![](/screenshots/a08e6244-d70b-4cd2-860c-137534064da0.png)
cool-fermi.212-58-20-2.plesk.page
Open in
urlscan Pro
212.58.20.2
Malicious Activity!
Public Scan
Effective URL: https://cool-fermi.212-58-20-2.plesk.page/c5f996cd74cf0da7bc0ec50c7/
Submission: On July 25 via api from US — Scanned from GE
Summary
TLS certificate: Issued by R3 on July 24th 2023. Valid for: 3 months.
This is the only time cool-fermi.212-58-20-2.plesk.page was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Telekom (Telecommunication)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 8 | 212.58.20.2 212.58.20.2 | 8685 (DORUKNET) (DORUKNET) | |
1 | 80.158.67.40 80.158.67.40 | 34086 (SCZN-AS) (SCZN-AS) | |
5 | 62.157.140.200 62.157.140.200 | 3320 (DTAG Inte...) (DTAG Internet service provider operations) | |
12 | 3 |
ASN8685 (DORUKNET, TR)
PTR: ruweb01.doruk.net.tr
sharp-edison.212-58-20-2.plesk.page | |
cool-fermi.212-58-20-2.plesk.page |
ASN3320 (DTAG Internet service provider operations, DE)
PTR: accounts.login.idm.telekom.com
accounts.login.idm.telekom.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
plesk.page
2 redirects
sharp-edison.212-58-20-2.plesk.page cool-fermi.212-58-20-2.plesk.page |
68 KB |
5 |
telekom.com
accounts.login.idm.telekom.com — Cisco Umbrella Rank: 57116 |
173 KB |
1 |
telekom.de
www.telekom.de — Cisco Umbrella Rank: 126390 |
|
12 | 3 |
Domain | Requested by | |
---|---|---|
7 | cool-fermi.212-58-20-2.plesk.page |
2 redirects
sharp-edison.212-58-20-2.plesk.page
cool-fermi.212-58-20-2.plesk.page |
5 | accounts.login.idm.telekom.com |
cool-fermi.212-58-20-2.plesk.page
|
1 | www.telekom.de |
cool-fermi.212-58-20-2.plesk.page
|
1 | sharp-edison.212-58-20-2.plesk.page | |
12 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.telekom.de |
Subject Issuer | Validity | Valid | |
---|---|---|---|
sharp-edison.212-58-20-2.plesk.page R3 |
2023-07-24 - 2023-10-22 |
3 months | crt.sh |
cool-fermi.212-58-20-2.plesk.page R3 |
2023-07-24 - 2023-10-22 |
3 months | crt.sh |
www.telekom.de Telekom Security ServerID OV Class 2 CA |
2023-07-03 - 2024-07-07 |
a year | crt.sh |
accounts.login.idm.telekom.com TeleSec ServerPass Extended Validation Class 3 CA |
2022-08-12 - 2023-08-16 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://cool-fermi.212-58-20-2.plesk.page/c5f996cd74cf0da7bc0ec50c7/
Frame ID: DEEFC8177344F6BDBC94F18EDE9FDB81
Requests: 11 HTTP requests in this frame
Frame:
https://www.telekom.de/ueber-das-unternehmen/emetriq-xdn?zid=a8c3c712-9ed6-4f1a-acea-259fffde7b7c
Frame ID: C3A33371FA40FCFF3351DFAA4F674FDD
Requests: 1 HTTP requests in this frame
Screenshot
![](/screenshots/a08e6244-d70b-4cd2-860c-137534064da0.png)
Page Title
Telekom LoginPage URL History Show full URLs
-
http://sharp-edison.212-58-20-2.plesk.page/
HTTP 307
https://sharp-edison.212-58-20-2.plesk.page/ Page URL
-
https://cool-fermi.212-58-20-2.plesk.page/
HTTP 302
https://cool-fermi.212-58-20-2.plesk.page/c5f996cd74cf0da7bc0ec50c7 HTTP 301
https://cool-fermi.212-58-20-2.plesk.page/c5f996cd74cf0da7bc0ec50c7/ Page URL
Page Statistics
5 Outgoing links
These are links going to different origins than the main page.
Title: Benötigen Sie Hilfe?
Search URL Search Domain Scan URL
Title: Telekom Login erstellen
Search URL Search Domain Scan URL
Title: Hier informieren über VERIMI
Search URL Search Domain Scan URL
Title: Impressum
Search URL Search Domain Scan URL
Title: Datenschutz
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://sharp-edison.212-58-20-2.plesk.page/
HTTP 307
https://sharp-edison.212-58-20-2.plesk.page/ Page URL
-
https://cool-fermi.212-58-20-2.plesk.page/
HTTP 302
https://cool-fermi.212-58-20-2.plesk.page/c5f996cd74cf0da7bc0ec50c7 HTTP 301
https://cool-fermi.212-58-20-2.plesk.page/c5f996cd74cf0da7bc0ec50c7/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://sharp-edison.212-58-20-2.plesk.page/ HTTP 307
- https://sharp-edison.212-58-20-2.plesk.page/
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
sharp-edison.212-58-20-2.plesk.page/ Redirect Chain
|
260 B 453 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
cool-fermi.212-58-20-2.plesk.page/c5f996cd74cf0da7bc0ec50c7/ Redirect Chain
|
10 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
components.min.css
cool-fermi.212-58-20-2.plesk.page/c5f996cd74cf0da7bc0ec50c7/static/factorx/css/ |
98 KB 31 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login-24.16.1.css
cool-fermi.212-58-20-2.plesk.page/c5f996cd74cf0da7bc0ec50c7/static/factorx/css/ |
18 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
t-online-logo-29112019.png
cool-fermi.212-58-20-2.plesk.page/c5f996cd74cf0da7bc0ec50c7/static/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
services.png
cool-fermi.212-58-20-2.plesk.page/c5f996cd74cf0da7bc0ec50c7/static/factorx/images/ |
22 KB 22 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
emetriq-xdn
www.telekom.de/ueber-das-unternehmen/ Frame C3A3 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
data_protection.svg
accounts.login.idm.telekom.com/static/factorx/images/ |
673 B 894 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
teleicon-outline.woff
accounts.login.idm.telekom.com/static/factorx/fonts/ |
9 KB 9 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
telegroteskscreen-ultra.woff
accounts.login.idm.telekom.com/static/factorx/fonts/ |
52 KB 53 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
telegroteskscreen-thin.woff
accounts.login.idm.telekom.com/static/factorx/fonts/ |
57 KB 57 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
telegroteskscreen-regular.woff
accounts.login.idm.telekom.com/static/factorx/fonts/ |
53 KB 54 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Telekom (Telecommunication)1 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 00 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
accounts.login.idm.telekom.com
cool-fermi.212-58-20-2.plesk.page
sharp-edison.212-58-20-2.plesk.page
www.telekom.de
212.58.20.2
62.157.140.200
80.158.67.40
01fa42140c7fd1e43496b320027681e75123e8121c4ff52e7a390a4ec37d9379
11eed36ec8f3c28fd90958d9881d080cf237ab18d6792dd22785e729f06795ba
14977cb7057352ad7715b93dec52f4993fc16980836d03b64f79566e8c9bec22
3b6317d7c6288f6380f182e8bdc16b4cea82df91bc0f0209dfbce457b3e16910
3c3cff57406992d5b880806e120965b2a77f6a9ac1bbe7a781bfc9f752b4ab5c
53637a2d4745687c07969427a743c6b9207b3ba6e261fa19a61cccaab46eb316
5bd0035d8acae2b84653df0b759c71c859b78fb654a83604eed4246b72fd2c07
ab2ecea34b4814b43fb874bcfa562a3af70545cb9f5bf22e9a17c3b888f21eba
b80effdb6b1baee7ad8a926a027a9f085d0b91a1b52e3a8cf34e9a6b087aad97
f58ecb754487f42fbec18a84421310ab268024c38ec4f4e125aefbcc26fa2fe1