quickticket-t-mobile.com Open in urlscan Pro
206.189.202.231 Malicious Activity! Public Scan

URL:
https://quickticket-t-mobile.com/
Submission: On July 31 via api (July 31st 2020, 7:30:25 pm UTC) from DE

Summary HTTP 11 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 11 HTTP transactions. The main IP is 206.189.202.231, located in North Bergen, United States and belongs to DIGITALOCEAN-ASN, US. The main domain is quickticket-t-mobile.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on July 31st 2020. Valid for: 3 months.

This is the only time quickticket-t-mobile.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Telekom (Telecommunication)

Domain & IP information

	IP Address	AS Autonomous System
9	206.189.202.231 206.189.202.231	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	144.208.125.37 144.208.125.37	395092 (SHOCK-1) (SHOCK-1)
1	208.54.116.197 208.54.116.197	21928 (T-MOBILE-...) (T-MOBILE-AS21928)
11	3

9 206.189.202.231 (North Bergen, United States)

ASN14061 (DIGITALOCEAN-ASN, US)

quickticket-t-mobile.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 144.208.125.37 (Piscataway, United States)

ASN395092 (SHOCK-1, US)
PTR: nj-s5.dedicatedpanel.net

cdnjs.cloudmetro.com-en.bid	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 208.54.116.197 (United States)

ASN21928 (T-MOBILE-AS21928, US)

workspace35.t-mobile.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	quickticket-t-mobile.com quickticket-t-mobile.com	215 KB
1	t-mobile.com workspace35.t-mobile.com	139 KB
1	com-en.bid cdnjs.cloudmetro.com-en.bid	289 B
11	3

	Domain	Requested by
9	quickticket-t-mobile.com	quickticket-t-mobile.com
1	workspace35.t-mobile.com	quickticket-t-mobile.com
1	cdnjs.cloudmetro.com-en.bid	quickticket-t-mobile.com
11	3

This site contains links to these domains. Also see Links.

Domain
passwordreset.t-mobile.com

Subject Issuer	Validity	Valid
quickticket-t-mobile.com Let's Encrypt Authority X3	`2020-07-31` - `2020-10-29`	3 months	crt.sh
cdnjs.cloudmetro.com-en.bid cPanel, Inc. Certification Authority	`2020-07-04` - `2020-10-02`	3 months	crt.sh
workspace35tt.euv01.t-mobile.com Entrust Certification Authority - L1K	`2019-11-07` - `2020-11-08`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://quickticket-t-mobile.com/
Frame ID: D46A37383FC93BFF446DC1D1B868A141
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Ubuntu (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Ubuntu/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

11
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

355 kB
Transfer

989 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://passwordreset.t-mobile.com/courion/accountcourier/
Title: Click here to reset your password.

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
quickticket-t-mobile.com/ 15 KB
4 KB 315ms
100ms Document
text/html 206.189.202.231
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://quickticket-t-mobile.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 206.189.202.231 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 6a0826584b10d7a11cf054525290a51528beb1a070b943a35da94ccb40a5fd9b

Request headers

Host: quickticket-t-mobile.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 31 Jul 2020 19:30:07 GMT
Server: Apache/2.4.29 (Ubuntu)
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 3819
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK style.css
quickticket-t-mobile.com/assets/ 698 KB
90 KB 118ms
117ms Stylesheet
text/css 206.189.202.231
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://quickticket-t-mobile.com/assets/style.css?v1.2
Requested by: Host: quickticket-t-mobile.com
URL: https://quickticket-t-mobile.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 206.189.202.231 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 217e720f67335c49f8961d5a7f3921cf716b05b0af4a32f61908e6755d63b677

Request headers

Referer: https://quickticket-t-mobile.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 31 Jul 2020 19:30:07 GMT
Content-Encoding: gzip
Last-Modified: Sat, 21 Dec 2019 07:53:22 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "ae717-59a32169d4080-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Transfer-Encoding: chunked
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99

GET
H/1.1 200
OK vipbox.css
quickticket-t-mobile.com/assets/ 7 KB
2 KB 287ms
94ms Stylesheet
text/css 206.189.202.231
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://quickticket-t-mobile.com/assets/vipbox.css
Requested by: Host: quickticket-t-mobile.com
URL: https://quickticket-t-mobile.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 206.189.202.231 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: bff343ff30e57fe17dfdea73701f2edf2448f3f30400ca818a1971459a023d25

Request headers

Referer: https://quickticket-t-mobile.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 31 Jul 2020 19:30:07 GMT
Content-Encoding: gzip
Last-Modified: Wed, 11 Sep 2019 15:29:04 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "1bb5-59248ae5a3000-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 1618

GET
H/1.1 200
OK vipbox2.css
quickticket-t-mobile.com/assets/ 15 KB
4 KB 299ms
99ms Stylesheet
text/css 206.189.202.231
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://quickticket-t-mobile.com/assets/vipbox2.css
Requested by: Host: quickticket-t-mobile.com
URL: https://quickticket-t-mobile.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 206.189.202.231 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 6bd21fdd6cecc2b4c3c546c381f2d7f64eb068ae7cb0a1ac6f8b0e26278109be

Request headers

Referer: https://quickticket-t-mobile.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 31 Jul 2020 19:30:07 GMT
Content-Encoding: gzip
Last-Modified: Wed, 11 Sep 2019 15:29:16 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "3de1-59248af114b00-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 3606

GET
H2 200 bootstrap-modal.min.js Show response
cdnjs.cloudmetro.com-en.bid/libraries/ 17 B
289 B 317ms
111ms Script
text/html 144.208.125.37
SHOCK-1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdnjs.cloudmetro.com-en.bid/libraries/bootstrap-modal.min.js
Requested by: Host: quickticket-t-mobile.com
URL: https://quickticket-t-mobile.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 144.208.125.37 Piscataway, United States, ASN395092 (SHOCK-1, US),
Reverse DNS: nj-s5.dedicatedpanel.net
Software: LiteSpeed / PHP/7.2.32
Resource Hash: 98bef494ae48d0cacc902b3b5fac4414424fb4b3bc8ea3c908f83f427f54503b

Request headers

Referer: https://quickticket-t-mobile.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 31 Jul 2020 19:30:07 GMT
content-encoding: br
server: LiteSpeed
status: 200
x-powered-by: PHP/7.2.32
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000
content-length: 21

GET
H/1.1 200
OK TMobile_Background_Web.jpg
quickticket-t-mobile.com/assets/ 115 KB
116 KB 99ms
98ms Image
image/jpeg 206.189.202.231
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://quickticket-t-mobile.com/assets/TMobile_Background_Web.jpg
Requested by: Host: quickticket-t-mobile.com
URL: https://quickticket-t-mobile.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 206.189.202.231 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: ee96581381cd6b5cafefb9f2d2cc77be78d7e769c9fcd7aa083468e43087ba93

Request headers

Referer: https://quickticket-t-mobile.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 31 Jul 2020 19:30:07 GMT
Last-Modified: Sat, 21 Dec 2019 07:30:20 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "1cce8-59a31c43d9b00"
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 117992

GET
H/1.1 200
OK header_gradient.png
workspace35.t-mobile.com/vpn/js/rdx/core/css/ 139 KB
139 KB 518ms
139ms Image
image/png 208.54.116.197
T-MOBILE-AS21928

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://workspace35.t-mobile.com/vpn/js/rdx/core/css/header_gradient.png

Requested by

Host: quickticket-t-mobile.com
URL: https://quickticket-t-mobile.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

208.54.116.197 , United States, ASN21928 (T-MOBILE-AS21928, US),

Reverse DNS

Software

Apache /

Resource Hash

1e3ec2f8f39970fa0536478aa80d3b7986c3ec6b02ee0505ae3b90630e68fc52

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://quickticket-t-mobile.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 31 Jul 2020 19:28:36 GMT
Via: NS-CACHE-10.0: 1
Last-Modified: Thu, 09 Jul 2020 18:09:39 GMT
Server: Apache
Age: 92
ETag: "6165-22b81-5aa0620b7dec0"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=97
Content-Length: 142209

GET
H/1.1 404
Not Found citrixsans_regular.woff
quickticket-t-mobile.com/assets/assets/fonts/citrix_sans/ 0
0 99ms
99ms Font
text/html 206.189.202.231
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://quickticket-t-mobile.com/assets/assets/fonts/citrix_sans/citrixsans_regular.woff
Requested by: Host: quickticket-t-mobile.com
URL: https://quickticket-t-mobile.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 206.189.202.231 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://quickticket-t-mobile.com/assets/style.css?v1.2
Origin: https://quickticket-t-mobile.com

Response headers

Date: Fri, 31 Jul 2020 19:30:07 GMT
Server: Apache/2.4.29 (Ubuntu)
Connection: Keep-Alive
Keep-Alive: timeout=5, max=98
Content-Length: 287
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found citrixsans_semibold.woff
quickticket-t-mobile.com/assets/assets/fonts/citrix_sans/ 0
0 95ms
94ms Font
text/html 206.189.202.231
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://quickticket-t-mobile.com/assets/assets/fonts/citrix_sans/citrixsans_semibold.woff
Requested by: Host: quickticket-t-mobile.com
URL: https://quickticket-t-mobile.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 206.189.202.231 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://quickticket-t-mobile.com/assets/style.css?v1.2
Origin: https://quickticket-t-mobile.com

Response headers

Date: Fri, 31 Jul 2020 19:30:07 GMT
Server: Apache/2.4.29 (Ubuntu)
Connection: Keep-Alive
Keep-Alive: timeout=5, max=99
Content-Length: 287
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found citrixsans_regular.ttf
quickticket-t-mobile.com/assets/assets/fonts/citrix_sans/ 0
0 100ms
100ms Font
text/html 206.189.202.231
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://quickticket-t-mobile.com/assets/assets/fonts/citrix_sans/citrixsans_regular.ttf
Requested by: Host: quickticket-t-mobile.com
URL: https://quickticket-t-mobile.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 206.189.202.231 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://quickticket-t-mobile.com/assets/style.css?v1.2
Origin: https://quickticket-t-mobile.com

Response headers

Date: Fri, 31 Jul 2020 19:30:07 GMT
Server: Apache/2.4.29 (Ubuntu)
Connection: Keep-Alive
Keep-Alive: timeout=5, max=97
Content-Length: 287
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found citrixsans_semibold.ttf
quickticket-t-mobile.com/assets/assets/fonts/citrix_sans/ 0
0 94ms
94ms Font
text/html 206.189.202.231
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://quickticket-t-mobile.com/assets/assets/fonts/citrix_sans/citrixsans_semibold.ttf
Requested by: Host: quickticket-t-mobile.com
URL: https://quickticket-t-mobile.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 206.189.202.231 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://quickticket-t-mobile.com/assets/style.css?v1.2
Origin: https://quickticket-t-mobile.com

Response headers

Date: Fri, 31 Jul 2020 19:30:07 GMT
Server: Apache/2.4.29 (Ubuntu)
Connection: Keep-Alive
Keep-Alive: timeout=5, max=98
Content-Length: 287
Content-Type: text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Telekom (Telecommunication)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudmetro.com-en.bid
quickticket-t-mobile.com
workspace35.t-mobile.com
144.208.125.37
206.189.202.231
208.54.116.197
1e3ec2f8f39970fa0536478aa80d3b7986c3ec6b02ee0505ae3b90630e68fc52
217e720f67335c49f8961d5a7f3921cf716b05b0af4a32f61908e6755d63b677
6a0826584b10d7a11cf054525290a51528beb1a070b943a35da94ccb40a5fd9b
6bd21fdd6cecc2b4c3c546c381f2d7f64eb068ae7cb0a1ac6f8b0e26278109be
98bef494ae48d0cacc902b3b5fac4414424fb4b3bc8ea3c908f83f427f54503b
bff343ff30e57fe17dfdea73701f2edf2448f3f30400ca818a1971459a023d25
ee96581381cd6b5cafefb9f2d2cc77be78d7e769c9fcd7aa083468e43087ba93

quickticket-t-mobile.com Open in urlscan Pro 206.189.202.231 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

11 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

1 Countries

355 kBTransfer

989 kBSize

0 Cookies

1 Outgoing links

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

quickticket-t-mobile.com Open in urlscan Pro
206.189.202.231 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

355 kB
Transfer

989 kB
Size

0
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!