www.accounts-login-idm-telekomde.eu Open in urlscan Pro
31.11.32.73 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/Telekom-Login.htm?webscr&cmd=_login-run&SESSION=d8e1hvaBEYsH...
Submission Tags: 6424033
Submission: On February 28 via api (February 28th 2020, 2:29:30 pm UTC) from NL

Summary HTTP 17 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 17 HTTP transactions. The main IP is 31.11.32.73, located in Arezzo, Italy and belongs to ARUBA-ASN, IT. The main domain is www.accounts-login-idm-telekomde.eu.
TLS certificate: Issued by Actalis Domain Validation Server CA G2 on February 11th 2020. Valid for: a year.

This is the only time www.accounts-login-idm-telekomde.eu was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Telekom (Telecommunication)

Domain & IP information

	IP Address		AS Autonomous System
17	31.11.32.73 31.11.32.73		31034 (ARUBA-ASN) (ARUBA-ASN)
17	1

17 31.11.32.73 (Arezzo, Italy)

ASN31034 (ARUBA-ASN, IT)
PTR: websn1s063.aruba.it

www.accounts-login-idm-telekomde.eu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
17	accounts-login-idm-telekomde.eu www.accounts-login-idm-telekomde.eu	81 KB
17	1

	Domain	Requested by
17	www.accounts-login-idm-telekomde.eu	www.accounts-login-idm-telekomde.eu
17	1

This site contains links to these domains. Also see Links.

Domain
meinkonto.telekom-dienste.de
www.telekom.de

Subject Issuer	Validity	Valid
*.accounts-login-idm-telekomde.eu Actalis Domain Validation Server CA G2	`2020-02-11` - `2021-02-11`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/Telekom-Login.htm?webscr&cmd=_login-run&SESSION=d8e1hvaBEYsHkhj04Apx8Z98wz1k3oyZaw3hsmlIgFHe4yZreYlG9oGGZdz&dispatch=ab2b41c63853f0a651ba9fbf502b0cd8d806ca13ca3449af72a1ea5aedbed26af45a1078feb35de77d26b3f7a52ef502
Frame ID: ACE387730BBD45D2943B3670EF03BD3D
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Windows Server (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i

IIS (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^\/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

17
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

81 kB
Transfer

273 kB
Size

0
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://meinkonto.telekom-dienste.de/wiederherstellung/passwort/index.xhtml
Title: Passwort vergessen?

Search URL Search Domain Scan URL

URL: https://meinkonto.telekom-dienste.de/konto/registrierung?client_id=10PRODYAK00000004901SAM30000000000000000&state=cedd4481-e234-4a94-aa6d-35114930a556&nonce=YAKREG-NC-3e58b77c-a5ad-4011-81ff-df82ec043ab2&redirect_uri=https%3A%2F%2Faccounts.login.idm.telekom.com%2Fcallback&display=page&scope=openid&response_type=code&regp=freemail&sid=yak
Title: Jetzt registrieren

Search URL Search Domain Scan URL

URL: https://www.telekom.de/start/impressum
Title: Impressum

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Telekom-Login.htm Show response www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/	9 KB 3 KB	259ms 53ms	Document text/html	31.11.32.73 ARUBA-ASN
General Check archive.org Show headers Download Go to Full URL https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/Telekom-Login.htm?webscr&cmd=_login-run&SESSION=d8e1hvaBEYsHkhj04Apx8Z98wz1k3oyZaw3hsmlIgFHe4yZreYlG9oGGZdz&dispatch=ab2b41c63853f0a651ba9fbf502b0cd8d806ca13ca3449af72a1ea5aedbed26af45a1078feb35de77d26b3f7a52ef502 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 31.11.32.73 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT), Reverse DNS websn1s063.aruba.it Software Microsoft-IIS/8.5 / ASP.NET Resource Hash `891c7b28e5914b0f18d738004f45919043accbf8fcc0ddff5e9c340a87b7f5a5` Request headers Host www.accounts-login-idm-telekomde.eu Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest document Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest document Response headers Content-Type text/html Content-Encoding gzip Last-Modified Tue, 11 Feb 2020 11:31:33 GMT Accept-Ranges bytes ETag "8018b6cfcee0d51:0" Vary Accept-Encoding Server Microsoft-IIS/8.5 X-Powered-By ASP.NET Date Fri, 28 Feb 2020 14:29:11 GMT Content-Length 2709
GET H/1.1	200 OK	components.css www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/Telekom-Login_files/	85 KB 16 KB	95ms 92ms	Stylesheet text/css	31.11.32.73 ARUBA-ASN
General Check archive.org Show headers Download Go to Full URL https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/Telekom-Login_files/components.css Requested by Host: www.accounts-login-idm-telekomde.eu URL: https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/Telekom-Login.htm?webscr&cmd=_login-run&SESSION=d8e1hvaBEYsHkhj04Apx8Z98wz1k3oyZaw3hsmlIgFHe4yZreYlG9oGGZdz&dispatch=ab2b41c63853f0a651ba9fbf502b0cd8d806ca13ca3449af72a1ea5aedbed26af45a1078feb35de77d26b3f7a52ef502 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 31.11.32.73 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT), Reverse DNS websn1s063.aruba.it Software Microsoft-IIS/8.5 / ASP.NET Resource Hash `bb31969044665668b32fae628d08207b0509b7dbe9b6436fb596f485c929876d` Request headers Referer https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/Telekom-Login.htm?webscr&cmd=_login-run&SESSION=d8e1hvaBEYsHkhj04Apx8Z98wz1k3oyZaw3hsmlIgFHe4yZreYlG9oGGZdz&dispatch=ab2b41c63853f0a651ba9fbf502b0cd8d806ca13ca3449af72a1ea5aedbed26af45a1078feb35de77d26b3f7a52ef502 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers Date Fri, 28 Feb 2020 14:29:11 GMT Content-Encoding gzip Last-Modified Tue, 11 Feb 2020 11:31:33 GMT Server Microsoft-IIS/8.5 X-Powered-By ASP.NET ETag "8018b6cfcee0d51:0" Vary Accept-Encoding Content-Type text/css Accept-Ranges bytes Content-Length 15892
GET H/1.1	200 OK	login.css www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/Telekom-Login_files/	6 KB 2 KB	112ms 37ms	Stylesheet text/css	31.11.32.73 ARUBA-ASN
General Check archive.org Show headers Download Go to Full URL https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/Telekom-Login_files/login.css Requested by Host: www.accounts-login-idm-telekomde.eu URL: https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/Telekom-Login.htm?webscr&cmd=_login-run&SESSION=d8e1hvaBEYsHkhj04Apx8Z98wz1k3oyZaw3hsmlIgFHe4yZreYlG9oGGZdz&dispatch=ab2b41c63853f0a651ba9fbf502b0cd8d806ca13ca3449af72a1ea5aedbed26af45a1078feb35de77d26b3f7a52ef502 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 31.11.32.73 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT), Reverse DNS websn1s063.aruba.it Software Microsoft-IIS/8.5 / ASP.NET Resource Hash `aa7738b9c192114afc3c295e5bb2d441ae4c7da9716eb86d40993a11a74bf3ea` Request headers Referer https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/Telekom-Login.htm?webscr&cmd=_login-run&SESSION=d8e1hvaBEYsHkhj04Apx8Z98wz1k3oyZaw3hsmlIgFHe4yZreYlG9oGGZdz&dispatch=ab2b41c63853f0a651ba9fbf502b0cd8d806ca13ca3449af72a1ea5aedbed26af45a1078feb35de77d26b3f7a52ef502 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers Date Fri, 28 Feb 2020 14:29:11 GMT Content-Encoding gzip Last-Modified Tue, 11 Feb 2020 11:31:35 GMT Server Microsoft-IIS/8.5 X-Powered-By ASP.NET ETag "8045e7d0cee0d51:0" Vary Accept-Encoding Content-Type text/css Accept-Ranges bytes Content-Length 1276
GET H/1.1	404 Not Found	import-event-0746.txt www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/Telekom-Login_files/	5 KB 5 KB	144ms 48ms	Image text/html	31.11.32.73 ARUBA-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/Telekom-Login_files/import-event-0746.txt Requested by Host: www.accounts-login-idm-telekomde.eu URL: https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/Telekom-Login.htm?webscr&cmd=_login-run&SESSION=d8e1hvaBEYsHkhj04Apx8Z98wz1k3oyZaw3hsmlIgFHe4yZreYlG9oGGZdz&dispatch=ab2b41c63853f0a651ba9fbf502b0cd8d806ca13ca3449af72a1ea5aedbed26af45a1078feb35de77d26b3f7a52ef502 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 31.11.32.73 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT), Reverse DNS websn1s063.aruba.it Software Microsoft-IIS/8.5 / ASP.NET Resource Hash `9720a56c174341ae95aee0a4f8e641b259948ec78ac6e9022e047fe38e354f2f` Request headers Referer https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/Telekom-Login.htm?webscr&cmd=_login-run&SESSION=d8e1hvaBEYsHkhj04Apx8Z98wz1k3oyZaw3hsmlIgFHe4yZreYlG9oGGZdz&dispatch=ab2b41c63853f0a651ba9fbf502b0cd8d806ca13ca3449af72a1ea5aedbed26af45a1078feb35de77d26b3f7a52ef502 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Date Fri, 28 Feb 2020 14:29:11 GMT Cache-Control private Server Microsoft-IIS/8.5 X-Powered-By ASP.NET Content-Length 5138 Content-Type text/html; charset=utf-8
GET H/1.1	200 OK	jquery-1.js Show response www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/Telekom-Login_files/	94 KB 33 KB	137ms 61ms	Script application/javascript	31.11.32.73 ARUBA-ASN
General Check archive.org Show headers Download Go to Full URL https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/Telekom-Login_files/jquery-1.js Requested by Host: www.accounts-login-idm-telekomde.eu URL: https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/Telekom-Login.htm?webscr&cmd=_login-run&SESSION=d8e1hvaBEYsHkhj04Apx8Z98wz1k3oyZaw3hsmlIgFHe4yZreYlG9oGGZdz&dispatch=ab2b41c63853f0a651ba9fbf502b0cd8d806ca13ca3449af72a1ea5aedbed26af45a1078feb35de77d26b3f7a52ef502 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 31.11.32.73 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT), Reverse DNS websn1s063.aruba.it Software Microsoft-IIS/8.5 / ASP.NET Resource Hash `20e11ce61890c08c0529911822233c9023ebc367df6c1050dec105e2b9628104` Request headers Referer https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/Telekom-Login.htm?webscr&cmd=_login-run&SESSION=d8e1hvaBEYsHkhj04Apx8Z98wz1k3oyZaw3hsmlIgFHe4yZreYlG9oGGZdz&dispatch=ab2b41c63853f0a651ba9fbf502b0cd8d806ca13ca3449af72a1ea5aedbed26af45a1078feb35de77d26b3f7a52ef502 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Date Fri, 28 Feb 2020 14:29:11 GMT Content-Encoding gzip Last-Modified Tue, 11 Feb 2020 11:31:34 GMT Server Microsoft-IIS/8.5 X-Powered-By ASP.NET ETag "0af4ed0cee0d51:0" Vary Accept-Encoding Content-Type application/javascript Accept-Ranges bytes Content-Length 33402
GET H/1.1	200 OK	components.js Show response www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/Telekom-Login_files/	66 KB 21 KB	138ms 62ms	Script application/javascript	31.11.32.73 ARUBA-ASN
General Check archive.org Show headers Download Go to Full URL https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/Telekom-Login_files/components.js Requested by Host: www.accounts-login-idm-telekomde.eu URL: https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/Telekom-Login.htm?webscr&cmd=_login-run&SESSION=d8e1hvaBEYsHkhj04Apx8Z98wz1k3oyZaw3hsmlIgFHe4yZreYlG9oGGZdz&dispatch=ab2b41c63853f0a651ba9fbf502b0cd8d806ca13ca3449af72a1ea5aedbed26af45a1078feb35de77d26b3f7a52ef502 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 31.11.32.73 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT), Reverse DNS websn1s063.aruba.it Software Microsoft-IIS/8.5 / ASP.NET Resource Hash `c63d7993ea7dbf9618b51351e7209baa3c0c99944df7a98602f2a1cafaef29c5` Request headers Referer https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/Telekom-Login.htm?webscr&cmd=_login-run&SESSION=d8e1hvaBEYsHkhj04Apx8Z98wz1k3oyZaw3hsmlIgFHe4yZreYlG9oGGZdz&dispatch=ab2b41c63853f0a651ba9fbf502b0cd8d806ca13ca3449af72a1ea5aedbed26af45a1078feb35de77d26b3f7a52ef502 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Date Fri, 28 Feb 2020 14:29:11 GMT Content-Encoding gzip Last-Modified Tue, 11 Feb 2020 11:31:34 GMT Server Microsoft-IIS/8.5 X-Powered-By ASP.NET ETag "0af4ed0cee0d51:0" Vary Accept-Encoding Content-Type application/javascript Accept-Ranges bytes Content-Length 20824
GET H/1.1	200 OK	login.js Show response www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/Telekom-Login_files/	8 KB 2 KB	146ms 52ms	Script application/javascript	31.11.32.73 ARUBA-ASN
General Check archive.org Show headers Download Go to Full URL https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/Telekom-Login_files/login.js Requested by Host: www.accounts-login-idm-telekomde.eu URL: https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/Telekom-Login.htm?webscr&cmd=_login-run&SESSION=d8e1hvaBEYsHkhj04Apx8Z98wz1k3oyZaw3hsmlIgFHe4yZreYlG9oGGZdz&dispatch=ab2b41c63853f0a651ba9fbf502b0cd8d806ca13ca3449af72a1ea5aedbed26af45a1078feb35de77d26b3f7a52ef502 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 31.11.32.73 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT), Reverse DNS websn1s063.aruba.it Software Microsoft-IIS/8.5 / ASP.NET Resource Hash `072d54a99e5108243e4e8f6c85adc3f1a88113cd29458107c47b8d2f458be558` Request headers Referer https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/Telekom-Login.htm?webscr&cmd=_login-run&SESSION=d8e1hvaBEYsHkhj04Apx8Z98wz1k3oyZaw3hsmlIgFHe4yZreYlG9oGGZdz&dispatch=ab2b41c63853f0a651ba9fbf502b0cd8d806ca13ca3449af72a1ea5aedbed26af45a1078feb35de77d26b3f7a52ef502 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Date Fri, 28 Feb 2020 14:29:11 GMT Content-Encoding gzip Last-Modified Tue, 11 Feb 2020 11:31:35 GMT Server Microsoft-IIS/8.5 X-Powered-By ASP.NET ETag "8045e7d0cee0d51:0" Vary Accept-Encoding Content-Type application/javascript Accept-Ranges bytes Content-Length 2102
GET H/1.1	404 Not Found	telegroteskscreen-regular.woff www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/fonts/	0 0	37ms 37ms	Font text/html	31.11.32.73 ARUBA-ASN
General Check archive.org Show headers Download Go to Full URL https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/fonts/telegroteskscreen-regular.woff Requested by Host: www.accounts-login-idm-telekomde.eu URL: https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/Telekom-Login.htm?webscr&cmd=_login-run&SESSION=d8e1hvaBEYsHkhj04Apx8Z98wz1k3oyZaw3hsmlIgFHe4yZreYlG9oGGZdz&dispatch=ab2b41c63853f0a651ba9fbf502b0cd8d806ca13ca3449af72a1ea5aedbed26af45a1078feb35de77d26b3f7a52ef502 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 31.11.32.73 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT), Reverse DNS websn1s063.aruba.it Software Microsoft-IIS/8.5 / ASP.NET Resource Hash Request headers Referer https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/Telekom-Login_files/components.css Origin https://www.accounts-login-idm-telekomde.eu Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 28 Feb 2020 14:29:11 GMT Cache-Control private Server Microsoft-IIS/8.5 X-Powered-By ASP.NET Content-Length 5128 Content-Type text/html; charset=utf-8
GET H/1.1	404 Not Found	telekomicon-outline.woff www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/fonts/	0 0	49ms 48ms	Font text/html	31.11.32.73 ARUBA-ASN
General Check archive.org Show headers Download Go to Full URL https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/fonts/telekomicon-outline.woff Requested by Host: www.accounts-login-idm-telekomde.eu URL: https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/Telekom-Login.htm?webscr&cmd=_login-run&SESSION=d8e1hvaBEYsHkhj04Apx8Z98wz1k3oyZaw3hsmlIgFHe4yZreYlG9oGGZdz&dispatch=ab2b41c63853f0a651ba9fbf502b0cd8d806ca13ca3449af72a1ea5aedbed26af45a1078feb35de77d26b3f7a52ef502 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 31.11.32.73 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT), Reverse DNS websn1s063.aruba.it Software Microsoft-IIS/8.5 / ASP.NET Resource Hash Request headers Referer https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/Telekom-Login_files/components.css Origin https://www.accounts-login-idm-telekomde.eu Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 28 Feb 2020 14:29:11 GMT Cache-Control private Server Microsoft-IIS/8.5 X-Powered-By ASP.NET Content-Length 5116 Content-Type text/html; charset=utf-8
GET H/1.1	404 Not Found	telegroteskscreen-bold.woff www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/fonts/	0 0	78ms 51ms	Font text/html	31.11.32.73 ARUBA-ASN
General Check archive.org Show headers Download Go to Full URL https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/fonts/telegroteskscreen-bold.woff Requested by Host: www.accounts-login-idm-telekomde.eu URL: https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/Telekom-Login.htm?webscr&cmd=_login-run&SESSION=d8e1hvaBEYsHkhj04Apx8Z98wz1k3oyZaw3hsmlIgFHe4yZreYlG9oGGZdz&dispatch=ab2b41c63853f0a651ba9fbf502b0cd8d806ca13ca3449af72a1ea5aedbed26af45a1078feb35de77d26b3f7a52ef502 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 31.11.32.73 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT), Reverse DNS websn1s063.aruba.it Software Microsoft-IIS/8.5 / ASP.NET Resource Hash Request headers Referer https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/Telekom-Login_files/components.css Origin https://www.accounts-login-idm-telekomde.eu Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 28 Feb 2020 14:29:11 GMT Cache-Control private Server Microsoft-IIS/8.5 X-Powered-By ASP.NET Content-Length 5122 Content-Type text/html; charset=utf-8
GET H/1.1	404 Not Found	telegroteskscreen-thin.woff www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/fonts/	0 0	85ms 56ms	Font text/html	31.11.32.73 ARUBA-ASN
General Check archive.org Show headers Download Go to Full URL https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/fonts/telegroteskscreen-thin.woff Requested by Host: www.accounts-login-idm-telekomde.eu URL: https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/Telekom-Login.htm?webscr&cmd=_login-run&SESSION=d8e1hvaBEYsHkhj04Apx8Z98wz1k3oyZaw3hsmlIgFHe4yZreYlG9oGGZdz&dispatch=ab2b41c63853f0a651ba9fbf502b0cd8d806ca13ca3449af72a1ea5aedbed26af45a1078feb35de77d26b3f7a52ef502 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 31.11.32.73 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT), Reverse DNS websn1s063.aruba.it Software Microsoft-IIS/8.5 / ASP.NET Resource Hash Request headers Referer https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/Telekom-Login_files/components.css Origin https://www.accounts-login-idm-telekomde.eu Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 28 Feb 2020 14:29:11 GMT Cache-Control private Server Microsoft-IIS/8.5 X-Powered-By ASP.NET Content-Length 5122 Content-Type text/html; charset=utf-8
GET H/1.1	404 Not Found	telekomicon-ui.woff www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/fonts/	0 0	69ms 37ms	Font text/html	31.11.32.73 ARUBA-ASN
General Check archive.org Show headers Download Go to Full URL https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/fonts/telekomicon-ui.woff Requested by Host: www.accounts-login-idm-telekomde.eu URL: https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/Telekom-Login.htm?webscr&cmd=_login-run&SESSION=d8e1hvaBEYsHkhj04Apx8Z98wz1k3oyZaw3hsmlIgFHe4yZreYlG9oGGZdz&dispatch=ab2b41c63853f0a651ba9fbf502b0cd8d806ca13ca3449af72a1ea5aedbed26af45a1078feb35de77d26b3f7a52ef502 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 31.11.32.73 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT), Reverse DNS websn1s063.aruba.it Software Microsoft-IIS/8.5 / ASP.NET Resource Hash Request headers Referer https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/Telekom-Login_files/components.css Origin https://www.accounts-login-idm-telekomde.eu Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 28 Feb 2020 14:29:11 GMT Cache-Control private Server Microsoft-IIS/8.5 X-Powered-By ASP.NET Content-Length 5106 Content-Type text/html; charset=utf-8
GET H/1.1	404 Not Found	telegroteskscreen-regular.ttf www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/fonts/	0 0	46ms 39ms	Font text/html	31.11.32.73 ARUBA-ASN
General Check archive.org Show headers Download Go to Full URL https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/fonts/telegroteskscreen-regular.ttf Requested by Host: www.accounts-login-idm-telekomde.eu URL: https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/Telekom-Login.htm?webscr&cmd=_login-run&SESSION=d8e1hvaBEYsHkhj04Apx8Z98wz1k3oyZaw3hsmlIgFHe4yZreYlG9oGGZdz&dispatch=ab2b41c63853f0a651ba9fbf502b0cd8d806ca13ca3449af72a1ea5aedbed26af45a1078feb35de77d26b3f7a52ef502 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 31.11.32.73 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT), Reverse DNS websn1s063.aruba.it Software Microsoft-IIS/8.5 / ASP.NET Resource Hash Request headers Referer https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/Telekom-Login_files/components.css Origin https://www.accounts-login-idm-telekomde.eu Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 28 Feb 2020 14:29:11 GMT Cache-Control private Server Microsoft-IIS/8.5 X-Powered-By ASP.NET Content-Length 5126 Content-Type text/html; charset=utf-8
GET H/1.1	404 Not Found	telekomicon-outline.ttf www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/fonts/	0 0	49ms 48ms	Font text/html	31.11.32.73 ARUBA-ASN
General Check archive.org Show headers Download Go to Full URL https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/fonts/telekomicon-outline.ttf Requested by Host: www.accounts-login-idm-telekomde.eu URL: https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/Telekom-Login.htm?webscr&cmd=_login-run&SESSION=d8e1hvaBEYsHkhj04Apx8Z98wz1k3oyZaw3hsmlIgFHe4yZreYlG9oGGZdz&dispatch=ab2b41c63853f0a651ba9fbf502b0cd8d806ca13ca3449af72a1ea5aedbed26af45a1078feb35de77d26b3f7a52ef502 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 31.11.32.73 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT), Reverse DNS websn1s063.aruba.it Software Microsoft-IIS/8.5 / ASP.NET Resource Hash Request headers Referer https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/Telekom-Login_files/components.css Origin https://www.accounts-login-idm-telekomde.eu Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 28 Feb 2020 14:29:11 GMT Cache-Control private Server Microsoft-IIS/8.5 X-Powered-By ASP.NET Content-Length 5114 Content-Type text/html; charset=utf-8
GET H/1.1	404 Not Found	telekomicon-ui.ttf www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/fonts/	0 0	40ms 40ms	Font text/html	31.11.32.73 ARUBA-ASN
General Check archive.org Show headers Download Go to Full URL https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/fonts/telekomicon-ui.ttf Requested by Host: www.accounts-login-idm-telekomde.eu URL: https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/Telekom-Login.htm?webscr&cmd=_login-run&SESSION=d8e1hvaBEYsHkhj04Apx8Z98wz1k3oyZaw3hsmlIgFHe4yZreYlG9oGGZdz&dispatch=ab2b41c63853f0a651ba9fbf502b0cd8d806ca13ca3449af72a1ea5aedbed26af45a1078feb35de77d26b3f7a52ef502 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 31.11.32.73 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT), Reverse DNS websn1s063.aruba.it Software Microsoft-IIS/8.5 / ASP.NET Resource Hash Request headers Referer https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/Telekom-Login_files/components.css Origin https://www.accounts-login-idm-telekomde.eu Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 28 Feb 2020 14:29:11 GMT Cache-Control private Server Microsoft-IIS/8.5 X-Powered-By ASP.NET Content-Length 5104 Content-Type text/html; charset=utf-8
GET H/1.1	404 Not Found	telegroteskscreen-bold.ttf www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/fonts/	0 0	50ms 50ms	Font text/html	31.11.32.73 ARUBA-ASN
General Check archive.org Show headers Download Go to Full URL https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/fonts/telegroteskscreen-bold.ttf Requested by Host: www.accounts-login-idm-telekomde.eu URL: https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/Telekom-Login.htm?webscr&cmd=_login-run&SESSION=d8e1hvaBEYsHkhj04Apx8Z98wz1k3oyZaw3hsmlIgFHe4yZreYlG9oGGZdz&dispatch=ab2b41c63853f0a651ba9fbf502b0cd8d806ca13ca3449af72a1ea5aedbed26af45a1078feb35de77d26b3f7a52ef502 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 31.11.32.73 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT), Reverse DNS websn1s063.aruba.it Software Microsoft-IIS/8.5 / ASP.NET Resource Hash Request headers Referer https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/Telekom-Login_files/components.css Origin https://www.accounts-login-idm-telekomde.eu Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 28 Feb 2020 14:29:11 GMT Cache-Control private Server Microsoft-IIS/8.5 X-Powered-By ASP.NET Content-Length 5120 Content-Type text/html; charset=utf-8
GET H/1.1	404 Not Found	telegroteskscreen-thin.ttf www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/fonts/	0 0	54ms 53ms	Font text/html	31.11.32.73 ARUBA-ASN
General Check archive.org Show headers Download Go to Full URL https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/fonts/telegroteskscreen-thin.ttf Requested by Host: www.accounts-login-idm-telekomde.eu URL: https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/Telekom-Login.htm?webscr&cmd=_login-run&SESSION=d8e1hvaBEYsHkhj04Apx8Z98wz1k3oyZaw3hsmlIgFHe4yZreYlG9oGGZdz&dispatch=ab2b41c63853f0a651ba9fbf502b0cd8d806ca13ca3449af72a1ea5aedbed26af45a1078feb35de77d26b3f7a52ef502 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 31.11.32.73 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT), Reverse DNS websn1s063.aruba.it Software Microsoft-IIS/8.5 / ASP.NET Resource Hash Request headers Referer https://www.accounts-login-idm-telekomde.eu/meinkonto.telekom-dienste.de/oauth2/Telekom-Login_files/components.css Origin https://www.accounts-login-idm-telekomde.eu Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 28 Feb 2020 14:29:11 GMT Cache-Control private Server Microsoft-IIS/8.5 X-Powered-By ASP.NET Content-Length 5120 Content-Type text/html; charset=utf-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Telekom (Telecommunication)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.accounts-login-idm-telekomde.eu
31.11.32.73
072d54a99e5108243e4e8f6c85adc3f1a88113cd29458107c47b8d2f458be558
20e11ce61890c08c0529911822233c9023ebc367df6c1050dec105e2b9628104
891c7b28e5914b0f18d738004f45919043accbf8fcc0ddff5e9c340a87b7f5a5
9720a56c174341ae95aee0a4f8e641b259948ec78ac6e9022e047fe38e354f2f
aa7738b9c192114afc3c295e5bb2d441ae4c7da9716eb86d40993a11a74bf3ea
bb31969044665668b32fae628d08207b0509b7dbe9b6436fb596f485c929876d
c63d7993ea7dbf9618b51351e7209baa3c0c99944df7a98602f2a1cafaef29c5

www.accounts-login-idm-telekomde.eu Open in urlscan Pro 31.11.32.73 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

17 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

81 kBTransfer

273 kBSize

0 Cookies

3 Outgoing links

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

10 JavaScript Global Variables

0 Cookies

Indicators

www.accounts-login-idm-telekomde.eu Open in urlscan Pro
31.11.32.73 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

81 kB
Transfer

273 kB
Size

0
Cookies

17 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!