breakhierarchy.org
Open in
urlscan Pro
142.4.0.32
Malicious Activity!
Public Scan
Effective URL: https://breakhierarchy.org/z/t-online%202/UJSK374KJD/login.php?KcPF0L4DzddzPays8ayP3G5nSjjsg2O1PeB89wApymVS9NlrqmgGUnqusq4m...
Submission: On July 04 via api from US — Scanned from DE
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on June 26th 2024. Valid for: 3 months.
This is the only time breakhierarchy.org was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Telekom (Telecommunication)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 192.185.182.214 192.185.182.214 | 19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING) | |
2 11 | 142.4.0.32 142.4.0.32 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
10 | 2003:2:2:140:... 2003:2:2:140:62:157:140:200 | 3320 (DTAG Inte...) (DTAG Internet service provider operations) | |
20 | 3 |
ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: 192-185-182-214.unifiedlayer.com
ra.pulverizer.in |
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 142-4-0-32.unifiedlayer.com
breakhierarchy.org |
ASN3320 (DTAG Internet service provider operations, DE)
accounts.login.idm.telekom.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
breakhierarchy.org
2 redirects
breakhierarchy.org |
352 KB |
10 |
telekom.com
accounts.login.idm.telekom.com — Cisco Umbrella Rank: 71839 Failed |
|
1 |
pulverizer.in
1 redirects
ra.pulverizer.in |
117 B |
20 | 3 |
Domain | Requested by | |
---|---|---|
11 | breakhierarchy.org |
2 redirects
breakhierarchy.org
|
10 | accounts.login.idm.telekom.com |
breakhierarchy.org
|
1 | ra.pulverizer.in | 1 redirects |
20 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.telekom.de |
Subject Issuer | Validity | Valid | |
---|---|---|---|
breakhierarchy.org cPanel, Inc. Certification Authority |
2024-06-26 - 2024-09-24 |
3 months | crt.sh |
accounts.login.idm.telekom.com Telekom Security ServerID OV Class 2 CA |
2024-06-26 - 2025-06-30 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://breakhierarchy.org/z/t-online%202/UJSK374KJD/login.php?KcPF0L4DzddzPays8ayP3G5nSjjsg2O1PeB89wApymVS9NlrqmgGUnqusq4m1Wghpi6W2bX0cObUk9Fw
Frame ID: 9461CF4C92E1A197E3FF6E72ABBC1B62
Requests: 20 HTTP requests in this frame
Screenshot
Page Title
Telekom LoginPage URL History Show full URLs
-
http://ra.pulverizer.in/
HTTP 307
https://ra.pulverizer.in/ HTTP 301
https://breakhierarchy.org/z/t-online%202/UJSK374KJD HTTP 301
https://breakhierarchy.org/z/t-online%202/UJSK374KJD/ HTTP 302
https://breakhierarchy.org/z/t-online%202/UJSK374KJD/login.php?KcPF0L4DzddzPays8ayP3G5nSjjsg2O1PeB89wAp... Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: hier
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://ra.pulverizer.in/
HTTP 307
https://ra.pulverizer.in/ HTTP 301
https://breakhierarchy.org/z/t-online%202/UJSK374KJD HTTP 301
https://breakhierarchy.org/z/t-online%202/UJSK374KJD/ HTTP 302
https://breakhierarchy.org/z/t-online%202/UJSK374KJD/login.php?KcPF0L4DzddzPays8ayP3G5nSjjsg2O1PeB89wApymVS9NlrqmgGUnqusq4m1Wghpi6W2bX0cObUk9Fw Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 5- https://login.t-online.de/stats/t-online-logo-29112019.png HTTP 301
- https://www.t-online.de/auth/ HTTP 302
- https://www.t-online.de/auth/oauth2/authorization/telekom HTTP 302
- https://accounts.login.idm.telekom.com/oauth2/auth?response_type=code&client_id=10LIVESAM30000004901PORTALE2000000000000&scope=openid&state=OuSV4f30i6aC5kpEfApN4GVPA_O1EnPLPPFLplC02xc%3D&redirect_uri=https://www.t-online.de/auth/login/oauth2/code/telekom&nonce=Zk-OC_xAciOWL4pDyvDgdqgf17lkfcTHoqymFoEMAMU&display=popup&claims=%7B%22id_token%22:%7B%22urn:telekom.com:all%22:null%7D%7D%0A
20 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
login.php
breakhierarchy.org/z/t-online%202/UJSK374KJD/ Redirect Chain
|
8 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
components.min.css
breakhierarchy.org/z/t-online%202/UJSK374KJD/assets/ |
99 KB 99 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login-20.26.0.css
breakhierarchy.org/z/t-online%202/UJSK374KJD/assets/ |
14 KB 14 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-3.2.1.min.js
breakhierarchy.org/z/t-online%202/UJSK374KJD/assets/ |
85 KB 85 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
components.min.js
breakhierarchy.org/z/t-online%202/UJSK374KJD/assets/ |
76 KB 76 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login.js
breakhierarchy.org/z/t-online%202/UJSK374KJD/assets/ |
11 KB 12 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
auth
accounts.login.idm.telekom.com/oauth2/ Redirect Chain
|
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
services.png
breakhierarchy.org/z/t-online%202/UJSK374KJD/assets/ |
22 KB 22 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
data_protection.svg
breakhierarchy.org/static/factorx/vdplus/images/ |
0 186 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
teleicon-outline.woff
accounts.login.idm.telekom.com/static/factorx/vdplus/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
telegroteskscreen-ultra.woff
accounts.login.idm.telekom.com/static/factorx/vdplus/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
telegroteskscreen-regular.woff
accounts.login.idm.telekom.com/static/factorx/vdplus/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
telegroteskscreen-thin.woff
accounts.login.idm.telekom.com/static/factorx/vdplus/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
teleicon-ui.woff
accounts.login.idm.telekom.com/static/factorx/vdplus/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
teleicon-outline.ttf
accounts.login.idm.telekom.com/static/factorx/vdplus/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
telegroteskscreen-ultra.ttf
accounts.login.idm.telekom.com/static/factorx/vdplus/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
teleicon-ui.ttf
accounts.login.idm.telekom.com/static/factorx/vdplus/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
telegroteskscreen-regular.ttf
accounts.login.idm.telekom.com/static/factorx/vdplus/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
telegroteskscreen-thin.ttf
accounts.login.idm.telekom.com/static/factorx/vdplus/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
favicon.png
breakhierarchy.org/z/t-online%202/UJSK374KJD/assets/ |
34 KB 34 KB |
Other
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- accounts.login.idm.telekom.com
- URL
- https://accounts.login.idm.telekom.com/oauth2/auth?response_type=code&client_id=10LIVESAM30000004901PORTALE2000000000000&scope=openid&state=OuSV4f30i6aC5kpEfApN4GVPA_O1EnPLPPFLplC02xc%3D&redirect_uri=https://www.t-online.de/auth/login/oauth2/code/telekom&nonce=Zk-OC_xAciOWL4pDyvDgdqgf17lkfcTHoqymFoEMAMU&display=popup&claims=%7B%22id_token%22:%7B%22urn:telekom.com:all%22:null%7D%7D%0A
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Telekom (Telecommunication)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
undefined| event object| fence object| sharedStorage function| $ function| jQuery object| Login4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
www.t-online.de/auth | Name: T_SID Value: MTZlODlhMTEtMGRlNy00Mjg5LTlhMzAtNWU5ODcxZmZhZDgy |
|
breakhierarchy.org/ | Name: PHPSESSID Value: 1535047b778ef8ca963635e12c686a4e |
|
accounts.login.idm.telekom.com/ | Name: CC Value: CgRrZXkxEhQZ1C5K5mU-cMPvNRMiBEWfSP3QfxqwAfO4Ncb6mlsKRiCHgKUycaaHFwAQXfsLP6xuthlzaR-FrP7jucwca0uALG2rk8gSgm3_8wrPhOzE8froZhRzotBddfAfCiW0FPMmKm6gTkgmggB_k4vn02CktzJY9j6skIdzpUnzquvHzxEhdqV_PS-Y0WBn61OfOQrQUO8LUTbijpbfZDRLquqxOSQyDnNWVldWNwA5SaN6j3dzT3_5-p7zKqcHxOt-hQ-6eyzJHJsK |
|
accounts.login.idm.telekom.com/ | Name: FI3ed5eb60-3a56-11ef-9487-ab91ccec47ad Value: CgRrZXkxEhQyEft88z3jxCU8vqaq27zrLy6AVxqwARl662B4MAkB7Vy8w0f8hhY7vtCJanGWzmCEhalsuwZZfeS8Ep9GvAHGAwis9vgePv8jF0UHjImC8ow7C4X4j9x3nLBGXuZKJeDxOR06M8tm6k4TTo8bJ6TNt354362i-_EQJ130lxXkUlo-I8Z53gvLoHWXtyDjsAi4Eg-U1OkxoZfGqTYGmWtsAs9v3WyN63-vIuc9QkVqAMeS994oKTci0KTHJI99QEzFYOKyYn3A |
11 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
accounts.login.idm.telekom.com
breakhierarchy.org
ra.pulverizer.in
accounts.login.idm.telekom.com
142.4.0.32
192.185.182.214
2003:2:2:140:62:157:140:200
0b4610a14f6829fdc2cca2ed0aa4aa1a1825c4415be0d64bf53cc8e86f92848c
14977cb7057352ad7715b93dec52f4993fc16980836d03b64f79566e8c9bec22
42d274b3c3f7c6565c2f3cc9b009770f143ceca121b91bc25f844f7040f18c94
61524aa76330a1046312d9641fa9230e6c7f9c21bac2d0aaa4150d59c10079bf
638b895638b74a68f11696db4b1210e91fdd0219307d8e2263bbd519f90565a6
87fe47697ddaf5379772c48a8487ef835080417c9c434c4ecd2733af356d8f16
8fb4dacc85198fcdab2b59b4b744d2c125a79e0ffd39f34cfe2593bfbd2ddea0
d3a518dea876de39f9e5dc1ffcdeb6c661aee25d8a62474386b664ef3bf1b40f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855