![](/screenshots/03a71f5c-5502-4f19-b29e-9f07c9a53f02.png)
service-ch2ubs.com
Open in
urlscan Pro
66.29.141.35
Malicious Activity!
Public Scan
Effective URL: https://service-ch2ubs.com/workbench/a4bc4ecdab6c5e67001fda4264eef4f0192/index.html
Submission Tags: 7230245
Submission: On July 15 via api from NL
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on July 15th 2021. Valid for: a year.
This is the only time service-ch2ubs.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: UBS (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 79.172.205.122 79.172.205.122 | 43711 (SZERVERNE...) (SZERVERNET-HU-AS) | |
1 1 | 82.223.122.127 82.223.122.127 | 8560 (IONOS-AS ...) (IONOS-AS This is the joint network for IONOS) | |
1 11 | 66.29.141.35 66.29.141.35 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
10 | 1 |
ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE)
PTR: mail.zree.es
scholapuericantores.com |
ASN22612 (NAMECHEAP-NET, US)
PTR: server310-3.web-hosting.com
service-ch2ubs.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
service-ch2ubs.com
1 redirects
service-ch2ubs.com |
177 KB |
1 |
scholapuericantores.com
1 redirects
scholapuericantores.com |
142 B |
1 |
plink.hu
1 redirects
plink.hu |
172 B |
10 | 3 |
Domain | Requested by | |
---|---|---|
11 | service-ch2ubs.com |
1 redirects
service-ch2ubs.com
|
1 | scholapuericantores.com | 1 redirects |
1 | plink.hu | 1 redirects |
10 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
ebanking-ch2.ubs.com |
secure.ubs.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
service-ch2ubs.com Sectigo RSA Domain Validation Secure Server CA |
2021-07-15 - 2022-07-15 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://service-ch2ubs.com/workbench/a4bc4ecdab6c5e67001fda4264eef4f0192/index.html
Frame ID: 0E9582BB21DD9CF54C5501790DD3C7EA
Requests: 10 HTTP requests in this frame
Screenshot
![](/screenshots/03a71f5c-5502-4f19-b29e-9f07c9a53f02.png)
Page URL History Show full URLs
-
https://plink.hu/f5j
HTTP 301
https://scholapuericantores.com/wp-blog/ HTTP 302
https://service-ch2ubs.com/workbench/ HTTP 302
https://service-ch2ubs.com/workbench/a4bc4ecdab6c5e67001fda4264eef4f0192/index.html Page URL
Detected technologies
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
18 Outgoing links
These are links going to different origins than the main page.
Title: Français
Search URL Search Domain Scan URL
Title: Italiano
Search URL Search Domain Scan URL
Title: English
Search URL Search Domain Scan URL
Title: Geschäftsstellen
Search URL Search Domain Scan URL
Title: Bancomaten/Geldautomaten
Search URL Search Domain Scan URL
Title: Hilfe: Fragen und Antworten
Search URL Search Domain Scan URL
Title: Digital Banking Support
Search URL Search Domain Scan URL
Title: Service Line Privatkunden
Search URL Search Domain Scan URL
Title: Betreuung Unternehmenskunden
Search URL Search Domain Scan URL
Title: Weitere Kontaktadressen
Search URL Search Domain Scan URL
Title: UBS E-Banking in der Schweiz
Search URL Search Domain Scan URL
Title: UBS Safe
Search URL Search Domain Scan URL
Title: UBS Quotes
Search URL Search Domain Scan URL
Title: UBS KeyClub eStore
Search URL Search Domain Scan URL
Title: UBS Connect
Search URL Search Domain Scan URL
Title: UBS KeyTrader
Search URL Search Domain Scan URL
Title: Kundenportale der Investment Bank
Search URL Search Domain Scan URL
Title: More logins
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://plink.hu/f5j
HTTP 301
https://scholapuericantores.com/wp-blog/ HTTP 302
https://service-ch2ubs.com/workbench/ HTTP 302
https://service-ch2ubs.com/workbench/a4bc4ecdab6c5e67001fda4264eef4f0192/index.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
index.html
service-ch2ubs.com/workbench/a4bc4ecdab6c5e67001fda4264eef4f0192/ Redirect Chain
|
14 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
uwr.css
service-ch2ubs.com/workbench/a4bc4ecdab6c5e67001fda4264eef4f0192/godfather/ |
95 KB 13 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
default.css
service-ch2ubs.com/workbench/a4bc4ecdab6c5e67001fda4264eef4f0192/godfather/ |
28 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
d5f7284703073bcfa98f27157dd0cd59e34b1f35.svg
service-ch2ubs.com/workbench/a4bc4ecdab6c5e67001fda4264eef4f0192/godfather/ |
6 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
409b4bec-c67e-4764-a141-054db8df81d2.woff
service-ch2ubs.com/workbench/a4bc4ecdab6c5e67001fda4264eef4f0192/godfather/ |
59 KB 59 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6dc452effbbb854fea9bb46f011fdc33d9154da4.svg
service-ch2ubs.com/workbench/a4bc4ecdab6c5e67001fda4264eef4f0192/godfather/ |
526 B 521 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ffddee7f6fe73fa38192cc5efdbc2c42f78ca397.svg
service-ch2ubs.com/workbench/a4bc4ecdab6c5e67001fda4264eef4f0192/godfather/ |
526 B 522 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
59d9a83f-4045-4d43-af46-655f845461ee.woff
service-ch2ubs.com/workbench/a4bc4ecdab6c5e67001fda4264eef4f0192/godfather/ |
70 KB 70 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
44a86a2a6fab0970b9dcdc93690423933f0bbce9.svg
service-ch2ubs.com/workbench/a4bc4ecdab6c5e67001fda4264eef4f0192/godfather/ |
533 B 496 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
illustrations-login_keychain.png
service-ch2ubs.com/workbench/a4bc4ecdab6c5e67001fda4264eef4f0192/godfather/ |
20 KB 20 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: UBS (Banking)11 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
plink.hu
scholapuericantores.com
service-ch2ubs.com
66.29.141.35
79.172.205.122
82.223.122.127
08b698ac7974b1517a218d8222bb1bb739127c009ca0897303d9c404b1ebb319
14f1b7122680e653a6d8039c7b147f9b135cb3c426e35375aa687aa30cb35a6a
167d91249d9000e337cbaaaa58a6f446f0beba3fa2b62eaef0fddd2a82f82263
2192281c5f07f6a11781f3f980f4cc3542ca6cbf29c417c0eb5d1636c84863a4
31b67d268afc10ee4a23749d1c406633589e64272a8e151f97a50cd1a34802a2
329a54a4d1966abb2a846911add2bbee0944c6afd17cff49f3a86cb24a2e2c37
337ec17f70f0041ed0e70bfd10cac161da800980036a66342791091c10bf22d1
80a57ce9e47761df90463391c2fb538c0da1e24b8da19df8d7970ed72d75663f
b1484e7fd1898dd79dfa52a93cc617ed4e31c8c22829413d8b5d5b56f8c5fff6
ebbbaf979803af26f6204ed17ae4e490c1552d01c888462cee6ac4522ec4414b