sjgnin.immowelt.de.jsnma.com Open in urlscan Pro
92.205.10.134 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://sjgnin.immowelt.de.jsnma.com/
Submission: On June 20 via automatic, source openphish (June 20th 2021, 1:26:51 am UTC)

Summary HTTP 20 Redirects Links 7 Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 20 HTTP transactions. The main IP is 92.205.10.134, located in Strasbourg, France and belongs to GODADDY-SXB, DE. The main domain is sjgnin.immowelt.de.jsnma.com.

This is the only time sjgnin.immowelt.de.jsnma.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Immowelt (Real Estate)

Domain & IP information

	IP Address	AS Autonomous System
1	92.205.10.134 92.205.10.134	21499 (GODADDY-SXB) (GODADDY-SXB)
16	104.111.235.62 104.111.235.62	16625 (AKAMAI-AS) (AKAMAI-AS)
1	104.109.86.213 104.109.86.213	16625 (AKAMAI-AS) (AKAMAI-AS)
2	104.109.77.38 104.109.77.38	16625 (AKAMAI-AS) (AKAMAI-AS)
20	4

1 92.205.10.134 (Strasbourg, France)

ASN21499 (GODADDY-SXB, DE)
PTR: ip-92-205-10-134.ip.secureserver.net

sjgnin.immowelt.de.jsnma.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 104.111.235.62 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-235-62.deploy.static.akamaitechnologies.com

cdnglobal.immowelt.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.109.86.213 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-109-86-213.deploy.static.akamaitechnologies.com

navigation.immowelt.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.109.77.38 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-109-77-38.deploy.static.akamaitechnologies.com

tags.tiqcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
17	immowelt.org cdnglobal.immowelt.org navigation.immowelt.org	320 KB
2	tiqcdn.com tags.tiqcdn.com	15 KB
1	jsnma.com sjgnin.immowelt.de.jsnma.com	3 KB
20	3

	Domain	Requested by
16	cdnglobal.immowelt.org	sjgnin.immowelt.de.jsnma.com navigation.immowelt.org cdnglobal.immowelt.org
2	tags.tiqcdn.com	cdnglobal.immowelt.org tags.tiqcdn.com
1	navigation.immowelt.org	sjgnin.immowelt.de.jsnma.com
1	sjgnin.immowelt.de.jsnma.com
20	4

This site contains links to these domains. Also see Links.

Domain
immowelt.de
www.immowelt.de
secure.immowelt.de

Subject Issuer	Validity	Valid
*.immowelt.org DigiCert SHA2 Secure Server CA	`2021-06-10` - `2022-06-15`	a year	crt.sh
*.tiqcdn.com DigiCert SHA2 Secure Server CA	`2021-04-19` - `2022-04-27`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://sjgnin.immowelt.de.jsnma.com/
Frame ID: 28C1D60342CD732C76E7B4F69A286280
Requests: 20 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Tealium (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /^(?:https?:)?\/\/tags\.tiqcdn\.com\//i

Page Statistics

20
Requests

70 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

4
IPs

2
Countries

339 kB
Transfer

463 kB
Size

1
Cookies

7 Outgoing links

These are links going to different origins than the main page.

URL: https://immowelt.de/
Title:

Search URL Search Domain Scan URL

URL: https://www.immowelt.de/
Title:

Search URL Search Domain Scan URL

URL: https://secure.immowelt.de/autmvc/LostPassword/Start
Title: Passwort vergessen?

Search URL Search Domain Scan URL

URL: https://immowelt.de/myiw/meineimmowelt/index.aspx?registervisible
Title: Jetzt kostenfrei registrieren

Search URL Search Domain Scan URL

URL: https://immowelt.de/immoweltag/datenschutz
Title: Datenschutzerklärung

Search URL Search Domain Scan URL

URL: https://immowelt.de/immoweltag/agb
Title: AGB

Search URL Search Domain Scan URL

URL: https://immowelt.de/immoweltag/impressum
Title: Impressum

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

20 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response sjgnin.immowelt.de.jsnma.com/	9 KB 3 KB	153ms 79ms	Document text/html	92.205.10.134 GODADDY-SXB
General Check archive.org Show headers Download Go to Full URL http://sjgnin.immowelt.de.jsnma.com/ Protocol HTTP/1.1 Server 92.205.10.134 Strasbourg, France, ASN21499 (GODADDY-SXB, DE), Reverse DNS ip-92-205-10-134.ip.secureserver.net Software Apache / Resource Hash `b065553e7fee1f0b5486865dbf488ed7ae4e58792f398ec7a68bc7779dba7b49` Request headers Host sjgnin.immowelt.de.jsnma.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Sun, 20 Jun 2021 01:26:32 GMT Server Apache Upgrade h2,h2c Connection Upgrade, Keep-Alive Last-Modified Fri, 18 Jun 2021 16:23:11 GMT ETag "63611a5-256b-5c50cbd6eeb68-gzip" Accept-Ranges bytes Vary Accept-Encoding,User-Agent Content-Encoding gzip Content-Length 2797 Keep-Alive timeout=5 Content-Type text/html
GET H2	200	main-0.css cdnglobal.immowelt.org/signin-ui/46ebcfc95654e49313ff6a1a6bb5c5f4bbd55beb/	15 KB 3 KB	98ms 31ms	Stylesheet text/css	104.111.235.62 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://cdnglobal.immowelt.org/signin-ui/46ebcfc95654e49313ff6a1a6bb5c5f4bbd55beb/main-0.css Requested by Host: sjgnin.immowelt.de.jsnma.com URL: http://sjgnin.immowelt.de.jsnma.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.235.62 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-235-62.deploy.static.akamaitechnologies.com Software Akamai Resource Optimizer / Resource Hash `601034c6742d608a15e31c6c6054406662b2dc86632377d2e5bfec582f91f738` Request headers Referer http://sjgnin.immowelt.de.jsnma.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 20 Jun 2021 01:26:32 GMT content-encoding br vary Accept-Encoding server-timing cdn-cache; desc=HIT, edge; dur=2 content-length 2587 last-modified Sat, 24 Apr 2021 09:51:52 GMT server Akamai Resource Optimizer etag "5134e574006b078b966f1b8bb44984ca:1591082095.307696" access-control-max-age 86400 access-control-allow-methods GET,POST content-type text/css access-control-allow-origin * cache-control max-age=5121065, max-age=8640000 access-control-allow-credentials false accept-ranges bytes access-control-allow-headers *
GET H2	200	navigation.js Show response navigation.immowelt.org/v1/MINIMAL/0/	67 KB 11 KB	256ms 186ms	Script application/javascript	104.109.86.213 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://navigation.immowelt.org/v1/MINIMAL/0/navigation.js Requested by Host: sjgnin.immowelt.de.jsnma.com URL: http://sjgnin.immowelt.de.jsnma.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.109.86.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-86-213.deploy.static.akamaitechnologies.com Software / Resource Hash `7530ef695bd2f6b08322215f639bfc5e7e17e1a8365279688e0a1856b7e71bf4` Request headers Referer http://sjgnin.immowelt.de.jsnma.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 20 Jun 2021 01:26:32 GMT content-encoding gzip etag "66f12327b2dcd178943c08954e38b099" vary Accept-Encoding access-control-allow-methods GET,POST content-type application/javascript;charset=UTF-8 access-control-allow-origin https://www.immowelt.de access-control-max-age 86400 cache-control max-age=1800 access-control-allow-credentials false server-timing intid;desc=63b6aca7a5611fd9 access-control-allow-headers * content-length 10993 expires Sun, 20 Jun 2021 01:35:33 GMT
GET H2	200	utag.js Show response cdnglobal.immowelt.org/signin-ui/46ebcfc95654e49313ff6a1a6bb5c5f4bbd55beb/	2 KB 1 KB	99ms 32ms	Script application/x-javascript	104.111.235.62 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://cdnglobal.immowelt.org/signin-ui/46ebcfc95654e49313ff6a1a6bb5c5f4bbd55beb/utag.js Requested by Host: sjgnin.immowelt.de.jsnma.com URL: http://sjgnin.immowelt.de.jsnma.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.235.62 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-235-62.deploy.static.akamaitechnologies.com Software Akamai Resource Optimizer / Resource Hash `cbf94d9a1dde05b4d2dbafc574fdc7e89f57d1cf84be9d74748a7c0809b24653` Request headers Referer http://sjgnin.immowelt.de.jsnma.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 20 Jun 2021 01:26:32 GMT content-encoding br vary Accept-Encoding server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 656 last-modified Fri, 11 Jun 2021 07:35:11 GMT server Akamai Resource Optimizer etag "ad16d01187e06a1832492dd01f451f16:1591082095.317736" access-control-max-age 86400 access-control-allow-methods GET,POST content-type application/x-javascript access-control-allow-origin * cache-control max-age=5121065, max-age=8640000 access-control-allow-credentials false accept-ranges bytes access-control-allow-headers *
GET H2	200	logo_immowelt.svg cdnglobal.immowelt.org/global-assets/4.0.1/legacy/0/images/	4 KB 2 KB	32ms 31ms	Image image/svg+xml	104.111.235.62 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cdnglobal.immowelt.org/global-assets/4.0.1/legacy/0/images/logo_immowelt.svg Requested by Host: sjgnin.immowelt.de.jsnma.com URL: http://sjgnin.immowelt.de.jsnma.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.235.62 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-235-62.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash `23938eb4314413660e24c2a78dd20ae6bfeff839962ebea8ab2a19dee5ae226a` Request headers Referer http://sjgnin.immowelt.de.jsnma.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 20 Jun 2021 01:26:32 GMT content-encoding gzip vary Accept-Encoding server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 1731 last-modified Fri, 20 Mar 2020 14:07:25 GMT server AkamaiNetStorage etag "12a36ea277732f464361d90291ad3224:1584713245.120842" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/svg+xml access-control-allow-origin * cache-control max-age=8640000 access-control-allow-credentials false accept-ranges bytes access-control-allow-headers *
GET H2	200	icon-teaser-magnify.svg cdnglobal.immowelt.org/signin-ui/46ebcfc95654e49313ff6a1a6bb5c5f4bbd55beb/images/icons/icons-iw/	2 KB 1 KB	32ms 31ms	Image image/svg+xml	104.111.235.62 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cdnglobal.immowelt.org/signin-ui/46ebcfc95654e49313ff6a1a6bb5c5f4bbd55beb/images/icons/icons-iw/icon-teaser-magnify.svg Requested by Host: sjgnin.immowelt.de.jsnma.com URL: http://sjgnin.immowelt.de.jsnma.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.235.62 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-235-62.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash `95b6af6df04ea28daee05d78c1de48f9b386294a6a87503b9eae94d3e8ceff70` Request headers Referer http://sjgnin.immowelt.de.jsnma.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 20 Jun 2021 01:26:32 GMT content-encoding gzip vary Accept-Encoding server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 928 last-modified Tue, 02 Jun 2020 07:14:56 GMT server AkamaiNetStorage etag "4b6938455aa3d71d0405b5a67e1d5e38:1591082096.094148" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/svg+xml access-control-allow-origin * cache-control max-age=8640000 access-control-allow-credentials false accept-ranges bytes access-control-allow-headers *
GET H2	200	icon-teaser-arrows.svg cdnglobal.immowelt.org/signin-ui/46ebcfc95654e49313ff6a1a6bb5c5f4bbd55beb/images/icons/icons-iw/	2 KB 1 KB	34ms 34ms	Image image/svg+xml	104.111.235.62 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cdnglobal.immowelt.org/signin-ui/46ebcfc95654e49313ff6a1a6bb5c5f4bbd55beb/images/icons/icons-iw/icon-teaser-arrows.svg Requested by Host: sjgnin.immowelt.de.jsnma.com URL: http://sjgnin.immowelt.de.jsnma.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.235.62 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-235-62.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash `667e25b67585a8da45125ea470976ef8ae9df1b8c9413388b32fc7a45549b632` Request headers Referer http://sjgnin.immowelt.de.jsnma.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 20 Jun 2021 01:26:32 GMT content-encoding gzip vary Accept-Encoding server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 938 last-modified Tue, 02 Jun 2020 07:14:56 GMT server AkamaiNetStorage etag "c8551e0ed6f820f4be47c4ad37c67330:1591082096.150917" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/svg+xml access-control-allow-origin * cache-control max-age=8640000 access-control-allow-credentials false accept-ranges bytes access-control-allow-headers *
GET H2	200	main-0.js Show response cdnglobal.immowelt.org/signin-ui/46ebcfc95654e49313ff6a1a6bb5c5f4bbd55beb/	17 KB 6 KB	31ms 31ms	Script application/x-javascript	104.111.235.62 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://cdnglobal.immowelt.org/signin-ui/46ebcfc95654e49313ff6a1a6bb5c5f4bbd55beb/main-0.js Requested by Host: sjgnin.immowelt.de.jsnma.com URL: http://sjgnin.immowelt.de.jsnma.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.235.62 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-235-62.deploy.static.akamaitechnologies.com Software Akamai Resource Optimizer / Resource Hash `c7b188b49949bc627a96f9afc9b656cf2acb4a108f3794911c36276690960860` Request headers Referer http://sjgnin.immowelt.de.jsnma.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 20 Jun 2021 01:26:32 GMT content-encoding br vary Accept-Encoding server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 5307 last-modified Sat, 24 Apr 2021 09:52:10 GMT server Akamai Resource Optimizer etag "7f6fb540f85e570398d99c9d46ca8815:1591082095.344572" access-control-max-age 86400 access-control-allow-methods GET,POST content-type application/x-javascript access-control-allow-origin * cache-control max-age=5121065, max-age=8640000 access-control-allow-credentials false accept-ranges bytes access-control-allow-headers *
GET H/1.1	200 OK	minimal-0-header.css cdnglobal.immowelt.org/navigation-ui/36ce6c1529d518adaf7ba69717310bc233765b4f/css/	1006 B 1 KB	66ms 49ms	Stylesheet text/css	104.111.235.62 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL http://cdnglobal.immowelt.org/navigation-ui/36ce6c1529d518adaf7ba69717310bc233765b4f/css/minimal-0-header.css Requested by Host: navigation.immowelt.org URL: https://navigation.immowelt.org/v1/MINIMAL/0/navigation.js Protocol HTTP/1.1 Server 104.111.235.62 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-235-62.deploy.static.akamaitechnologies.com Software Akamai Resource Optimizer / Resource Hash `8c643cf092aae00273e2163a89a756093f1a44bb79acefc0421f2d164806498a` Request headers Referer http://sjgnin.immowelt.de.jsnma.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Sun, 20 Jun 2021 01:26:32 GMT Content-Encoding gzip Vary Accept-Encoding Server-Timing cdn-cache; desc=HIT, edge; dur=1 Connection keep-alive Content-Length 413 Last-Modified Sat, 27 Feb 2021 04:57:22 GMT Server Akamai Resource Optimizer ETag "1c83ab44fb80e33960d085b8e11f163c:1613486959.820503" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type text/css Access-Control-Allow-Origin * Cache-Control max-age=3495900, max-age=8640000 Access-Control-Allow-Credentials false Accept-Ranges bytes Access-Control-Allow-Headers *
GET H/1.1	200 OK	logo_immowelt.svg cdnglobal.immowelt.org/global-assets/4.3.0/legacy/0/images/	4 KB 2 KB	70ms 49ms	Image image/svg+xml	104.111.235.62 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL http://cdnglobal.immowelt.org/global-assets/4.3.0/legacy/0/images/logo_immowelt.svg Requested by Host: sjgnin.immowelt.de.jsnma.com URL: http://sjgnin.immowelt.de.jsnma.com/ Protocol HTTP/1.1 Server 104.111.235.62 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-235-62.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash `23938eb4314413660e24c2a78dd20ae6bfeff839962ebea8ab2a19dee5ae226a` Request headers Referer http://sjgnin.immowelt.de.jsnma.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Sun, 20 Jun 2021 01:26:32 GMT Content-Encoding gzip Vary Accept-Encoding Connection keep-alive Server-Timing cdn-cache; desc=HIT, edge; dur=1 Content-Length 1731 Last-Modified Fri, 26 Mar 2021 09:20:26 GMT Server AkamaiNetStorage ETag "12a36ea277732f464361d90291ad3224:1616750426.02394" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/svg+xml Access-Control-Allow-Origin * Cache-Control max-age=8640000 Access-Control-Allow-Credentials false Accept-Ranges bytes Access-Control-Allow-Headers *
GET H/1.1	200 OK	minimal-0-footer.css cdnglobal.immowelt.org/navigation-ui/36ce6c1529d518adaf7ba69717310bc233765b4f/css/	407 B 871 B	57ms 42ms	Stylesheet text/css	104.111.235.62 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL http://cdnglobal.immowelt.org/navigation-ui/36ce6c1529d518adaf7ba69717310bc233765b4f/css/minimal-0-footer.css Requested by Host: navigation.immowelt.org URL: https://navigation.immowelt.org/v1/MINIMAL/0/navigation.js Protocol HTTP/1.1 Server 104.111.235.62 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-235-62.deploy.static.akamaitechnologies.com Software Akamai Resource Optimizer / Resource Hash `9368cd8e815dc1dc9cef1af73372cb04f8d4ee1d407c497bcba5c9ec655adc6f` Request headers Referer http://sjgnin.immowelt.de.jsnma.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Sun, 20 Jun 2021 01:26:32 GMT Content-Encoding gzip Vary Accept-Encoding Server-Timing cdn-cache; desc=HIT, edge; dur=1 Connection keep-alive Content-Length 231 Last-Modified Thu, 25 Mar 2021 01:48:35 GMT Server Akamai Resource Optimizer ETag "ddbbf83ef425bb9c4c7d284aeb0833ec:1615209932.450041" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type text/css Access-Control-Allow-Origin * Cache-Control max-age=3870764, max-age=8640000 Access-Control-Allow-Credentials false Accept-Ranges bytes Access-Control-Allow-Headers *
GET H/1.1	200 OK	minimal-0-footer.js Show response cdnglobal.immowelt.org/navigation-ui/36ce6c1529d518adaf7ba69717310bc233765b4f/	2 KB 2 KB	64ms 46ms	Script application/x-javascript	104.111.235.62 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL http://cdnglobal.immowelt.org/navigation-ui/36ce6c1529d518adaf7ba69717310bc233765b4f/minimal-0-footer.js Requested by Host: navigation.immowelt.org URL: https://navigation.immowelt.org/v1/MINIMAL/0/navigation.js Protocol HTTP/1.1 Server 104.111.235.62 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-235-62.deploy.static.akamaitechnologies.com Software Akamai Resource Optimizer / Resource Hash `9415b6e6159d140fed108f9867486050a2b51e4acf2af543d2ce4598839bca69` Request headers Referer http://sjgnin.immowelt.de.jsnma.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Sun, 20 Jun 2021 01:26:32 GMT Content-Encoding gzip Vary Accept-Encoding Server-Timing cdn-cache; desc=HIT, edge; dur=1 Connection keep-alive Content-Length 1028 Last-Modified Wed, 20 Jan 2021 13:18:19 GMT Server Akamai Resource Optimizer ETag "79d2b73d059d68b0f0fcef16c1c7a075:1611147467.48711" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type application/x-javascript Access-Control-Allow-Origin * Cache-Control max-age=3517933, max-age=8640000 Access-Control-Allow-Credentials false Accept-Ranges bytes Access-Control-Allow-Headers *
GET H2	200	arrow-right.svg cdnglobal.immowelt.org/signin-ui/46ebcfc95654e49313ff6a1a6bb5c5f4bbd55beb/images/icons/	801 B 1 KB	31ms 30ms	Image image/svg+xml	104.111.235.62 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cdnglobal.immowelt.org/signin-ui/46ebcfc95654e49313ff6a1a6bb5c5f4bbd55beb/images/icons/arrow-right.svg Requested by Host: cdnglobal.immowelt.org URL: https://cdnglobal.immowelt.org/signin-ui/46ebcfc95654e49313ff6a1a6bb5c5f4bbd55beb/main-0.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.235.62 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-235-62.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash `451770ba091160eee511e9e1ad0ec7681f8d1849614081afa350c8093e9828f2` Request headers Referer https://cdnglobal.immowelt.org/signin-ui/46ebcfc95654e49313ff6a1a6bb5c5f4bbd55beb/main-0.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 20 Jun 2021 01:26:32 GMT last-modified Tue, 02 Jun 2020 07:14:56 GMT server AkamaiNetStorage etag "c3b166645313ca63e2910da99f97abb4:1591082096.026634" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/svg+xml access-control-allow-origin * cache-control max-age=8640000 access-control-allow-credentials false server-timing cdn-cache; desc=HIT, edge; dur=1 accept-ranges bytes access-control-allow-headers * content-length 801
GET H2	200	lock.svg cdnglobal.immowelt.org/signin-ui/46ebcfc95654e49313ff6a1a6bb5c5f4bbd55beb/images/icons/	2 KB 1 KB	33ms 33ms	Image image/svg+xml	104.111.235.62 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cdnglobal.immowelt.org/signin-ui/46ebcfc95654e49313ff6a1a6bb5c5f4bbd55beb/images/icons/lock.svg Requested by Host: cdnglobal.immowelt.org URL: https://cdnglobal.immowelt.org/signin-ui/46ebcfc95654e49313ff6a1a6bb5c5f4bbd55beb/main-0.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.235.62 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-235-62.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash `ff5a7ccafdf5655b806f5fc619bd47fb43e9858021a5d72e742dd5f647e8ffee` Request headers Referer https://cdnglobal.immowelt.org/signin-ui/46ebcfc95654e49313ff6a1a6bb5c5f4bbd55beb/main-0.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 20 Jun 2021 01:26:32 GMT content-encoding gzip vary Accept-Encoding server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 763 last-modified Tue, 02 Jun 2020 07:14:55 GMT server AkamaiNetStorage etag "3d56b55f1782f3856540a9389156a995:1591082095.963483" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/svg+xml access-control-allow-origin * cache-control max-age=8640000 access-control-allow-credentials false accept-ranges bytes access-control-allow-headers *
GET H2	200	login-default-lgm.jpg cdnglobal.immowelt.org/signin-ui/46ebcfc95654e49313ff6a1a6bb5c5f4bbd55beb/images/teaser/	132 KB 133 KB	34ms 34ms	Image image/jpeg	104.111.235.62 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cdnglobal.immowelt.org/signin-ui/46ebcfc95654e49313ff6a1a6bb5c5f4bbd55beb/images/teaser/login-default-lgm.jpg Requested by Host: cdnglobal.immowelt.org URL: https://cdnglobal.immowelt.org/signin-ui/46ebcfc95654e49313ff6a1a6bb5c5f4bbd55beb/main-0.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.235.62 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-235-62.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash `eee230b896f349558bb52c66ffe6d2428452a5f0de5860fc3ac57c3e161bfb5a` Request headers Referer https://cdnglobal.immowelt.org/signin-ui/46ebcfc95654e49313ff6a1a6bb5c5f4bbd55beb/main-0.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 20 Jun 2021 01:26:32 GMT last-modified Tue, 02 Jun 2020 07:14:56 GMT server AkamaiNetStorage etag "0c8b3467f9256fc4e46dca096fdf5c43:1591082096.018714" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/jpeg access-control-allow-origin * cache-control max-age=8640000 access-control-allow-credentials false server-timing cdn-cache; desc=HIT, edge; dur=1 accept-ranges bytes access-control-allow-headers * content-length 135408
GET H2	200	OpenSans-Light.woff2 cdnglobal.immowelt.org/signin-ui/46ebcfc95654e49313ff6a1a6bb5c5f4bbd55beb/fonts/	45 KB 45 KB	96ms 33ms	Font font/woff2	104.111.235.62 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://cdnglobal.immowelt.org/signin-ui/46ebcfc95654e49313ff6a1a6bb5c5f4bbd55beb/fonts/OpenSans-Light.woff2 Requested by Host: cdnglobal.immowelt.org URL: https://cdnglobal.immowelt.org/signin-ui/46ebcfc95654e49313ff6a1a6bb5c5f4bbd55beb/main-0.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.235.62 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-235-62.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash `1e2ca939c8ea6e474d75968c821c6b0e9a7d326dab593bb97478012372b20617` Request headers Origin http://sjgnin.immowelt.de.jsnma.com Referer https://cdnglobal.immowelt.org/signin-ui/46ebcfc95654e49313ff6a1a6bb5c5f4bbd55beb/main-0.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 20 Jun 2021 01:26:32 GMT last-modified Tue, 02 Jun 2020 07:14:55 GMT server AkamaiNetStorage etag "39d27e13dce3dfe4cdc70a281ccdf113:1591082095.889298" access-control-max-age 86400 access-control-allow-methods GET,POST content-type font/woff2 access-control-allow-origin * cache-control max-age=8640000 access-control-allow-credentials false server-timing cdn-cache; desc=HIT, edge; dur=1 accept-ranges bytes access-control-allow-headers * content-length 45900
GET H2	200	OpenSans-Regular.woff2 cdnglobal.immowelt.org/signin-ui/46ebcfc95654e49313ff6a1a6bb5c5f4bbd55beb/fonts/	46 KB 46 KB	139ms 75ms	Font font/woff2	104.111.235.62 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://cdnglobal.immowelt.org/signin-ui/46ebcfc95654e49313ff6a1a6bb5c5f4bbd55beb/fonts/OpenSans-Regular.woff2 Requested by Host: cdnglobal.immowelt.org URL: https://cdnglobal.immowelt.org/signin-ui/46ebcfc95654e49313ff6a1a6bb5c5f4bbd55beb/main-0.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.235.62 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-235-62.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash `4c1c2e95835201077586a3698cd47806dd18df10d32a1e6cb6aa9e47224a55e3` Request headers Origin http://sjgnin.immowelt.de.jsnma.com Referer https://cdnglobal.immowelt.org/signin-ui/46ebcfc95654e49313ff6a1a6bb5c5f4bbd55beb/main-0.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 20 Jun 2021 01:26:32 GMT last-modified Tue, 02 Jun 2020 07:14:55 GMT server AkamaiNetStorage etag "55835483c304eaa8477fea2c36abba17:1591082095.84807" access-control-max-age 86400 access-control-allow-methods GET,POST content-type font/woff2 access-control-allow-origin * cache-control max-age=8640000 access-control-allow-credentials false server-timing cdn-cache; desc=HIT, edge; dur=1 accept-ranges bytes access-control-allow-headers * content-length 47016
GET H2	200	OpenSans-Semibold.woff2 cdnglobal.immowelt.org/signin-ui/46ebcfc95654e49313ff6a1a6bb5c5f4bbd55beb/fonts/	62 KB 63 KB	129ms 66ms	Font font/woff2	104.111.235.62 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://cdnglobal.immowelt.org/signin-ui/46ebcfc95654e49313ff6a1a6bb5c5f4bbd55beb/fonts/OpenSans-Semibold.woff2 Requested by Host: cdnglobal.immowelt.org URL: https://cdnglobal.immowelt.org/signin-ui/46ebcfc95654e49313ff6a1a6bb5c5f4bbd55beb/main-0.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.235.62 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-235-62.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash `df0231affb521137bf135898b6ce4c2ce59a79e3e23068a673868366c7ac68bb` Request headers Origin http://sjgnin.immowelt.de.jsnma.com Referer https://cdnglobal.immowelt.org/signin-ui/46ebcfc95654e49313ff6a1a6bb5c5f4bbd55beb/main-0.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 20 Jun 2021 01:26:32 GMT last-modified Tue, 02 Jun 2020 07:14:55 GMT server AkamaiNetStorage etag "08952b029e4decbc8ef9fb553cae8cea:1591082095.887283" access-control-max-age 86400 access-control-allow-methods GET,POST content-type font/woff2 access-control-allow-origin * cache-control max-age=8640000 access-control-allow-credentials false server-timing cdn-cache; desc=HIT, edge; dur=1 accept-ranges bytes access-control-allow-headers * content-length 63728
GET H2	200	utag.js Show response tags.tiqcdn.com/utag/axelspringer/immowelt-secure/prod/	49 KB 15 KB	163ms 97ms	Script application/x-javascript	104.109.77.38 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://tags.tiqcdn.com/utag/axelspringer/immowelt-secure/prod/utag.js Requested by Host: cdnglobal.immowelt.org URL: https://cdnglobal.immowelt.org/signin-ui/46ebcfc95654e49313ff6a1a6bb5c5f4bbd55beb/utag.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.109.77.38 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-77-38.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash `547c8bbde5fb00c553442e180a12790bef3060cf7fe3176f3580e6b799b4f918` Request headers Referer http://sjgnin.immowelt.de.jsnma.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 20 Jun 2021 01:26:33 GMT content-encoding gzip last-modified Tue, 02 Mar 2021 07:51:28 GMT server AkamaiNetStorage etag "2d8f867fe06b743b00306f0159fd72e5:1614671488.576294" vary Accept-Encoding content-type application/x-javascript cache-control max-age=300 accept-ranges bytes content-length 15206 expires Sun, 20 Jun 2021 01:31:33 GMT
GET H/1.1	200 OK	utag.v.js Show response tags.tiqcdn.com/utag/tiqapp/	2 B 356 B	64ms 45ms	Script application/x-javascript	104.109.77.38 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL http://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=axelspringer/immowelt-secure/202103020751&cb=1624152393078 Requested by Host: tags.tiqcdn.com URL: https://tags.tiqcdn.com/utag/axelspringer/immowelt-secure/prod/utag.js Protocol HTTP/1.1 Server 104.109.77.38 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-109-77-38.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash `a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb` Request headers Referer http://sjgnin.immowelt.de.jsnma.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Sun, 20 Jun 2021 01:26:33 GMT Last-Modified Thu, 14 Apr 2016 16:57:51 GMT Server AkamaiNetStorage ETag "7bc0ee636b3b83484fc3b9348863bd22:1460653071" Content-Type application/x-javascript Cache-Control max-age=600 Connection keep-alive Accept-Ranges bytes Content-Length 2 Expires Sun, 20 Jun 2021 01:36:33 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Immowelt (Real Estate)

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.jsnma.com/	1970-01-20 03:54:48	Name: utag_main Value: v_id:017a2706c56f00130b4a35fd741e00072002406a00b08$_sn:1$_se:1$_ss:1$_st:1624154193072$ses_id:1624152393072%3Bexp-session$_pn:1%3Bexp-session

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnglobal.immowelt.org
navigation.immowelt.org
sjgnin.immowelt.de.jsnma.com
tags.tiqcdn.com
104.109.77.38
104.109.86.213
104.111.235.62
92.205.10.134
1e2ca939c8ea6e474d75968c821c6b0e9a7d326dab593bb97478012372b20617
23938eb4314413660e24c2a78dd20ae6bfeff839962ebea8ab2a19dee5ae226a
451770ba091160eee511e9e1ad0ec7681f8d1849614081afa350c8093e9828f2
4c1c2e95835201077586a3698cd47806dd18df10d32a1e6cb6aa9e47224a55e3
547c8bbde5fb00c553442e180a12790bef3060cf7fe3176f3580e6b799b4f918
601034c6742d608a15e31c6c6054406662b2dc86632377d2e5bfec582f91f738
667e25b67585a8da45125ea470976ef8ae9df1b8c9413388b32fc7a45549b632
7530ef695bd2f6b08322215f639bfc5e7e17e1a8365279688e0a1856b7e71bf4
8c643cf092aae00273e2163a89a756093f1a44bb79acefc0421f2d164806498a
9368cd8e815dc1dc9cef1af73372cb04f8d4ee1d407c497bcba5c9ec655adc6f
9415b6e6159d140fed108f9867486050a2b51e4acf2af543d2ce4598839bca69
95b6af6df04ea28daee05d78c1de48f9b386294a6a87503b9eae94d3e8ceff70
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
b065553e7fee1f0b5486865dbf488ed7ae4e58792f398ec7a68bc7779dba7b49
c7b188b49949bc627a96f9afc9b656cf2acb4a108f3794911c36276690960860
cbf94d9a1dde05b4d2dbafc574fdc7e89f57d1cf84be9d74748a7c0809b24653
df0231affb521137bf135898b6ce4c2ce59a79e3e23068a673868366c7ac68bb
eee230b896f349558bb52c66ffe6d2428452a5f0de5860fc3ac57c3e161bfb5a
ff5a7ccafdf5655b806f5fc619bd47fb43e9858021a5d72e742dd5f647e8ffee

sjgnin.immowelt.de.jsnma.com Open in urlscan Pro 92.205.10.134 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

20 Requests

70 %HTTPS

0 %IPv6

3 Domains

4 Subdomains

4 IPs

2 Countries

339 kBTransfer

463 kBSize

1 Cookies

7 Outgoing links

Redirected requests

20 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

17 JavaScript Global Variables

1 Cookies

Indicators

sjgnin.immowelt.de.jsnma.com Open in urlscan Pro
92.205.10.134 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

20
Requests

70 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

4
IPs

2
Countries

339 kB
Transfer

463 kB
Size

1
Cookies

20 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!