![](/screenshots/c05501d4-c4f4-4c30-8257-c7766bcb8cd7.png)
magcpopot.6f.sk
Open in
urlscan Pro
2a01:28:ca:63:120:114::
Malicious Activity!
Public Scan
Effective URL: http://magcpopot.6f.sk/ssss.htm
Submission: On June 03 via manual from DE
Summary
This is the only time magcpopot.6f.sk was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Telekom (Telecommunication)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2606:4700:10:... 2606:4700:10::6816:1e8 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a01:28:ca:63... 2a01:28:ca:63:120:114:: | 39392 (SUPERNETW...) (SUPERNETWORK (^_^)/) | |
10 | 2003:2:2:140:... 2003:2:2:140:62:157:140:200 | 3320 (DTAG Inte...) (DTAG Internet service provider operations) | |
1 1 | 2a00:cd0:104d... 2a00:cd0:104d:1:80:82:200:32 | 48173 (UNBELIEVA...) (UNBELIEVABLE-AS) | |
1 | 52.48.182.61 52.48.182.61 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 185.54.150.52 185.54.150.52 | 60164 (WEBTREKK-AS) (WEBTREKK-AS) | |
13 | 4 |
ASN3320 (DTAG Internet service provider operations, DE)
accounts.login.idm.telekom.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-52-48-182-61.eu-west-1.compute.amazonaws.com
lns-ev.xplosion.de |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
telekom.com
accounts.login.idm.telekom.com |
251 KB |
1 |
telekom.de
pix.telekom.de |
866 B |
1 |
xplosion.de
lns-ev.xplosion.de |
217 B |
1 |
xdn-ttp.de
1 redirects
xdn-ttp.de |
494 B |
1 |
6f.sk
magcpopot.6f.sk |
9 KB |
1 |
cutt.ly
1 redirects
cutt.ly |
467 B |
13 | 6 |
Domain | Requested by | |
---|---|---|
10 | accounts.login.idm.telekom.com |
magcpopot.6f.sk
accounts.login.idm.telekom.com |
1 | pix.telekom.de |
magcpopot.6f.sk
|
1 | lns-ev.xplosion.de |
magcpopot.6f.sk
|
1 | xdn-ttp.de | 1 redirects |
1 | magcpopot.6f.sk | |
1 | cutt.ly | 1 redirects |
13 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
meinkonto.telekom-dienste.de |
www.telekom.de |
Subject Issuer | Validity | Valid | |
---|---|---|---|
accounts.login.idm.telekom.com TeleSec ServerPass Extended Validation Class 3 CA |
2018-11-06 - 2020-11-11 |
2 years | crt.sh |
*.xplosion.de Thawte RSA CA 2018 |
2020-01-08 - 2021-03-08 |
a year | crt.sh |
pix.telekom.de TeleSec ServerPass Class 2 CA |
2018-07-02 - 2020-07-07 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
http://magcpopot.6f.sk/ssss.htm
Frame ID: F36637333463E44B5A924A1611A55DAF
Requests: 13 HTTP requests in this frame
Screenshot
![](/screenshots/c05501d4-c4f4-4c30-8257-c7766bcb8cd7.png)
Page URL History Show full URLs
-
https://cutt.ly/1yXN2J2
HTTP 301
http://magcpopot.6f.sk/ssss.htm Page URL
Detected technologies
Detected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Detected patterns
- script /jquery[.-]([\d.]*\d)[^/]*\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
3 Outgoing links
These are links going to different origins than the main page.
Title: Passwort vergessen?
Search URL Search Domain Scan URL
Title: Jetzt registrieren
Search URL Search Domain Scan URL
Title: Impressum
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://cutt.ly/1yXN2J2
HTTP 301
http://magcpopot.6f.sk/ssss.htm Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 5- https://xdn-ttp.de/lns/import-event-0746?zid=818bb5f6-d249-4e5b-b9d7-db75050d7f66 HTTP 302
- https://lns-ev.xplosion.de/xdn-import/import-event?zid=TpMv%2FvRCarTpzDj4SySJmoJ4qD2yhY91xiin21KczSgplKWWHYFkpf1rfnOLva%2FV&partner=0746
13 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
ssss.htm
magcpopot.6f.sk/ Redirect Chain
|
9 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
components.min.css
accounts.login.idm.telekom.com/oauth2/static/vdplus/css/ |
85 KB 16 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login.css
accounts.login.idm.telekom.com/oauth2/static/vdplus/css/ |
5 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-1.11.3.min.js
accounts.login.idm.telekom.com/oauth2/static/vdplus/js/ |
94 KB 33 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
components.min.js
accounts.login.idm.telekom.com/oauth2/static/vdplus/js/ |
66 KB 21 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login.js
accounts.login.idm.telekom.com/oauth2/static/vdplus/js/ |
8 KB 3 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
import-event
lns-ev.xplosion.de/xdn-import/ Redirect Chain
|
0 217 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
wt
pix.telekom.de/196380495960676/ |
43 B 866 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
telegroteskscreen-regular.woff
accounts.login.idm.telekom.com/oauth2/static/vdplus/fonts/ |
54 KB 54 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
telekomicon-outline.woff
accounts.login.idm.telekom.com/oauth2/static/vdplus/fonts/ |
9 KB 9 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
telegroteskscreen-bold.woff
accounts.login.idm.telekom.com/oauth2/static/vdplus/fonts/ |
53 KB 53 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
telegroteskscreen-thin.woff
accounts.login.idm.telekom.com/oauth2/static/vdplus/fonts/ |
57 KB 58 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
telekomicon-ui.woff
accounts.login.idm.telekom.com/oauth2/static/vdplus/fonts/ |
3 KB 3 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Telekom (Telecommunication)10 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| $ function| jQuery object| Login boolean| loginTrial boolean| accountLocked boolean| accountLockedPermanent number| accountLockExpiration object| jQuery1113032892711801426610 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
accounts.login.idm.telekom.com
cutt.ly
lns-ev.xplosion.de
magcpopot.6f.sk
pix.telekom.de
xdn-ttp.de
185.54.150.52
2003:2:2:140:62:157:140:200
2606:4700:10::6816:1e8
2a00:cd0:104d:1:80:82:200:32
2a01:28:ca:63:120:114::
52.48.182.61
21d4dc49ec496581969051f9f542afee01f9029e7db6112bff99e7be2942de53
345466d497966801ab4b5390c09e49d03f2ede8539bd35a56e25ed15bb2dc80e
398d81bd14d983142b711f0873e4253a7c2c41581f006c529fd9807e184dff37
43493c8fdfe7935a395920ef619a4dc56c440479ce190ad2ac1df8e23acc5595
46ee4054fcdde4283dcd560f28747c1963834e3dbf21905f7bc35f2e84e19e28
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
d9e120fd2798b90e1a4aed8b465d891de4ee81ee43cfc6a417ad2015bd3c6be3
e185aceb03040c947c211bc9e972ce427f11c5801338fd8f943e3b53e229eb3e
e1b1f6b64573c86c3b9f5f023ab7e791a074dbccb87d61e886cb6fa659ba9485
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5a1bef74748388cadf99777549feff118627b888816a6f57fc0fb36e3cad57f
ecb916133a9376911f10bc5c659952eb0031e457f5df367cde560edbfba38fb8
fffefeeecc2fc71642be6dae310057480a6e0a17d9a8ed14a2d9547227d2de5d