![](/screenshots/be706329-a809-4347-b697-94f7a28d6a02.png)
mileskarten.de
Open in
urlscan Pro
188.114.96.3
Malicious Activity!
Public Scan
Effective URL: https://mileskarten.de/auth/xN9dG1/login.php?id=24966063
Submission Tags: @ecarlesi possiblethreat phishing Search All
Submission: On March 08 via api from IT — Scanned from IT
Summary
TLS certificate: Issued by GTS CA 1P5 on February 22nd 2024. Valid for: 3 months.
This is the only time mileskarten.de was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Lufthansa (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 104.21.10.185 104.21.10.185 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 192.0.78.26 192.0.78.26 | 2635 (AUTOMATTIC) (AUTOMATTIC) | |
1 1 | 104.18.36.131 104.18.36.131 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 10 | 188.114.96.3 188.114.96.3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 104.16.87.20 104.16.87.20 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 151.101.130.137 151.101.130.137 | 54113 (FASTLY) (FASTLY) | |
2 | 104.17.25.14 104.17.25.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 157.240.0.6 157.240.0.6 | 32934 (FACEBOOK) (FACEBOOK) | |
1 | 142.250.185.74 142.250.185.74 | 15169 (GOOGLE) (GOOGLE) | |
1 | 142.250.186.131 142.250.186.131 | 15169 (GOOGLE) (GOOGLE) | |
1 | 157.240.253.35 157.240.253.35 | 32934 (FACEBOOK) (FACEBOOK) | |
20 | 10 |
ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-02-fra3.fbcdn.net
connect.facebook.net |
ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f10.1e100.net
fonts.googleapis.com |
ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f3.1e100.net
fonts.gstatic.com |
ASN32934 (FACEBOOK, US)
PTR: edge-star-mini-shv-02-fra5.facebook.com
www.facebook.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
mileskarten.de
2 redirects
mileskarten.de |
16 KB |
2 |
facebook.net
connect.facebook.net — Cisco Umbrella Rank: 180 |
69 KB |
2 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 228 |
413 KB |
2 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 310 |
48 KB |
1 |
facebook.com
www.facebook.com — Cisco Umbrella Rank: 100 |
185 B |
1 |
gstatic.com
fonts.gstatic.com |
48 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 30 |
2 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 760 |
31 KB |
1 |
truthsocial.com
1 redirects
links.truthsocial.com — Cisco Umbrella Rank: 280326 |
1 KB |
1 |
href.li
href.li — Cisco Umbrella Rank: 103256 |
405 B |
1 |
thecofchurch.com
1 redirects
www.thecofchurch.com |
716 B |
0 |
jkdluxlimo.com
Failed
jkdluxlimo.com Failed |
|
20 | 12 |
Domain | Requested by | |
---|---|---|
10 | mileskarten.de |
2 redirects
href.li
mileskarten.de |
2 | connect.facebook.net |
mileskarten.de
connect.facebook.net |
2 | cdnjs.cloudflare.com |
mileskarten.de
|
2 | cdn.jsdelivr.net |
mileskarten.de
|
1 | www.facebook.com |
mileskarten.de
|
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | fonts.googleapis.com |
mileskarten.de
|
1 | code.jquery.com |
mileskarten.de
|
1 | links.truthsocial.com | 1 redirects |
1 | href.li | |
1 | www.thecofchurch.com | 1 redirects |
0 | jkdluxlimo.com Failed |
mileskarten.de
|
20 | 12 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
tls.automattic.com R3 |
2024-03-05 - 2024-06-03 |
3 months | crt.sh |
mileskarten.de GTS CA 1P5 |
2024-02-22 - 2024-05-22 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-05-02 - 2024-05-01 |
a year | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2023-07-11 - 2024-07-14 |
a year | crt.sh |
*.facebook.com DigiCert SHA2 High Assurance Server CA |
2023-12-16 - 2024-03-15 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2024-02-19 - 2024-05-13 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2024-02-19 - 2024-05-13 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://mileskarten.de/auth/xN9dG1/login.php?id=24966063
Frame ID: 5493A67ED7D038EC1B48EBC04E184A68
Requests: 20 HTTP requests in this frame
Screenshot
![](/screenshots/be706329-a809-4347-b697-94f7a28d6a02.png)
Page Title
Miles & More Online-KartenkontoPage URL History Show full URLs
-
http://www.thecofchurch.com/
HTTP 301
https://href.li/?https://links.truthsocial.com/link/112008047871792166 Page URL
-
https://links.truthsocial.com/link/112008047871792166
HTTP 301
https://mileskarten.de/ HTTP 302
https://mileskarten.de/auth/?pwd=miles HTTP 302
https://mileskarten.de/auth/xN9dG1/login.php?id=24966063 Page URL
Detected technologies
Detected patterns
Detected patterns
- \.php(?:$|\?)
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Detected patterns
- //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js
![](/vendor/wappa/icons/Font Awesome.png)
Detected patterns
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Detected patterns
- <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://www.thecofchurch.com/
HTTP 301
https://href.li/?https://links.truthsocial.com/link/112008047871792166 Page URL
-
https://links.truthsocial.com/link/112008047871792166
HTTP 301
https://mileskarten.de/ HTTP 302
https://mileskarten.de/auth/?pwd=miles HTTP 302
https://mileskarten.de/auth/xN9dG1/login.php?id=24966063 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://www.thecofchurch.com/ HTTP 301
- https://href.li/?https://links.truthsocial.com/link/112008047871792166
20 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
href.li/ Redirect Chain
|
554 B 405 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Primary Request
login.php
mileskarten.de/auth/xN9dG1/ Redirect Chain
|
9 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/ |
152 KB 25 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
helpers.css
mileskarten.de/auth/media/css/ |
41 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
style.css
mileskarten.de/auth/media/css/ |
3 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
spinner.gif
jkdluxlimo.com/assets/xhr/files/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logo.svg
mileskarten.de/auth/media/imgs/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logo2.svg
mileskarten.de/auth/media/imgs/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
key.png
mileskarten.de/auth/media/imgs/ |
474 B 975 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
arrow.png
mileskarten.de/auth/media/imgs/ |
190 B 693 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.6.1.min.js
code.jquery.com/ |
88 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.bundle.min.js
cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/js/ |
77 KB 23 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.min.js
cdnjs.cloudflare.com/ajax/libs/font-awesome/6.2.0/js/ |
1 MB 410 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.mask.min.js
cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.14.16/ |
8 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
js.js
mileskarten.de/auth/media/js/ |
31 B 533 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fbevents.js
connect.facebook.net/en_US/ |
215 KB 58 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
28 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
679544337423493
connect.facebook.net/signals/config/ |
53 KB 11 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v40/ |
47 KB 48 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.facebook.com/tr/ |
0 185 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- jkdluxlimo.com
- URL
- https://jkdluxlimo.com/assets/xhr/files/spinner.gif
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Lufthansa (Transportation)10 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| fbq function| _fbq function| $ function| jQuery number| uidEvent object| bootstrap object| ___FONT_AWESOME___ object| FontAwesomeConfig object| FontAwesome object| $jscomp5 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
links.truthsocial.com/ | Name: _mastodon_session Value: df4bfe585e6067e1dfc5f1314625f966 |
|
.truthsocial.com/ | Name: __cf_bm Value: zGxLFvFKvK8viBEGRJPTanbg0mtlwLbiwKsF9CgwbJQ-1709897447-1.0.1.1-FvpOL8UbYxJahYQqBFCoHPM7QAVbaonF.qp3eVv6LsTqvW9J9GFd0xrJycgrYlostJnO6VbEzSHYXLdEZtRVLw |
|
links.truthsocial.com/ | Name: __cflb Value: 0H28vTPqhjwKvpvovPVBEXtBS5ranf56RKooaCUFBPD |
|
mileskarten.de/ | Name: PHPSESSID Value: ke4rco9bo3lad0hgf19la789d6 |
|
.mileskarten.de/ | Name: _fbp Value: fb.1.1709897449535.2118674600 |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.jsdelivr.net
cdnjs.cloudflare.com
code.jquery.com
connect.facebook.net
fonts.googleapis.com
fonts.gstatic.com
href.li
jkdluxlimo.com
links.truthsocial.com
mileskarten.de
www.facebook.com
www.thecofchurch.com
jkdluxlimo.com
104.16.87.20
104.17.25.14
104.18.36.131
104.21.10.185
142.250.185.74
142.250.186.131
151.101.130.137
157.240.0.6
157.240.253.35
188.114.96.3
192.0.78.26
0a1e967b443876fee56a65b9edd355087cd39ec51f0120b0de535e87eff086bc
1c7070cf33da6adcb7a6b9ff7eb6e06fd8f64958622d61569b990e8b92c58615
24b85252041352cd0d17d257a7aeaed94d470b173b032d321f01b3d78ab0d04c
2a0db34dc14ef4b5ce73b230701c7561e5012667a4c9cb274ecab646e1474995
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
50b6e67cfcfe4ac8fe9cee705b681f696065306ee42bcd4e6b37a17dba333ac5
55925c9223edddf35f6b3c8037045a31999b4d9589ffd808183d287c27c6f452
6a769e18b06859751eaa2259044a6ff76e3ddcd6572a516d8ce3a2d7b8c7538e
7633b7c0c97d19e682feee8afa2738523fcb2a14544a550572caeecd2eefe66b
7e1f1503df765cca5e099891b94e318a2ef95081ba2af1eb6d417cc884bfdbfe
86b41ff3f229eb2a7f189765a96597ddcb7b76a20b6a99e529524db2ada54117
89a52b7cca8bf852b9797ceedf32d3bd8708d78834f1aeb57d3941b2b0d4c219
8b5e7b2959dfba5bcab247b90d26a6604e1a18cad3788a49bee3eb4d7514da22
90787ca0e77942034765d1f69eff786ed8fbb616ed49ba6fbc8e9f56207c579e
a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74
b1a61a6741d99578a8409e38dda1968a4e7ec2c5e7b59c4a666c2b434158dd88
d26f829655165017ce3829e1ef3279c50aa0f9543ffc292f3545c31ce8416cc2
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855