8
x-lima-id
arLkO1p9TLOxbQHUVh
content-security-policy
upgrade-insecure-requests
57d7b446c53b36cb99656354d6cbd2b7.woff
cdn.optusdigital.com/etc/designs/springd/clientlibs/osg/assets/fonts/lux-icons/ 		58 KB
58 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://cdn.optusdigital.com/etc/designs/springd/clientlibs/osg/assets/fonts/lux-icons/57d7b446c53b36cb99656354d6cbd2b7.woff
Requested by
Host: cdn.optusdigital.com
URL: https://cdn.optusdigital.com/etc/designs/springd/clientlibs/osg/lux.base.50b3d4d3488ad779a49fcece0f6c4d06.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.80.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-80-29.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
535547b941c74c7aa5b0b6c7c03737140521e3fd33aeeb717663b02bdb217bd7

Request headers

Referer
https://cdn.optusdigital.com/etc/designs/springd/clientlibs/osg/lux.base.50b3d4d3488ad779a49fcece0f6c4d06.css
Origin
https://optus-id6868.4lima.de
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Fri, 18 Mar 2022 03:17:10 GMT
via
1.1 ccfe5851ecd4194e2d976fb32dec7538.cloudfront.net (CloudFront)
last-modified
Wed, 16 Feb 2022 01:35:28 GMT
server
AmazonS3
age
7749
etag
"57d7b446c53b36cb99656354d6cbd2b7"
vary
Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods
GET
content-type
binary/octet-stream
access-control-allow-origin
*
x-cache
Hit from cloudfront
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-length
58916
x-amz-cf-id
U-DOmgl7uYHeGbHasv6q_O1Xk72WpxNmv8RHTu-wxNgdNqzYR7M5_Q==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Optus (Telecommunication)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored undefined| LanguageMenu object| LanguageMenu_keys object| LanguageMenu_values function| LanguageMenu_callback string| LanguageMenu_popupid number| intervalId

3 Cookies

Domain/Path Name / Value
optus-id6868.4lima.de/ Name: _lcp
Value: a
optus-id6868.4lima.de/ Name: _lcp2
Value: a
optus-id6868.4lima.de/ Name: _lcp3
Value: a

10 Console Messages

Source Level URL
Text
other warning URL: https://optus-id6868.4lima.de/
Message:
Failed to decode downloaded font: https://optus-id6868.4lima.de/etc/designs/springd/clientlibs/page-bundle/content/optus/en/my-account-login/assets/fonts/lux-icons/57d7b446c53b36cb99656354d6cbd2b7.woff
other warning URL: https://optus-id6868.4lima.de/
Message:
OTS parsing error: invalid sfntVersion: 1315905603
other warning URL: https://optus-id6868.4lima.de/
Message:
Failed to decode downloaded font: https://optus-id6868.4lima.de/etc/designs/springd/clientlibs/page-bundle/content/optus/en/my-account-login/assets/fonts/lux-icons/57d7b446c53b36cb99656354d6cbd2b7.woff
other warning URL: https://optus-id6868.4lima.de/
Message:
OTS parsing error: invalid sfntVersion: 1315905603
other warning URL: https://optus-id6868.4lima.de/
Message:
Failed to decode downloaded font: https://optus-id6868.4lima.de/etc/designs/springd/clientlibs/page-bundle/content/optus/en/my-account-login/assets/fonts/lux-icons/6b6792eb1ab5c78cbd100f3e24acd22d.ttf
other warning URL: https://optus-id6868.4lima.de/
Message:
OTS parsing error: invalid sfntVersion: -272908531
other warning URL: https://optus-id6868.4lima.de/
Message:
Failed to decode downloaded font: https://optus-id6868.4lima.de/etc/designs/springd/clientlibs/page-bundle/content/optus/en/my-account-login/assets/fonts/lux-icons/6b6792eb1ab5c78cbd100f3e24acd22d.ttf
other warning URL: https://optus-id6868.4lima.de/
Message:
OTS parsing error: invalid sfntVersion: -272908531
javascript warning URL: https://optus-id6868.4lima.de/
Message:
The resource https://1.cdn.optusdigital.com/LUX2/assets/fonts/markpro-medium.woff was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript warning URL: https://optus-id6868.4lima.de/
Message:
The resource https://1.cdn.optusdigital.com/LUX2/assets/fonts/markpro.woff was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.