login.sso.bluewin.ch
Open in
urlscan Pro
195.186.145.195
Malicious Activity!
Public Scan
Effective URL: https://login.sso.bluewin.ch/login?SNA=sam&keepLogin=true&RURL=https%3A%2F%2Fwww.swisscom.ch%2Fsam%2Fonline%2Fapp%2FDocument%...
Submission: On February 19 via manual from SG
Summary
TLS certificate: Issued by SwissSign EV Gold CA 2014 - G22 on March 21st 2018. Valid for: 2 years.
This is the only time login.sso.bluewin.ch was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Swisscom (Telecommunication)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 195.186.145.42 195.186.145.42 | 3303 (SWISSCOM ...) (SWISSCOM Swisscom (Switzerland) Ltd) | |
2 2 | 2a02:a90:c400... 2a02:a90:c400:5001::2 | 12429 (CYBERNET-) (CYBERNET-) | |
1 1 | 2a02:a90:c400... 2a02:a90:c400:4001::2 | 12429 (CYBERNET-) (CYBERNET-) | |
7 | 195.186.145.195 195.186.145.195 | 3303 (SWISSCOM ...) (SWISSCOM Swisscom (Switzerland) Ltd) | |
6 | 195.186.196.30 195.186.196.30 | 3303 (SWISSCOM ...) (SWISSCOM Swisscom (Switzerland) Ltd) | |
13 | 2 |
ASN3303 (SWISSCOM Swisscom (Switzerland) Ltd, CH)
PTR: samzhh.sso.bluewin.ch
sam.sso.bluewin.ch |
ASN3303 (SWISSCOM Swisscom (Switzerland) Ltd, CH)
login.sso.bluewin.ch |
ASN3303 (SWISSCOM Swisscom (Switzerland) Ltd, CH)
login.sso.bluewin.ch |
Apex Domain Subdomains |
Transfer | |
---|---|---|
14 |
bluewin.ch
1 redirects
sam.sso.bluewin.ch login.sso.bluewin.ch |
404 KB |
3 |
swisscom.ch
3 redirects
www1.swisscom.ch www.swisscom.ch |
2 KB |
13 | 2 |
Domain | Requested by | |
---|---|---|
13 | login.sso.bluewin.ch |
login.sso.bluewin.ch
|
2 | www.swisscom.ch | 2 redirects |
1 | www1.swisscom.ch | 1 redirects |
1 | sam.sso.bluewin.ch | 1 redirects |
13 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
registration.scl.swisscom.ch |
www.swisscom.ch |
Subject Issuer | Validity | Valid | |
---|---|---|---|
login.sso.bluewin.ch SwissSign EV Gold CA 2014 - G22 |
2018-03-21 - 2020-03-21 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://login.sso.bluewin.ch/login?SNA=sam&keepLogin=true&RURL=https%3A%2F%2Fwww.swisscom.ch%2Fsam%2Fonline%2Fapp%2FDocument%3Flogin%26nevistokenconsume&L=en&pps=desktop
Frame ID: D816C9EDA97E9BF000F9588EF0E320CD
Requests: 13 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://sam.sso.bluewin.ch/my/data/Document
HTTP 301
https://www1.swisscom.ch/sam/online/app/Document HTTP 302
https://www.swisscom.ch/sam/online/app/Document HTTP 302
https://www.swisscom.ch/sam/online/app/Document?login HTTP 302
https://login.sso.bluewin.ch/login?SNA=sam&keepLogin=true&RURL=https%3A%2F%2Fwww.swisscom.ch%2Fsam%2Fonli... Page URL
Detected technologies
TweenMax (JavaScript Frameworks) ExpandDetected patterns
- env /^TweenMax$/i
Modernizr (JavaScript Libraries) Expand
Detected patterns
- env /^Modernizr$/i
Page Statistics
4 Outgoing links
These are links going to different origins than the main page.
Title: Register
Search URL Search Domain Scan URL
Title: Using Mobile ID
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title: About Swisscom Login
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://sam.sso.bluewin.ch/my/data/Document
HTTP 301
https://www1.swisscom.ch/sam/online/app/Document HTTP 302
https://www.swisscom.ch/sam/online/app/Document HTTP 302
https://www.swisscom.ch/sam/online/app/Document?login HTTP 302
https://login.sso.bluewin.ch/login?SNA=sam&keepLogin=true&RURL=https%3A%2F%2Fwww.swisscom.ch%2Fsam%2Fonline%2Fapp%2FDocument%3Flogin%26nevistokenconsume&L=en&pps=desktop Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
13 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
Cookie set
login
login.sso.bluewin.ch/ Redirect Chain
|
8 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Cookie set
sdx.min.css
login.sso.bluewin.ch/resources/sdx/css/ |
307 KB 39 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Cookie set
nwmain.css
login.sso.bluewin.ch/resources/styles/ |
9 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sam.png;jsessionid=040AC0EC3D79FB135D0862820A123BF3
login.sso.bluewin.ch/resources/images/relying-party/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
all.js
login.sso.bluewin.ch/resources/scripts/ |
98 KB 33 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Cookie set
critical.js
login.sso.bluewin.ch/resources/scripts/ |
17 KB 7 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Cookie set
sdx.min.js
login.sso.bluewin.ch/resources/sdx/js/ |
339 KB 92 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Cookie set
Logo_Lifeform.png
login.sso.bluewin.ch/resources/images/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Cookie set
TheSansB_400_.woff2
login.sso.bluewin.ch/resources/sdx/fonts/TheSans/ |
50 KB 50 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Cookie set
lifeform-spritesheet.png
login.sso.bluewin.ch/resources/sdx/images/ |
38 KB 38 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Cookie set
TheSansB_600_.woff2
login.sso.bluewin.ch/resources/sdx/fonts/TheSans/ |
54 KB 54 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sdx-icons.woff2
login.sso.bluewin.ch/resources/sdx/fonts/sdx-icons/ |
24 KB 24 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Cookie set
TheSansB_300_.woff2
login.sso.bluewin.ch/resources/sdx/fonts/TheSans/ |
55 KB 55 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Swisscom (Telecommunication)82 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask function| handleSelect boolean| Ba object| webfont object| WebFont object| PubSub object| __core-js_shared__ object| Modernizr function| __extends function| __assign function| __rest function| __decorate function| __param function| __metadata function| __awaiter function| __generator function| __exportStar function| __values function| __read function| __spread function| __await function| __asyncGenerator function| __asyncDelegator function| __asyncValues function| __makeTemplateObject function| __importStar function| __importDefault function| flatpickr object| _gsQueue object| GreenSockGlobals object| com function| _gsDefine function| Ease function| Power4 function| Strong function| Quint function| Power3 function| Quart function| Power2 function| Cubic function| Power1 function| Quad function| Power0 function| Linear function| TweenLite function| TweenPlugin function| TweenMax function| TimelineLite function| TimelineMax function| BezierPlugin function| CSSPlugin function| BackOut function| BackIn function| BackInOut object| Back function| SlowMo function| SteppedEase function| RoughEase function| BounceOut function| BounceIn function| BounceInOut object| Bounce function| CircOut function| CircIn function| CircInOut object| Circ function| ElasticOut function| ElasticIn function| ElasticInOut object| Elastic function| ExpoOut function| ExpoIn function| ExpoInOut object| Expo function| SineOut function| SineIn function| SineInOut object| Sine object| EaseLookup object| sdx3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
login.sso.bluewin.ch/ | Name: JSESSIONID Value: 25FEFC9F5C45018A8E6E4E4A24D1927D |
|
.login.sso.bluewin.ch/ | Name: uxtype Value: new |
|
login.sso.bluewin.ch/ | Name: hazelcast.sessionId Value: HZFC7AB30EF9F94196828F197AA41B923E |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
login.sso.bluewin.ch
sam.sso.bluewin.ch
www.swisscom.ch
www1.swisscom.ch
195.186.145.195
195.186.145.42
195.186.196.30
2a02:a90:c400:4001::2
2a02:a90:c400:5001::2
06f449cdf9a25d9d55a22e797374da2fa5313c892e523e5aeb601db6e92fc53d
1573af38d48a35675d955142f69dcc06c6e5d5b78193f86763d2750f39770d6b
416e243e6ac013c2ce428f5707887796719657f13e7e52a08fe2b6a1a57e5c1b
5e39a8bb7dc50616b9f41997f90bbb8330be6eb35bb973995618c38a0e3c21f4
8390fbc9533f4baba09fc5d92999ce77139e089c02991fd4e006f8ac19f1b9dc
8c6a3f8d32c200068bb4366a6cfb01ca388e2d023a7c55fd3e9aa1fbdb13e1d3
a6bab48f290efd74478d95eab8bc0610cc32ffa78dc5adbb8fbc34f30ce8d930
aea14de2f15479f33a2cdfab1cdf996596cd10de05d4c2f1f5137ad1f16a2d4c
b01bd298d0734f96609de60bc30d1824f305fcadd8bf2c7b3511869fb03af518
d1870e3ff56e31519c45fbaad8528317692d60b7862cf7d563224b29132f2a18
e0bc3a627d23f2f2e1467bb520cf1a686a8b0e7ef12589e3e0aede4c350ad67e
f0cc4ee9dc83925f474ab0b5ed3a5395038c979e157d4bae8e67225f1b0922d8
f9adb57dca9cbd2514ed249714b613d65e78a81cadda2882679a9672c812d25e