www.login-handelmobil.de
Open in
urlscan Pro
217.160.0.65
Malicious Activity!
Public Scan
Submitted URL: https://www.login-handelmobil.de/
Effective URL: https://www.login-handelmobil.de/login/?lang=de&caller=https%3A%2F%2Fhandel.mobile.de%2Fstartseite%2F%3Flang%3Dde
Submission: On July 12 via automatic, source certstream-suspicious — Scanned from DE
Effective URL: https://www.login-handelmobil.de/login/?lang=de&caller=https%3A%2F%2Fhandel.mobile.de%2Fstartseite%2F%3Flang%3Dde
Submission: On July 12 via automatic, source certstream-suspicious — Scanned from DE
Summary
This website contacted 2 IPs
in 1 countries
across 2 domains to perform 16 HTTP transactions.
The main IP is 217.160.0.65, located in
Germany and
belongs to IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE.
The main domain is www.login-handelmobil.de.
TLS certificate: Issued by GeoTrust Global TLS RSA4096 SHA256 20... on July 12th 2022. Valid for: a year.
This is the only time www.login-handelmobil.de was scanned on urlscan.io!
TLS certificate: Issued by GeoTrust Global TLS RSA4096 SHA256 20... on July 12th 2022. Valid for: a year.
This is the only time www.login-handelmobil.de was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: mobile.de (Marketplace)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 9 | 217.160.0.65 217.160.0.65 | 8560 (IONOS-AS ...) (IONOS-AS This is the joint network for IONOS) | |
| 16 | 2 |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 9 |
login-handelmobil.de
1 redirects
www.login-handelmobil.de |
1 MB |
| 0 |
classistatic.de
Failed
static.classistatic.de Failed |
|
| 16 | 2 |
| Domain | Requested by | |
|---|---|---|
| 9 | www.login-handelmobil.de |
1 redirects
www.login-handelmobil.de
|
| 0 | static.classistatic.de Failed |
www.login-handelmobil.de
|
| 16 | 2 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.mobile.de |
| promo.mobile.de |
| login.mobile.de |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| login-handelmobil.de GeoTrust Global TLS RSA4096 SHA256 2022 CA1 |
2022-07-12 - 2023-07-12 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.login-handelmobil.de/login/?lang=de&caller=https%3A%2F%2Fhandel.mobile.de%2Fstartseite%2F%3Flang%3Dde
Frame ID: D08B15555E77A24F49EBF769B3B151FC
Requests: 18 HTTP requests in this frame
Screenshot
Page Title
Händler-LoginPage URL History Show full URLs
-
https://www.login-handelmobil.de/
HTTP 302
https://www.login-handelmobil.de/login/?lang=de&caller=https%3A%2F%2Fhandel.mobile.de%2Fstartseite%2F%3Flang%... Page URL
Page Statistics
4 Outgoing links
These are links going to different origins than the main page.
URL: https://www.mobile.de/
Search URL Search Domain Scan URL
URL: https://promo.mobile.de/b2b/neuigkeiten/tv-spot/?utm_source=b2b_memo&utm_medium=hb_graphic&utm_campaign=service&utm_content=loginplacement_neuer_tv_spot
Search URL Search Domain Scan URL
URL: https://login.mobile.de/a2/request_reset_password?lang=de
Title: Passwort vergessen?
Title: Passwort vergessen?
Search URL Search Domain Scan URL
URL: https://login.mobile.de/registration/index.html
Title: Jetzt registrieren
Title: Jetzt registrieren
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://www.login-handelmobil.de/
HTTP 302
https://www.login-handelmobil.de/login/?lang=de&caller=https%3A%2F%2Fhandel.mobile.de%2Fstartseite%2F%3Flang%3Dde Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
16 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
/
www.login-handelmobil.de/login/ Redirect Chain
|
19 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
3.c3c4e197.chunk.css
www.login-handelmobil.de/files/ |
254 KB 255 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
analytics.js.download
www.login-handelmobil.de/files/ |
48 KB 49 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
Login_Placement_TVSpot@2x.345552c3.jpg
www.login-handelmobil.de/files/ |
174 KB 174 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
runtime-main.7f348386.js.download
www.login-handelmobil.de/files/ |
2 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
2.28976362.chunk.js.download
www.login-handelmobil.de/files/ |
693 KB 694 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
main.8001d676.chunk.js.download
www.login-handelmobil.de/files/ |
48 KB 48 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
ztFKW8B
www.login-handelmobil.de/files/ |
77 KB 77 KB |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
Gibson-Regular-webfont-v2.woff2
static.classistatic.de/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
Gibson-SemiBold-webfont-v2.woff2
static.classistatic.de/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
Gibson-Regular-webfont-v2.woff
static.classistatic.de/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
Gibson-SemiBold-webfont-v2.woff
static.classistatic.de/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
gibson-regular-v4.woff2
static.classistatic.de/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
gibson-bold-v4.woff2
static.classistatic.de/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
gibson-regular-v4.woff
static.classistatic.de/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
gibson-bold-v4.woff
static.classistatic.de/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- static.classistatic.de
- URL
- https://static.classistatic.de/fonts/Gibson-Regular-webfont-v2.woff2
- Domain
- static.classistatic.de
- URL
- https://static.classistatic.de/fonts/Gibson-SemiBold-webfont-v2.woff2
- Domain
- static.classistatic.de
- URL
- https://static.classistatic.de/fonts/Gibson-Regular-webfont-v2.woff
- Domain
- static.classistatic.de
- URL
- https://static.classistatic.de/fonts/Gibson-SemiBold-webfont-v2.woff
- Domain
- static.classistatic.de
- URL
- https://static.classistatic.de/fonts/gibson-regular-v4.woff2
- Domain
- static.classistatic.de
- URL
- https://static.classistatic.de/fonts/gibson-bold-v4.woff2
- Domain
- static.classistatic.de
- URL
- https://static.classistatic.de/fonts/gibson-regular-v4.woff
- Domain
- static.classistatic.de
- URL
- https://static.classistatic.de/fonts/gibson-bold-v4.woff
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: mobile.de (Marketplace)26 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| mobile object| __INITIAL_STATE__ object| google_tag_data function| ga object| gaplugins object| webpackJsonpcommercial-a2-webapp object| _ac object| _cf object| bmak number| bm_counter object| bm_script undefined| scripts string| bm_url object| url_split string| obfus_state_field undefined| state_field_str string| _sd_trace function| op0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
16 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
static.classistatic.de
www.login-handelmobil.de
static.classistatic.de
217.160.0.65
0bfa06e0b73fc953f8ca719845ecdc78a2fdc101085422955443784f067decd8
7923c5df4689d8e2b03d4b24349057eb7415f9d70b6cd91975fd19814b402821
9438113100ff089d191a01c1b464f86963be589cd06c182b0c8b71fc95bd2200
9f4b95b244a872b7788d808d07f036a2eda6e59fedcb8dc82e0948675c23b6fc
a5525b01e2cb53fbe29ccd7c76f40cca19a2f1ccd620ad2ca487f807414591d9
a7845046bf947de055471e898116b665f34f1340482d906fdf8c503f2e1fbfde
a94387020585d27d6a98a7aa3ac8e2ce2d767d403d47c579fd3c139c3beb5c38
b540661ffc92ebda9a09487af326fe13cfe368d95b9c3361d3a9fac5bf5548d9
f4f454904bf19f0078f7c67c3ccbc5c759897631cb28d2cd4edf415cb797ef84
fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62