gunt-meir.de
Open in
urlscan Pro
217.160.0.217
Malicious Activity!
Public Scan
Effective URL: https://gunt-meir.de/offer/view/AuthRedirect?reqinput=z/NLGRxZFwhl2RC9RA0aE+HepCxhwicEtgBRvGRvrkN5omlwEM5ssnsx4ks0PGE...
Submission: On November 14 via manual from US — Scanned from GB
Summary
TLS certificate: Issued by GeoTrust TLS RSA CA G1 on October 6th 2023. Valid for: a year.
This is the only time gunt-meir.de was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: eBay (E-commerce)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 | 217.160.0.187 217.160.0.187 | 8560 (IONOS-AS ...) (IONOS-AS This is the joint network for IONOS) | |
| 1 | 217.160.0.217 217.160.0.217 | 8560 (IONOS-AS ...) (IONOS-AS This is the joint network for IONOS) | |
| 2 | 3 |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 1 |
gunt-meir.de
gunt-meir.de |
199 KB |
| 1 |
jnsk7wlk.de
jnsk7wlk.de |
382 B |
| 2 | 2 |
| Domain | Requested by | |
|---|---|---|
| 1 | gunt-meir.de |
jnsk7wlk.de
|
| 1 | jnsk7wlk.de | |
| 2 | 2 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| signin.ebay.co.uk |
| signup.ebay.co.uk |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| jnsk7wlk.de GeoTrust TLS RSA CA G1 |
2023-10-18 - 2024-10-17 |
a year | crt.sh |
| gunt-meir.de GeoTrust TLS RSA CA G1 |
2023-10-06 - 2024-10-05 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://gunt-meir.de/offer/view/AuthRedirect?reqinput=z/NLGRxZFwhl2RC9RA0aE+HepCxhwicEtgBRvGRvrkN5omlwEM5ssnsx4ks0PGEl1LIsGBfWJ5CDm1Z7ir7XPzIlOEB8UPgys51/Y55giFTD7dxd5wCMc5c1+3WA98mwXd55/d8s5acwO77M+uJIhg==
Frame ID: 93B1B9D1B2EA9EAA37D1297202A5B29F
Requests: 6 HTTP requests in this frame
Screenshot
Page Title
Error page | eBayPage URL History Show full URLs
- https://jnsk7wlk.de/s/9zhSQLdt5W Page URL
- https://gunt-meir.de/offer/view/AuthRedirect?reqinput=z/NLGRxZFwhl2RC9RA0aE+HepCxhwicEtgBRvGRvrkN... Page URL
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
Title: Sign in
Search URL Search Domain Scan URL
Title: register
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://jnsk7wlk.de/s/9zhSQLdt5W Page URL
- https://gunt-meir.de/offer/view/AuthRedirect?reqinput=z/NLGRxZFwhl2RC9RA0aE+HepCxhwicEtgBRvGRvrkN5omlwEM5ssnsx4ks0PGEl1LIsGBfWJ5CDm1Z7ir7XPzIlOEB8UPgys51/Y55giFTD7dxd5wCMc5c1+3WA98mwXd55/d8s5acwO77M+uJIhg== Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
2 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
9zhSQLdt5W
jnsk7wlk.de/s/ |
248 B 382 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
Primary Request
AuthRedirect
gunt-meir.de/offer/view/ |
530 KB 199 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
5 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
448 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
725 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: eBay (E-commerce)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture object| onorientationchange number| orientation0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
gunt-meir.de
jnsk7wlk.de
217.160.0.187
217.160.0.217
1b3c84dc67fbaa659cd41ef4f90978cdc64ee8e7afa4410ee56b55652acd6263
4a94f4329afbaced71c7ced387951cd0a58194ae87dd2249fec852bf3cf19038
4bf4c0ef8a5e153d99d0018c3742227e66a94f297fef26abbf8b7f07f57b6e44
5440e48584e47738479ccd905576e9ddf2097d07b6c7ba81dda6eeb13b1d4af0
5b530c6afca30b3fdb62764134a87c6535bd1092e65d2f8e422e995373928286