o2aktivierung.info Open in urlscan Pro
185.204.0.135 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://o2aktivierung.info/o2-online/o2
Effective URL:
https://o2aktivierung.info/online/o2/anmeldung/o2
Submission: On May 14 via manual (May 14th 2024, 4:42:46 am UTC) from DE — Scanned from DE

Summary HTTP 20 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 20 HTTP transactions. The main IP is 185.204.0.135, located in Moscow, Russian Federation and belongs to FIRSTBYTE-AS, GB. The main domain is o2aktivierung.info.
TLS certificate: Issued by R3 on May 9th 2024. Valid for: 3 months.

This is the only time o2aktivierung.info was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Telefonica (Telecommunication)

Domain & IP information

	IP Address	AS Autonomous System
14	185.204.0.135 185.204.0.135	204997 (FIRSTBYTE-AS) (FIRSTBYTE-AS)
1	2a02:ec80:300... 2a02:ec80:300:ed1a::2:b	14907 (WIKIMEDIA) (WIKIMEDIA)
20	3

14 185.204.0.135 (Moscow, Russian Federation)

ASN204997 (FIRSTBYTE-AS, GB)
PTR: vm2746192.firstbyte.club

o2aktivierung.info	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:ec80:300:ed1a::2:b (United States)

ASN14907 (WIKIMEDIA, US)

upload.wikimedia.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	o2aktivierung.info o2aktivierung.info	179 KB
1	wikimedia.org upload.wikimedia.org — Cisco Umbrella Rank: 3017	2 KB
0	google.de Failed www.google.de Failed
20	3

	Domain	Requested by
14	o2aktivierung.info	o2aktivierung.info
1	upload.wikimedia.org
0	www.google.de Failed	o2aktivierung.info
20	3

This site contains no links.

Subject Issuer	Validity	Valid
o2aktivierung.info R3	`2024-05-09` - `2024-08-07`	3 months	crt.sh
*.wikipedia.org DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-10-18` - `2024-10-16`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://o2aktivierung.info/online/o2/anmeldung/o2
Frame ID: 98226F3F14F9C4D1D4C2EFE26D5349D8
Requests: 20 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Login - O2

Page URL History Show full URLs

http://o2aktivierung.info/o2-online/o2 HTTP 307
https://o2aktivierung.info/o2-online/o2 Page URL
https://o2aktivierung.info/online/o2/anmeldung/o2 Page URL

Detected technologies

Adobe Experience Manager (CMS) Expand

Overall confidence: 100%
Detected patterns

<div class="[^"]*parbase

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Page Statistics

20
Requests

75 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

181 kB
Transfer

195 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://o2aktivierung.info/o2-online/o2 HTTP 307
https://o2aktivierung.info/o2-online/o2 Page URL
https://o2aktivierung.info/online/o2/anmeldung/o2 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://o2aktivierung.info/o2-online/o2 HTTP 307
https://o2aktivierung.info/o2-online/o2

Request Chain 1

https://o2aktivierung.info/favicon.ico HTTP 302
https://www.google.de/

Request Chain 2

https://o2aktivierung.info/online/o2/anmeldung/bower_components/jquery/dist/jquery.min.js HTTP 302
https://www.google.de/

Request Chain 3

https://o2aktivierung.info/online/o2/anmeldung/bower_components/ua-parser-js/dist/ua-parser.min.js HTTP 302
https://www.google.de/

Request Chain 4

https://o2aktivierung.info/online/o2/anmeldung/bower_components/font-awesome/css/font-awesome.min.css HTTP 302
https://www.google.de/

Request Chain 5

https://o2aktivierung.info/online/o2/anmeldung/bower_components/angular/angular.min.js HTTP 302
https://www.google.de/

20 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

o2 Show response
o2aktivierung.info/o2-online/
Redirect Chain

http://o2aktivierung.info/o2-online/o2
https://o2aktivierung.info/o2-online/o2

436 B
727 B

951ms
573ms

Document
text/html

185.204.0.135
FIRSTBYTE-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://o2aktivierung.info/o2-online/o2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.204.0.135 Moscow, Russian Federation, ASN204997 (FIRSTBYTE-AS, GB),
Reverse DNS: vm2746192.firstbyte.club
Software: Apache/2.4.18 (Ubuntu) /
Resource Hash: 9ad491ed3f3776d0d5e0f281c05bb42b052619af494522336240cefeb7e6c27e

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Cache-Control: no-store, no-cache, must-revalidate
Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 307
Content-Type: text/html; charset=UTF-8
Date: Tue, 14 May 2024 04:42:41 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive: timeout=5, max=100
Pragma: no-cache
Server: Apache/2.4.18 (Ubuntu)
Vary: Accept-Encoding

Redirect headers

Location: https://o2aktivierung.info/o2-online/o2
Non-Authoritative-Reason: HttpsUpgrades

GET

/
www.google.de/
Redirect Chain

https://o2aktivierung.info/favicon.ico
https://www.google.de/

0
0

GET
H/1.1 200
OK Primary Request o2 Show response
o2aktivierung.info/online/o2/anmeldung/ 15 KB
4 KB 1215ms
1214ms Document
text/html 185.204.0.135
FIRSTBYTE-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://o2aktivierung.info/online/o2/anmeldung/o2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.204.0.135 Moscow, Russian Federation, ASN204997 (FIRSTBYTE-AS, GB),
Reverse DNS: vm2746192.firstbyte.club
Software: Apache/2.4.18 (Ubuntu) /
Resource Hash: f7a971d3fdd72b72f0220051bcdc88d969b09c877b1ddb7a8e456aa4a8282ab6

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://o2aktivierung.info/o2-online/o2
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Cache-Control: no-store, no-cache, must-revalidate
Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 3789
Content-Type: text/html; charset=UTF-8
Date: Tue, 14 May 2024 04:42:43 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive: timeout=5, max=98
Pragma: no-cache
Server: Apache/2.4.18 (Ubuntu)
Vary: Accept-Encoding

GET

/
www.google.de/
Redirect Chain

https://o2aktivierung.info/online/o2/anmeldung/bower_components/jquery/dist/jquery.min.js
https://www.google.de/

0
0

GET

/
www.google.de/
Redirect Chain

https://o2aktivierung.info/online/o2/anmeldung/bower_components/ua-parser-js/dist/ua-parser.min.js
https://www.google.de/

0
0

GET

/
www.google.de/
Redirect Chain

https://o2aktivierung.info/online/o2/anmeldung/bower_components/font-awesome/css/font-awesome.min.css
https://www.google.de/

0
0

GET

/
www.google.de/
Redirect Chain

https://o2aktivierung.info/online/o2/anmeldung/bower_components/angular/angular.min.js
https://www.google.de/

0
0

GET
H/1.1 200
OK css.css
o2aktivierung.info/img/o2/login/form/ 624 B
666 B 732ms
625ms Stylesheet
text/css 185.204.0.135
FIRSTBYTE-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://o2aktivierung.info/img/o2/login/form/css.css
Requested by: Host: o2aktivierung.info
URL: https://o2aktivierung.info/online/o2/anmeldung/o2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.204.0.135 Moscow, Russian Federation, ASN204997 (FIRSTBYTE-AS, GB),
Reverse DNS: vm2746192.firstbyte.club
Software: Apache/2.4.18 (Ubuntu) /
Resource Hash: a2282c17fae39d990ffc9c7b707d6618efef6ac554b3e9611dadb841a4c16074

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://o2aktivierung.info/online/o2/anmeldung/o2
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 14 May 2024 04:42:44 GMT
Content-Encoding: gzip
Last-Modified: Mon, 23 Oct 2023 07:59:42 GMT
Server: Apache/2.4.18 (Ubuntu)
ETag: "270-6085d9ac75780-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 330

GET
H/1.1 200
OK index.css
o2aktivierung.info/img/o2/login/ 6 KB
2 KB 702ms
588ms Stylesheet
text/css 185.204.0.135
FIRSTBYTE-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://o2aktivierung.info/img/o2/login/index.css
Requested by: Host: o2aktivierung.info
URL: https://o2aktivierung.info/online/o2/anmeldung/o2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.204.0.135 Moscow, Russian Federation, ASN204997 (FIRSTBYTE-AS, GB),
Reverse DNS: vm2746192.firstbyte.club
Software: Apache/2.4.18 (Ubuntu) /
Resource Hash: cd1c70472d622c1f861b6542ea90d768686d27051f34dcc7ed4d90308b97f043

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://o2aktivierung.info/online/o2/anmeldung/o2
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 14 May 2024 04:42:44 GMT
Content-Encoding: gzip
Last-Modified: Wed, 08 Nov 2023 07:36:18 GMT
Server: Apache/2.4.18 (Ubuntu)
ETag: "16db-6099f248e0080-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 1393

GET
H/1.1 200
OK o2.png
o2aktivierung.info/img/o2/login/ 1 KB
1 KB 84ms
83ms Image
image/png 185.204.0.135
FIRSTBYTE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://o2aktivierung.info/img/o2/login/o2.png
Requested by: Host: o2aktivierung.info
URL: https://o2aktivierung.info/online/o2/anmeldung/o2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.204.0.135 Moscow, Russian Federation, ASN204997 (FIRSTBYTE-AS, GB),
Reverse DNS: vm2746192.firstbyte.club
Software: Apache/2.4.18 (Ubuntu) /
Resource Hash: de3174d5150bfdb08dcceeac6c100047cc44948ee209a8773be29b62230a974d

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://o2aktivierung.info/online/o2/anmeldung/o2
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 14 May 2024 04:42:44 GMT
Last-Modified: Tue, 07 Nov 2023 08:44:12 GMT
Server: Apache/2.4.18 (Ubuntu)
ETag: "434-6098bf98aef00"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=95
Content-Length: 1076

GET
H/1.1 200
OK ios.png
o2aktivierung.info/img/o2/login/ 3 KB
3 KB 84ms
84ms Image
image/png 185.204.0.135
FIRSTBYTE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://o2aktivierung.info/img/o2/login/ios.png
Requested by: Host: o2aktivierung.info
URL: https://o2aktivierung.info/online/o2/anmeldung/o2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.204.0.135 Moscow, Russian Federation, ASN204997 (FIRSTBYTE-AS, GB),
Reverse DNS: vm2746192.firstbyte.club
Software: Apache/2.4.18 (Ubuntu) /
Resource Hash: 553477374932c4e37d9baef1b311a260d7ad76d43d0f100a2f9ec4a57b40823e

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://o2aktivierung.info/online/o2/anmeldung/o2
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 14 May 2024 04:42:44 GMT
Last-Modified: Tue, 07 Nov 2023 08:48:28 GMT
Server: Apache/2.4.18 (Ubuntu)
ETag: "aea-6098c08cd2f00"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=94
Content-Length: 2794

GET
H/1.1 200
OK android.png
o2aktivierung.info/img/o2/login/ 3 KB
3 KB 561ms
561ms Image
image/png 185.204.0.135
FIRSTBYTE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://o2aktivierung.info/img/o2/login/android.png
Requested by: Host: o2aktivierung.info
URL: https://o2aktivierung.info/online/o2/anmeldung/o2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.204.0.135 Moscow, Russian Federation, ASN204997 (FIRSTBYTE-AS, GB),
Reverse DNS: vm2746192.firstbyte.club
Software: Apache/2.4.18 (Ubuntu) /
Resource Hash: 442ee5939c0b03561c121d19ab5d61c189b0928666feb26857325c4f711e63eb

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://o2aktivierung.info/online/o2/anmeldung/o2
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 14 May 2024 04:42:44 GMT
Last-Modified: Tue, 07 Nov 2023 08:48:46 GMT
Server: Apache/2.4.18 (Ubuntu)
ETag: "cde-6098c09dfd780"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 3294

GET
H/1.1 200
OK tele.webp
o2aktivierung.info/img/o2/login/ 2 KB
2 KB 86ms
86ms Image
image/webp 185.204.0.135
FIRSTBYTE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://o2aktivierung.info/img/o2/login/tele.webp
Requested by: Host: o2aktivierung.info
URL: https://o2aktivierung.info/online/o2/anmeldung/o2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.204.0.135 Moscow, Russian Federation, ASN204997 (FIRSTBYTE-AS, GB),
Reverse DNS: vm2746192.firstbyte.club
Software: Apache/2.4.18 (Ubuntu) /
Resource Hash: 3b05156b6514710918393522e4560613fe9d1162bb6082f65ffe9d74f74ee744

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://o2aktivierung.info/online/o2/anmeldung/o2
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 14 May 2024 04:42:44 GMT
Last-Modified: Tue, 07 Nov 2023 09:03:36 GMT
Server: Apache/2.4.18 (Ubuntu)
ETag: "6d8-6098c3eec2a00"
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=93
Content-Length: 1752

GET
H/1.1 200
OK tdg
o2aktivierung.info/img/o2/login/ 45 B
302 B 97ms
97ms Image
image/gif 185.204.0.135
FIRSTBYTE-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://o2aktivierung.info/img/o2/login/tdg
Requested by: Host: o2aktivierung.info
URL: https://o2aktivierung.info/online/o2/anmeldung/o2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.204.0.135 Moscow, Russian Federation, ASN204997 (FIRSTBYTE-AS, GB),
Reverse DNS: vm2746192.firstbyte.club
Software: Apache/2.4.18 (Ubuntu) /
Resource Hash: 62cfb054088e29a0e576b434030c236c6101af0599e6f55cfe89b35a6186fba4

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://o2aktivierung.info/online/o2/anmeldung/o2
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 14 May 2024 04:42:44 GMT
Last-Modified: Thu, 06 Jul 2023 19:11:04 GMT
Server: Apache/2.4.18 (Ubuntu)
ETag: "2d-5ffd647120200"
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=92
Content-Length: 45

GET
H/1.1 200
OK login.js Show response
o2aktivierung.info/js/hello/ 3 KB
1 KB 84ms
84ms Script
application/javascript 185.204.0.135
FIRSTBYTE-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://o2aktivierung.info/js/hello/login.js
Requested by: Host: o2aktivierung.info
URL: https://o2aktivierung.info/online/o2/anmeldung/o2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.204.0.135 Moscow, Russian Federation, ASN204997 (FIRSTBYTE-AS, GB),
Reverse DNS: vm2746192.firstbyte.club
Software: Apache/2.4.18 (Ubuntu) /
Resource Hash: 1d659c91bc277236c8b0d40d91046b7c0550e16074dd8deb81c8863e2af4a069

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://o2aktivierung.info/online/o2/anmeldung/o2
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 14 May 2024 04:42:44 GMT
Content-Encoding: gzip
Last-Modified: Thu, 21 Mar 2024 16:04:54 GMT
Server: Apache/2.4.18 (Ubuntu)
ETag: "bce-6142dde2f7580-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=91
Content-Length: 734

GET
H/1.1 200
OK css.css
o2aktivierung.info/img/o2/login/form/ 624 B
0 0ms
0ms Stylesheet
text/css 185.204.0.135
FIRSTBYTE-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://o2aktivierung.info/img/o2/login/form/css.css
Requested by: Host: o2aktivierung.info
URL: https://o2aktivierung.info/online/o2/anmeldung/o2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.204.0.135 Moscow, Russian Federation, ASN204997 (FIRSTBYTE-AS, GB),
Reverse DNS: vm2746192.firstbyte.club
Software: Apache/2.4.18 (Ubuntu) /
Resource Hash: a2282c17fae39d990ffc9c7b707d6618efef6ac554b3e9611dadb841a4c16074

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://o2aktivierung.info/online/o2/anmeldung/o2
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 14 May 2024 04:42:44 GMT
Content-Encoding: gzip
Last-Modified: Mon, 23 Oct 2023 07:59:42 GMT
Server: Apache/2.4.18 (Ubuntu)
ETag: "270-6085d9ac75780-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Accept-Ranges: bytes
Content-Length: 330

GET
H/1.1 200
OK OnAir-Bold.8cbe59f9.woff2
o2aktivierung.info/img/o2/login/ 47 KB
47 KB 140ms
139ms Font
application/octet-stream 185.204.0.135
FIRSTBYTE-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://o2aktivierung.info/img/o2/login/OnAir-Bold.8cbe59f9.woff2
Requested by: Host: o2aktivierung.info
URL: https://o2aktivierung.info/img/o2/login/index.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.204.0.135 Moscow, Russian Federation, ASN204997 (FIRSTBYTE-AS, GB),
Reverse DNS: vm2746192.firstbyte.club
Software: Apache/2.4.18 (Ubuntu) /
Resource Hash: c284299aeec8595fd3a10dcd2c27022edfda37c815571843a90c45cad18ace95

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://o2aktivierung.info/img/o2/login/index.css
Origin: https://o2aktivierung.info
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 14 May 2024 04:42:45 GMT
Last-Modified: Tue, 07 Nov 2023 08:00:06 GMT
Server: Apache/2.4.18 (Ubuntu)
ETag: "ba3c-6098b5bd42d80"
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 47676

GET
H/1.1 200
OK OnAir-Light.e3b307c6.woff2
o2aktivierung.info/img/o2/login/ 46 KB
46 KB 130ms
130ms Font
application/octet-stream 185.204.0.135
FIRSTBYTE-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://o2aktivierung.info/img/o2/login/OnAir-Light.e3b307c6.woff2
Requested by: Host: o2aktivierung.info
URL: https://o2aktivierung.info/img/o2/login/index.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.204.0.135 Moscow, Russian Federation, ASN204997 (FIRSTBYTE-AS, GB),
Reverse DNS: vm2746192.firstbyte.club
Software: Apache/2.4.18 (Ubuntu) /
Resource Hash: 4347e083fcc7406a94363480146e1cf9c2f88198921ef74fed3eddf6d969725b

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://o2aktivierung.info/img/o2/login/index.css
Origin: https://o2aktivierung.info
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 14 May 2024 04:42:45 GMT
Last-Modified: Tue, 07 Nov 2023 08:00:24 GMT
Server: Apache/2.4.18 (Ubuntu)
ETag: "b758-6098b5ce6d600"
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 46936

GET
H/1.1 200
OK o2icons.woff2
o2aktivierung.info/img/o2/login/ 67 KB
68 KB 125ms
125ms Font
application/octet-stream 185.204.0.135
FIRSTBYTE-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://o2aktivierung.info/img/o2/login/o2icons.woff2
Requested by: Host: o2aktivierung.info
URL: https://o2aktivierung.info/img/o2/login/index.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.204.0.135 Moscow, Russian Federation, ASN204997 (FIRSTBYTE-AS, GB),
Reverse DNS: vm2746192.firstbyte.club
Software: Apache/2.4.18 (Ubuntu) /
Resource Hash: 9514be1de81594cc232402c83c6f2a73276ae8c3a6224a7ac8a3561c5ed9f7c6

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://o2aktivierung.info/img/o2/login/index.css
Origin: https://o2aktivierung.info
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 14 May 2024 04:42:45 GMT
Last-Modified: Tue, 07 Nov 2023 08:03:30 GMT
Server: Apache/2.4.18 (Ubuntu)
ETag: "10dbc-6098b67fcf880"
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 69052

GET
H2 200 O2.svg
upload.wikimedia.org/wikipedia/commons/6/60/ 1 KB
2 KB 101ms
25ms Other
image/svg+xml 2a02:ec80:300:ed1a::2:b
WIKIMEDIA

General

Check archive.org

Show headers Download Go to

Full URL

https://upload.wikimedia.org/wikipedia/commons/6/60/O2.svg

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:ec80:300:ed1a::2:b , United States, ASN14907 (WIKIMEDIA, US),

Reverse DNS

Software

ATS/9.1.4 /

Resource Hash

a3533b93334aa06c7dc8658b8d2d7680c1c2f0d2d22ab9b8444122f6f193d509

Security Headers

Name	Value
Strict-Transport-Security	max-age=106384710; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://o2aktivierung.info/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 13 May 2024 08:08:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=106384710; includeSubDomains; preload
nel: { "report_to": "wm_nel", "max_age": 604800, "failure_fraction": 0.05, "success_fraction": 0.0}
age: 74081
x-cache-status: hit-front
x-cache: cp3079 hit, cp3079 hit/34
server-timing: cache;desc="hit-front", host;desc="cp3079"
content-length: 772
x-client-ip: 2001:1b60:1010:3:1012:3417:4537:ed74
x-object-meta-sha1base36: fautlw0q6hqmkjp6o3251nn012tv69z
last-modified: Fri, 01 Jul 2022 11:16:43 GMT
server: ATS/9.1.4
etag: W/20b38eb45ea0845ab8f739ee74d746f7
vary: Accept-Encoding
report-to: { "group": "wm_nel", "max_age": 604800, "endpoints": [{ "url": "https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error&schema_uri=/w3c/reportingapi/network_error/1.0.0" }] }
content-type: image/svg+xml
access-control-allow-origin: *
access-control-expose-headers: Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache
accept-ranges: bytes
timing-allow-origin: *

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.google.de
URL: https://www.google.de/

Domain: www.google.de
URL: https://www.google.de/

Domain: www.google.de
URL: https://www.google.de/

Domain: www.google.de
URL: https://www.google.de/

Domain: www.google.de
URL: https://www.google.de/

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Telefonica (Telecommunication)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| savepage_ShadowLoader

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			o2aktivierung.info/	1969-12-31 23:59:59	Name: PHPSESSID Value: ndpuk42qckui6lit57ejje3pv5

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://o2aktivierung.info/online/o2/anmeldung/o2 Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

o2aktivierung.info
upload.wikimedia.org
www.google.de
www.google.de
185.204.0.135
2a02:ec80:300:ed1a::2:b
1d659c91bc277236c8b0d40d91046b7c0550e16074dd8deb81c8863e2af4a069
3b05156b6514710918393522e4560613fe9d1162bb6082f65ffe9d74f74ee744
4347e083fcc7406a94363480146e1cf9c2f88198921ef74fed3eddf6d969725b
442ee5939c0b03561c121d19ab5d61c189b0928666feb26857325c4f711e63eb
553477374932c4e37d9baef1b311a260d7ad76d43d0f100a2f9ec4a57b40823e
62cfb054088e29a0e576b434030c236c6101af0599e6f55cfe89b35a6186fba4
9514be1de81594cc232402c83c6f2a73276ae8c3a6224a7ac8a3561c5ed9f7c6
9ad491ed3f3776d0d5e0f281c05bb42b052619af494522336240cefeb7e6c27e
a2282c17fae39d990ffc9c7b707d6618efef6ac554b3e9611dadb841a4c16074
a3533b93334aa06c7dc8658b8d2d7680c1c2f0d2d22ab9b8444122f6f193d509
c284299aeec8595fd3a10dcd2c27022edfda37c815571843a90c45cad18ace95
cd1c70472d622c1f861b6542ea90d768686d27051f34dcc7ed4d90308b97f043
de3174d5150bfdb08dcceeac6c100047cc44948ee209a8773be29b62230a974d
f7a971d3fdd72b72f0220051bcdc88d969b09c877b1ddb7a8e456aa4a8282ab6

o2aktivierung.info Open in urlscan Pro 185.204.0.135 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

20 Requests

75 %HTTPS

50 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

181 kBTransfer

195 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

20 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

o2aktivierung.info Open in urlscan Pro
185.204.0.135 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

20
Requests

75 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

181 kB
Transfer

195 kB
Size

1
Cookies

20 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!