www.vodi.me Open in urlscan Pro
2606:4700:30::6818:757b Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.vodi.me/content/gmx/gmx.php
Submission: On December 14 via api (December 14th 2019, 7:44:29 pm UTC) from GB

Summary HTTP 20 Redirects Links 7 Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 3 domains to perform 20 HTTP transactions. The main IP is 2606:4700:30::6818:757b, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is www.vodi.me.
TLS certificate: Issued by COMODO ECC Domain Validation Secure S... on November 30th 2019. Valid for: 6 months.

This is the only time www.vodi.me was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: GMX (Online)

Domain & IP information

	IP Address	AS Autonomous System
9	2606:4700:30:... 2606:4700:30::6818:757b	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	2606:4700::68... 2606:4700::6811:4004	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
9	23.210.249.45 23.210.249.45	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
1 2	82.165.229.54 82.165.229.54	8560 (ONEANDONE...) (ONEANDONE-AS Brauerstrasse 48)
20	4

9 2606:4700:30::6818:757b (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

www.vodi.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:4004 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

ajax.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 23.210.249.45 (Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a23-210-249-45.deploy.static.akamaitechnologies.com

img.ui-portal.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 82.165.229.54 (Germany) 1 redirects

ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE)
PTR: wa.ui-portal.de

wa.ui-portal.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	ui-portal.de 1 redirects img.ui-portal.de wa.ui-portal.de	57 KB
9	vodi.me www.vodi.me	80 KB
1	cloudflare.com ajax.cloudflare.com	4 KB
20	3

	Domain	Requested by
9	img.ui-portal.de	www.vodi.me
9	www.vodi.me	www.vodi.me ajax.cloudflare.com
2	wa.ui-portal.de	1 redirects
1	ajax.cloudflare.com	www.vodi.me
20	4

This site contains links to these domains. Also see Links.

Domain
www.gmx.net
interception1.gmx.net
hilfe.gmx.net
newsroom.gmx.net
agb-server.gmx.net

Subject Issuer	Validity	Valid
sni138558.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-11-30` - `2020-06-07`	6 months	crt.sh
ssl412106.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-12-05` - `2020-06-12`	6 months	crt.sh
img.ui-portal.de GeoTrust RSA CA 2018	`2019-08-06` - `2020-11-04`	a year	crt.sh
*.ui-portal.de GeoTrust RSA CA 2018	`2018-07-06` - `2020-07-05`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://www.vodi.me/content/gmx/gmx.php
Frame ID: F9DCD4DF1F1D5483EA0DCA2358CE8C8F
Requests: 20 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^\/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

20
Requests

100 %
HTTPS

50 %
IPv6

3
Domains

4
Subdomains

4
IPs

3
Countries

140 kB
Transfer

364 kB
Size

0
Cookies

7 Outgoing links

These are links going to different origins than the main page.

URL: https://www.gmx.net/
Title: GMX Mein Account

Search URL Search Domain Scan URL

URL: https://interception1.gmx.net/logininterceptionfrontend/?0&interceptiontype=VerifyLogin&service=freemail&successURL=https%3A%2F%2Fnavigator.gmx.net%2Flogin&statistics=xRbXFc8VKmF6s%2Frp6a5qP4z%2FNdyBHKIvfVNtKKZ%2FMIzZ6sV0I7t11UL6HiAYcLrIM%2FUa97LhhoApcfeuwhgCrf8OzhYyHaHNFxpFfXyh%2FgNOFasefWiag2osdLwsoaQUjFgl5KRWNZQn%2FJ%2BVf5Yq1vzDMmvcNacavpkSKc0VdsoMzKeZnxxL%2Fl2FTNDJCnPcIHjxpzAgCgOro1V2sZbBxg%3D%3D&username=ipeter%40gmx.ch&requestSecurityToken=a74443d0-2b89-4431-9ec7-335d9cbeed76
Title: Anderes Wort anzeigen

Search URL Search Domain Scan URL

URL: https://hilfe.gmx.net/
Title: Service

Search URL Search Domain Scan URL

URL: https://newsroom.gmx.net/
Title: Über GMX

Search URL Search Domain Scan URL

URL: https://www.gmx.net/impressum/
Title: Impressum

Search URL Search Domain Scan URL

URL: https://agb-server.gmx.net/gmxagb-de
Title: AGB

Search URL Search Domain Scan URL

URL: https://agb-server.gmx.net/datenschutz
Title: Datenschutz

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 18

https://wa.ui-portal.de/gmx/gmx/s?name=undefined&country=undefined&hid=%20&ts=1576352653006&viewres=1600x1200&viewport_w=1600&viewport_h=1200&title=GMX%20Mein%20Account&pageurl=https%3A//www.vodi.me/content/gmx/gmx.php&referrer= HTTP 302
https://wa.ui-portal.de/gmx/gmx/s?_wa=228f333afc8cc9c61fc77ed81b2c87f1&name=undefined&country=undefined&hid=%20&ts=1576352653006&viewres=1600x1200&viewport_w=1600&viewport_h=1200&title=GMX%20Mein%20Account&pageurl=https%3A//www.vodi.me/content/gmx/gmx.php&referrer=

20 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request gmx.php Show response
www.vodi.me/content/gmx/ 10 KB
3 KB 812ms
747ms Document
text/html 2606:4700:30::6818:757b
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.vodi.me/content/gmx/gmx.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::6818:757b , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3218b60cbefe402ec7093fcc0aa27805de140619e8dff4a4af4e14e023bd6323

Request headers

:method: GET
:authority: www.vodi.me
:scheme: https
:path: /content/gmx/gmx.php
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-user: ?1
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: none
sec-fetch-mode: navigate
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-User: ?1

Response headers

status: 200
date: Sat, 14 Dec 2019 19:44:07 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=d6bd20a916b24210a2e356de47ca3e8641576352646; expires=Mon, 13-Jan-20 19:44:06 GMT; path=/; domain=.vodi.me; HttpOnly
vary: Accept-Encoding
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5452aba8af445a0c-VIE
content-encoding: br

GET
H2 200 interception-ver-20954B03804E1BE9F69C743EFC55F129.css
www.vodi.me/content/gmx/gmx_files/ 68 KB
10 KB 731ms
730ms Stylesheet
text/css 2606:4700:30::6818:757b
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.vodi.me/content/gmx/gmx_files/interception-ver-20954B03804E1BE9F69C743EFC55F129.css
Requested by: Host: www.vodi.me
URL: https://www.vodi.me/content/gmx/gmx.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::6818:757b , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 63c19d4f65c6db137ebad0a97daf4b31b94900692e69e8a840555204aec4b602

Request headers

Referer: https://www.vodi.me/content/gmx/gmx.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 14 Dec 2019 19:44:07 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Sun, 08 Sep 2019 13:17:48 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=14400
cf-ray: 5452abad69f35a0c-VIE

GET
H2 200 traffic_light_global-ver-F8B380184E15E337A3D3C4A4451492EE.css
www.vodi.me/content/gmx/gmx_files/ 1020 B
375 B 585ms
584ms Stylesheet
text/css 2606:4700:30::6818:757b
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.vodi.me/content/gmx/gmx_files/traffic_light_global-ver-F8B380184E15E337A3D3C4A4451492EE.css
Requested by: Host: www.vodi.me
URL: https://www.vodi.me/content/gmx/gmx.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::6818:757b , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0577a50940bd30b753e372af56e01a10f612b46844743f0f40115ba9d367c492

Request headers

Referer: https://www.vodi.me/content/gmx/gmx.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 14 Dec 2019 19:44:07 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Sun, 08 Sep 2019 13:17:48 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=14400
cf-ray: 5452abad69f45a0c-VIE

GET
H2 200 saved_resource
www.vodi.me/content/gmx/gmx_files/ 4 KB
4 KB 5731ms
5730ms Image
image/jpeg 2606:4700:30::6818:757b
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.vodi.me/content/gmx/gmx_files/saved_resource
Requested by: Host: www.vodi.me
URL: https://www.vodi.me/content/gmx/gmx.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::6818:757b , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 21408131188b509cc83d535d9d205058a7f6d4f333aba939d60750015e9d06ef

Request headers

Referer: https://www.vodi.me/content/gmx/gmx.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 14 Dec 2019 19:44:10 GMT
cf-cache-status: DYNAMIC
last-modified: Sun, 08 Sep 2019 13:17:50 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status: 200
accept-ranges: bytes
cf-ray: 5452abad69f55a0c-VIE
content-length: 3990

GET
H2 200 rocket-loader.min.js Show response
ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/ 12 KB
4 KB 17ms
15ms Script
application/javascript 2606:4700::6811:4004
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js

Requested by

Host: www.vodi.me
URL: https://www.vodi.me/content/gmx/gmx.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:4004 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

b08cdbc2d30e656a86b20f8342428d5863f70f4b30135b4f4061f754ce932f5e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.vodi.me/content/gmx/gmx.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 14 Dec 2019 19:44:07 GMT
content-encoding: gzip
last-modified: Tue, 10 Dec 2019 17:32:17 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"5defd6a1-3016"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=172800, public
strict-transport-security: max-age=15780000; includeSubDomains
cf-ray: 5452abad6caf8c7a-VIE
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
expires: Mon, 16 Dec 2019 19:44:07 GMT

GET
H2 200 traffic_light-ver-6123F10E3FA50D8228A57963D71E6B86.js.download Show response
www.vodi.me/content/gmx/gmx_files/ 3 KB
1 KB 577ms
577ms Script
application/javascript 2606:4700:30::6818:757b
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.vodi.me/content/gmx/gmx_files/traffic_light-ver-6123F10E3FA50D8228A57963D71E6B86.js.download
Requested by: Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::6818:757b , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4df2c2441a949ed7ff7426c12c488c0f5506afbb6acad07e81a03a826c120ff5

Request headers

Referer: https://www.vodi.me/content/gmx/gmx.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 14 Dec 2019 19:44:07 GMT
content-encoding: br
cf-cache-status: DYNAMIC
last-modified: Sun, 08 Sep 2019 13:17:50 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cf-ray: 5452abadaa1f5a0c-VIE

GET
H2 200 4006.js.download Show response
www.vodi.me/content/gmx/gmx_files/ 19 KB
7 KB 576ms
575ms Script
application/javascript 2606:4700:30::6818:757b
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.vodi.me/content/gmx/gmx_files/4006.js.download
Requested by: Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::6818:757b , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 337b1cd522aac5c61604e40402c0dcc3053de9387d0c2be9c0c27c8503ec4e7d

Request headers

Referer: https://www.vodi.me/content/gmx/gmx.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 14 Dec 2019 19:44:07 GMT
content-encoding: br
cf-cache-status: DYNAMIC
last-modified: Sun, 08 Sep 2019 13:17:48 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cf-ray: 5452abadaa205a0c-VIE

GET
H2 200 interception.js.download Show response
www.vodi.me/content/gmx/gmx_files/ 64 KB
13 KB 599ms
599ms Script
application/javascript 2606:4700:30::6818:757b
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.vodi.me/content/gmx/gmx_files/interception.js.download
Requested by: Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::6818:757b , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: da5f4b5c081876a3c784d966637d71662bb8a9b5b8a0f742bdc3526c31a7434b

Request headers

Referer: https://www.vodi.me/content/gmx/gmx.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 14 Dec 2019 19:44:07 GMT
content-encoding: br
cf-cache-status: DYNAMIC
last-modified: Sun, 08 Sep 2019 13:17:48 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cf-ray: 5452abadaa215a0c-VIE

GET
H2 200 wicket-ajax-jquery-ver-3A8C326A8436172FC95523D517EBC88B.js.download Show response
www.vodi.me/content/gmx/gmx_files/ 43 KB
11 KB 653ms
653ms Script
application/javascript 2606:4700:30::6818:757b
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.vodi.me/content/gmx/gmx_files/wicket-ajax-jquery-ver-3A8C326A8436172FC95523D517EBC88B.js.download
Requested by: Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::6818:757b , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 814d708ae7117c643892517043641d0802ae58402b8eacab4b52084321fc9ec4

Request headers

Referer: https://www.vodi.me/content/gmx/gmx.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 14 Dec 2019 19:44:07 GMT
content-encoding: br
cf-cache-status: DYNAMIC
last-modified: Sun, 08 Sep 2019 13:17:48 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cf-ray: 5452abadaa225a0c-VIE

GET
H2 200 jquery-3.4.1-ver-D19AFC7779BBA20E96683BE58B330F62.js.download Show response
www.vodi.me/content/gmx/gmx_files/ 86 KB
30 KB 168ms
168ms Script
application/javascript 2606:4700:30::6818:757b
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.vodi.me/content/gmx/gmx_files/jquery-3.4.1-ver-D19AFC7779BBA20E96683BE58B330F62.js.download
Requested by: Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::6818:757b , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: c3236f2795c78a26b795a60a972ada5a30cf25eea2c17b56817ed66562084bef

Request headers

Referer: https://www.vodi.me/content/gmx/gmx.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 14 Dec 2019 19:44:07 GMT
content-encoding: br
cf-cache-status: DYNAMIC
last-modified: Sun, 08 Sep 2019 13:17:48 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cf-ray: 5452abadaa255a0c-VIE

GET
H2 200 page_header_2.png
img.ui-portal.de/interception/kontaktadresse/gmx/bg/ 981 B
1 KB 76ms
23ms Image
image/png 23.210.249.45
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.ui-portal.de/interception/kontaktadresse/gmx/bg/page_header_2.png
Requested by: Host: www.vodi.me
URL: https://www.vodi.me/content/gmx/gmx.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.45 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-210-249-45.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: f2be4d8456cd0f00e629994338ba6e72068ba5630a0e22cadc8a903d63ad83ed

Request headers

Referer: https://www.vodi.me/content/gmx/gmx_files/interception-ver-20954B03804E1BE9F69C743EFC55F129.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 14 Dec 2019 19:44:08 GMT
last-modified: Thu, 28 Apr 2016 08:33:18 GMT
server: Apache
etag: "3d5-5318760cdcf80"
content-type: image/png
status: 200
cache-control: public, max-age=1169
accept-ranges: bytes
x-robots-tag: noindex
content-length: 981

GET
H2 200 logoCI2018_navigator.png
img.ui-portal.de/ci/gmx/global/ 2 KB
2 KB 80ms
28ms Image
image/png 23.210.249.45
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.ui-portal.de/ci/gmx/global/logoCI2018_navigator.png
Requested by: Host: www.vodi.me
URL: https://www.vodi.me/content/gmx/gmx.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.45 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-210-249-45.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 4cb170c47988f5ecd65f2243af51805b0507bb6ca6424da52b8d26475d0f8e16

Request headers

Referer: https://www.vodi.me/content/gmx/gmx_files/interception-ver-20954B03804E1BE9F69C743EFC55F129.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 14 Dec 2019 19:44:08 GMT
last-modified: Mon, 19 Feb 2018 13:59:12 GMT
server: Apache
etag: "7a5-565911945fc02"
content-type: image/png
status: 200
cache-control: public, max-age=226
accept-ranges: bytes
x-robots-tag: noindex
content-length: 1957

GET
H2 200 content.png
img.ui-portal.de/interception/kontaktadresse/gmx/bg/ 6 KB
7 KB 78ms
27ms Image
image/png 23.210.249.45
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.ui-portal.de/interception/kontaktadresse/gmx/bg/content.png
Requested by: Host: www.vodi.me
URL: https://www.vodi.me/content/gmx/gmx.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.45 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-210-249-45.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: f9063c8b0b831e649b6260a0a51a71c1a862911360f11f3ba43414bfc5b06c71

Request headers

Referer: https://www.vodi.me/content/gmx/gmx_files/interception-ver-20954B03804E1BE9F69C743EFC55F129.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 14 Dec 2019 19:44:08 GMT
last-modified: Mon, 18 Aug 2014 09:33:05 GMT
server: Apache
etag: "19f4-500e40ed5f640"
content-type: image/png
status: 200
cache-control: public, max-age=871
accept-ranges: bytes
x-robots-tag: noindex
content-length: 6644

GET
H2 200 hint_extraWide.png
img.ui-portal.de/interception/gmx/icon/ 1 KB
2 KB 76ms
25ms Image
image/png 23.210.249.45
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.ui-portal.de/interception/gmx/icon/hint_extraWide.png
Requested by: Host: www.vodi.me
URL: https://www.vodi.me/content/gmx/gmx.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.45 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-210-249-45.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 7a16dae2ca8b712d3c3f85e2ce7e95b9decc1defa377c03a14f872aea91c8a2f

Request headers

Referer: https://www.vodi.me/content/gmx/gmx_files/interception-ver-20954B03804E1BE9F69C743EFC55F129.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 14 Dec 2019 19:44:08 GMT
last-modified: Wed, 29 Jun 2016 08:49:20 GMT
server: Apache
etag: "561-53666d44e0400"
content-type: image/png
status: 200
cache-control: public, max-age=818
accept-ranges: bytes
x-robots-tag: noindex
content-length: 1377

GET
H2 200 hint_16x16.png
img.ui-portal.de/interception/gmx/icon/ 974 B
1 KB 81ms
30ms Image
image/png 23.210.249.45
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.ui-portal.de/interception/gmx/icon/hint_16x16.png
Requested by: Host: www.vodi.me
URL: https://www.vodi.me/content/gmx/gmx.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.45 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-210-249-45.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: d5eb5d3724dc0762e05678e16c2a1c893e8f1cee6076ca191914573be5ac3695

Request headers

Referer: https://www.vodi.me/content/gmx/gmx_files/interception-ver-20954B03804E1BE9F69C743EFC55F129.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 14 Dec 2019 19:44:08 GMT
last-modified: Thu, 23 May 2013 13:29:45 GMT
server: Apache
etag: "3ce-4dd62acf34440"
content-type: image/png
status: 200
cache-control: public, max-age=680
accept-ranges: bytes
x-robots-tag: noindex
content-length: 974

GET
H2 404 password-show-inactive-normal.png
img.ui-portal.de/interception/kontaktadresse/gmx/icon/ 0
0 97ms
46ms Image
text/html 23.210.249.45
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.ui-portal.de/interception/kontaktadresse/gmx/icon/password-show-inactive-normal.png
Requested by: Host: www.vodi.me
URL: https://www.vodi.me/content/gmx/gmx.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.45 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-210-249-45.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.vodi.me/content/gmx/gmx_files/interception-ver-20954B03804E1BE9F69C743EFC55F129.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

GET
H2 200 p.gif
img.ui-portal.de/ 42 B
205 B 26ms
25ms Image
image/gif 23.210.249.45
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.ui-portal.de/p.gif
Requested by: Host: www.vodi.me
URL: https://www.vodi.me/content/gmx/gmx.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.45 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-210-249-45.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://www.vodi.me/content/gmx/gmx_files/interception-ver-20954B03804E1BE9F69C743EFC55F129.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 14 Dec 2019 19:44:08 GMT
last-modified: Thu, 08 Aug 2002 13:23:51 GMT
server: Apache
etag: "2a-3a7b33340c7c0"
content-type: image/gif
status: 200
cache-control: public, max-age=1234
accept-ranges: bytes
x-robots-tag: noindex
content-length: 42

GET
H2 200 RobotoCondensed-Regular-webfont.woff
img.ui-portal.de/ci/gmx/global/fonts/roboto/ 25 KB
25 KB 76ms
26ms Font
application/font-woff 23.210.249.45
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://img.ui-portal.de/ci/gmx/global/fonts/roboto/RobotoCondensed-Regular-webfont.woff
Requested by: Host: www.vodi.me
URL: https://www.vodi.me/content/gmx/gmx.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.45 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-210-249-45.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 7ec51beb961db2999fe41a96a3212edc51d9aeeec5c9d374e39c7313d183d8a6

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.vodi.me/content/gmx/gmx_files/interception-ver-20954B03804E1BE9F69C743EFC55F129.css
Origin: https://www.vodi.me

Response headers

date: Sat, 14 Dec 2019 19:44:08 GMT
last-modified: Thu, 27 Feb 2014 04:45:48 GMT
server: Apache
access-control-allow-origin: *
etag: "62b4-4f35bfeb9b700"
content-type: application/font-woff
status: 200
cache-control: public, max-age=922864
accept-ranges: bytes
x-robots-tag: noindex
content-length: 25268

GET
H2 200 RobotoCondensed-Light-webfont.woff
img.ui-portal.de/ci/gmx/global/fonts/roboto/ 18 KB
19 KB 92ms
42ms Font
application/font-woff 23.210.249.45
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://img.ui-portal.de/ci/gmx/global/fonts/roboto/RobotoCondensed-Light-webfont.woff
Requested by: Host: www.vodi.me
URL: https://www.vodi.me/content/gmx/gmx.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.45 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-210-249-45.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 4cde34c1e366e3d7625d453914da07e72c137c195ec9191db06f41775e65a01b

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.vodi.me/content/gmx/gmx_files/interception-ver-20954B03804E1BE9F69C743EFC55F129.css
Origin: https://www.vodi.me

Response headers

date: Sat, 14 Dec 2019 19:44:08 GMT
last-modified: Tue, 18 Jul 2017 09:59:36 GMT
server: Apache
access-control-allow-origin: *
etag: "49c0-5549492a91200"
content-type: application/font-woff
status: 200
cache-control: public, max-age=923386
accept-ranges: bytes
x-robots-tag: noindex
content-length: 18880

GET
H/1.1

200
OK

s
wa.ui-portal.de/gmx/gmx/
Redirect Chain

https://wa.ui-portal.de/gmx/gmx/s?name=undefined&country=undefined&hid=%20&ts=1576352653006&viewres=1600x1200&viewport_w=1600&viewport_h=1200&title=GMX%20Mein%20Account&pageurl=https%3A//www.vodi.m...
https://wa.ui-portal.de/gmx/gmx/s?_wa=228f333afc8cc9c61fc77ed81b2c87f1&name=undefined&country=undefined&hid=%20&ts=1576352653006&viewres=1600x1200&viewport_w=1600&viewport_h=1200&title=GMX%20Mein%2...

43 B
383 B

32ms
32ms

Image
image/gif

82.165.229.54
ONEANDONE-AS Brau...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://wa.ui-portal.de/gmx/gmx/s?_wa=228f333afc8cc9c61fc77ed81b2c87f1&name=undefined&country=undefined&hid=%20&ts=1576352653006&viewres=1600x1200&viewport_w=1600&viewport_h=1200&title=GMX%20Mein%20Account&pageurl=https%3A//www.vodi.me/content/gmx/gmx.php&referrer=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 82.165.229.54 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS: wa.ui-portal.de
Software: Apache /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

Referer: https://www.vodi.me/content/gmx/gmx.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 14 Dec 2019 19:44:13 GMT
Server: Apache
P3P: CP="this is not a p3p policy"
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Type: image/gif
Keep-Alive: timeout=3, max=99
Content-Length: 43
Expires: Wed, 11 Jan 1984 05:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 14 Dec 2019 19:44:13 GMT
Server: Apache
P3P: CP="this is not a p3p policy"
Location: https://wa.ui-portal.de/gmx/gmx/s?_wa=228f333afc8cc9c61fc77ed81b2c87f1&name=undefined&country=undefined&hid=%20&ts=1576352653006&viewres=1600x1200&viewport_w=1600&viewport_h=1200&title=GMX%20Mein%20Account&pageurl=https%3A//www.vodi.me/content/gmx/gmx.php&referrer=
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
Keep-Alive: timeout=3, max=100
Content-Length: 489
Expires: Wed, 11 Jan 1984 05:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: GMX (Online)

27 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	warning	URL: https://www.vodi.me/content/gmx/gmx_files/jquery-3.4.1-ver-D19AFC7779BBA20E96683BE58B330F62.js.download(Line 2) Message: jQuery.Deferred exception: $(...).on(...).on(...).on(...).on(...).find(...).andSelf is not a function TypeError: $(...).on(...).on(...).on(...).on(...).find(...).andSelf is not a function at initButtons (https://www.vodi.me/content/gmx/gmx_files/interception.js.download:167:10) at HTMLDocument.<anonymous> (https://www.vodi.me/content/gmx/gmx_files/interception.js.download:178:5) at e (https://www.vodi.me/content/gmx/gmx_files/jquery-3.4.1-ver-D19AFC7779BBA20E96683BE58B330F62.js.download:2:29453) at t (https://www.vodi.me/content/gmx/gmx_files/jquery-3.4.1-ver-D19AFC7779BBA20E96683BE58B330F62.js.download:2:29755) undefined

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.cloudflare.com
img.ui-portal.de
wa.ui-portal.de
www.vodi.me
23.210.249.45
2606:4700:30::6818:757b
2606:4700::6811:4004
82.165.229.54
0577a50940bd30b753e372af56e01a10f612b46844743f0f40115ba9d367c492
21408131188b509cc83d535d9d205058a7f6d4f333aba939d60750015e9d06ef
3218b60cbefe402ec7093fcc0aa27805de140619e8dff4a4af4e14e023bd6323
337b1cd522aac5c61604e40402c0dcc3053de9387d0c2be9c0c27c8503ec4e7d
4cb170c47988f5ecd65f2243af51805b0507bb6ca6424da52b8d26475d0f8e16
4cde34c1e366e3d7625d453914da07e72c137c195ec9191db06f41775e65a01b
4df2c2441a949ed7ff7426c12c488c0f5506afbb6acad07e81a03a826c120ff5
63c19d4f65c6db137ebad0a97daf4b31b94900692e69e8a840555204aec4b602
7a16dae2ca8b712d3c3f85e2ce7e95b9decc1defa377c03a14f872aea91c8a2f
7ec51beb961db2999fe41a96a3212edc51d9aeeec5c9d374e39c7313d183d8a6
814d708ae7117c643892517043641d0802ae58402b8eacab4b52084321fc9ec4
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
b08cdbc2d30e656a86b20f8342428d5863f70f4b30135b4f4061f754ce932f5e
c3236f2795c78a26b795a60a972ada5a30cf25eea2c17b56817ed66562084bef
d5eb5d3724dc0762e05678e16c2a1c893e8f1cee6076ca191914573be5ac3695
da5f4b5c081876a3c784d966637d71662bb8a9b5b8a0f742bdc3526c31a7434b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f2be4d8456cd0f00e629994338ba6e72068ba5630a0e22cadc8a903d63ad83ed
f9063c8b0b831e649b6260a0a51a71c1a862911360f11f3ba43414bfc5b06c71

www.vodi.me Open in urlscan Pro 2606:4700:30::6818:757b Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

20 Requests

100 %HTTPS

50 %IPv6

3 Domains

4 Subdomains

4 IPs

3 Countries

140 kBTransfer

364 kBSize

0 Cookies

7 Outgoing links

Redirected requests

20 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

27 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

www.vodi.me Open in urlscan Pro
2606:4700:30::6818:757b Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

20
Requests

100 %
HTTPS

50 %
IPv6

3
Domains

4
Subdomains

4
IPs

3
Countries

140 kB
Transfer

364 kB
Size

0
Cookies

20 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!