swisspassidsbbcff.sviluppo.host Open in urlscan Pro
149.62.187.110 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://swisspassidsbbcff.sviluppo.host/auth/Entry.php
Submission: On April 28 via api (April 28th 2024, 5:07:35 am UTC) from BY — Scanned from IT

Summary HTTP 14 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 14 HTTP transactions. The main IP is 149.62.187.110, located in Italy and belongs to COLTENGINE COLTENGINE Network, IT. The main domain is swisspassidsbbcff.sviluppo.host.
TLS certificate: Issued by R3 on April 19th 2024. Valid for: 3 months.

This is the only time swisspassidsbbcff.sviluppo.host was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Schweizerische Bundesbahnen (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
10	149.62.187.110 149.62.187.110	47242 (COLTENGIN...) (COLTENGINE COLTENGINE Network)
3	193.203.121.166 193.203.121.166	31004 (SBB-CFF-F...) (SBB-CFF-FFS Telecom SBB)
1	193.203.121.145 193.203.121.145	31004 (SBB-CFF-F...) (SBB-CFF-FFS Telecom SBB)
14	3

10 149.62.187.110 (Italy)

ASN47242 (COLTENGINE COLTENGINE Network, IT)
PTR: w3007.shared.host.it

swisspassidsbbcff.sviluppo.host	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 193.203.121.166 (Switzerland)

ASN31004 (SBB-CFF-FFS Telecom SBB, CH)

login.swisspass.ch	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 193.203.121.145 (Switzerland)

ASN31004 (SBB-CFF-FFS Telecom SBB, CH)

resources.swisspass.ch	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	sviluppo.host swisspassidsbbcff.sviluppo.host	162 KB
4	swisspass.ch login.swisspass.ch — Cisco Umbrella Rank: 305281 resources.swisspass.ch	345 KB
14	2

	Domain	Requested by
10	swisspassidsbbcff.sviluppo.host	swisspassidsbbcff.sviluppo.host
3	login.swisspass.ch	swisspassidsbbcff.sviluppo.host
1	resources.swisspass.ch	swisspassidsbbcff.sviluppo.host
14	3

This site contains no links.

Subject Issuer	Validity	Valid
swisspassidsbbcff.sviluppo.host R3	`2024-04-19` - `2024-07-18`	3 months	crt.sh
swisspass.ch SwissSign RSA TLS DV ICA 2022 - 1	`2024-03-14` - `2025-03-14`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://swisspassidsbbcff.sviluppo.host/auth/Entry.php
Frame ID: A3DEB28C310C8542ACC457794058DCA7
Requests: 13 HTTP requests in this frame

Frame: https://swisspassidsbbcff.sviluppo.host/auth/userapp_files/saved_resource.html
Frame ID: 434A6833B989877C2E3A92400730D7C9
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Login | SwissPass

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

otSDKStub\.js

Page Statistics

14
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

3
IPs

2
Countries

507 kB
Transfer

1121 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request Entry.php Show response
swisspassidsbbcff.sviluppo.host/auth/ 131 KB
25 KB 626ms
351ms Document
text/html 149.62.187.110
COLTENGINE COLTEN...

General

Check archive.org

Show headers Download Go to

Full URL: https://swisspassidsbbcff.sviluppo.host/auth/Entry.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 149.62.187.110 , Italy, ASN47242 (COLTENGINE COLTENGINE Network, IT),
Reverse DNS: w3007.shared.host.it
Software: nginx / PHP/7.4.33
Resource Hash: 729063f305e6efcd4a5eac69b799c96da4403fc5f082219d68f824b66213402d

Request headers

Accept-Language: it-IT,it;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding: br
content-type: text/html; charset=UTF-8
date: Sun, 28 Apr 2024 05:07:28 GMT
server: nginx
vary: Accept-Encoding,User-Agent
x-powered-by: PHP/7.4.33

GET
H2 200 otSDKStub.js Show response
swisspassidsbbcff.sviluppo.host/auth/userapp_files/ 21 KB
7 KB 91ms
89ms Script
application/javascript 149.62.187.110
COLTENGINE COLTEN...

General

Check archive.org

Show headers Download Go to

Full URL: https://swisspassidsbbcff.sviluppo.host/auth/userapp_files/otSDKStub.js
Requested by: Host: swisspassidsbbcff.sviluppo.host
URL: https://swisspassidsbbcff.sviluppo.host/auth/Entry.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 149.62.187.110 , Italy, ASN47242 (COLTENGINE COLTENGINE Network, IT),
Reverse DNS: w3007.shared.host.it
Software: nginx /
Resource Hash: 92e4588c227a58321a728574129e52ec244df30b90fc9a64a30ee65410104c41

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://swisspassidsbbcff.sviluppo.host/auth/Entry.php
Accept-Language: it-IT,it;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 28 Apr 2024 05:07:28 GMT
content-encoding: br
last-modified: Wed, 27 Mar 2024 23:15:53 GMT
server: nginx
etag: "526c-6604a8a9-9ce0620c3e62a69a;br"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 6575
expires: Sun, 05 May 2024 05:07:28 GMT

GET
H2 200 styles.8501c3a64c32c7c4.css
swisspassidsbbcff.sviluppo.host/auth/userapp_files/ 177 KB
21 KB 66ms
65ms Stylesheet
text/css 149.62.187.110
COLTENGINE COLTEN...

General

Check archive.org

Show headers Download Go to

Full URL: https://swisspassidsbbcff.sviluppo.host/auth/userapp_files/styles.8501c3a64c32c7c4.css
Requested by: Host: swisspassidsbbcff.sviluppo.host
URL: https://swisspassidsbbcff.sviluppo.host/auth/Entry.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 149.62.187.110 , Italy, ASN47242 (COLTENGINE COLTENGINE Network, IT),
Reverse DNS: w3007.shared.host.it
Software: nginx /
Resource Hash: 8e12bf257a56e15f5cb4fcc36e706ae4615dc43b497e24933a52886fc15587a1

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://swisspassidsbbcff.sviluppo.host/auth/Entry.php
Accept-Language: it-IT,it;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 28 Apr 2024 05:07:28 GMT
content-encoding: br
last-modified: Wed, 27 Mar 2024 23:21:03 GMT
server: nginx
etag: "2c588-6604a9df-f25b490c35a5c639;br"
vary: Accept-Encoding,User-Agent
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 21555
expires: Sun, 05 May 2024 05:07:28 GMT

GET
H2 200 otBannerSdk.js Show response
swisspassidsbbcff.sviluppo.host/auth/userapp_files/ 442 KB
102 KB 72ms
71ms Script
application/javascript 149.62.187.110
COLTENGINE COLTEN...

General

Check archive.org

Show headers Download Go to

Full URL: https://swisspassidsbbcff.sviluppo.host/auth/userapp_files/otBannerSdk.js
Requested by: Host: swisspassidsbbcff.sviluppo.host
URL: https://swisspassidsbbcff.sviluppo.host/auth/Entry.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 149.62.187.110 , Italy, ASN47242 (COLTENGINE COLTENGINE Network, IT),
Reverse DNS: w3007.shared.host.it
Software: nginx /
Resource Hash: 15de250a16ce58a10f84bebab59b9005ce36df4ec8e87c3bb1acc92726cfa971

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://swisspassidsbbcff.sviluppo.host/auth/Entry.php
Accept-Language: it-IT,it;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 28 Apr 2024 05:07:28 GMT
content-encoding: br
last-modified: Wed, 27 Mar 2024 23:15:53 GMT
server: nginx
etag: "6e895-6604a8a9-31149cb79e2e77b2;br"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 103628
expires: Sun, 05 May 2024 05:07:28 GMT

GET
H2 200 logo.png
swisspassidsbbcff.sviluppo.host/auth/userapp_files/ 548 B
939 B 87ms
86ms Image
image/png 149.62.187.110
COLTENGINE COLTEN...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://swisspassidsbbcff.sviluppo.host/auth/userapp_files/logo.png
Requested by: Host: swisspassidsbbcff.sviluppo.host
URL: https://swisspassidsbbcff.sviluppo.host/auth/Entry.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 149.62.187.110 , Italy, ASN47242 (COLTENGINE COLTENGINE Network, IT),
Reverse DNS: w3007.shared.host.it
Software: nginx /
Resource Hash: f2f0d94a5141a75ef227f2699b6a43588741ede3edd2fe2d075a65b3d413b2f8

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://swisspassidsbbcff.sviluppo.host/auth/Entry.php
Accept-Language: it-IT,it;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 28 Apr 2024 05:07:28 GMT
last-modified: Wed, 27 Mar 2024 23:15:53 GMT
server: nginx
etag: "224-6604a8a9-464a0574fe01dcb;;;"
vary: User-Agent
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 548
expires: Sun, 05 May 2024 05:07:28 GMT

GET
H/1.1 200
OK logo_text_de-20200819.svg
login.swisspass.ch/resources/img/ 137 KB
138 KB 189ms
51ms Image
image/svg+xml 193.203.121.166
SBB-CFF-FFS Telec...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://login.swisspass.ch/resources/img/logo_text_de-20200819.svg

Requested by

Host: swisspassidsbbcff.sviluppo.host
URL: https://swisspassidsbbcff.sviluppo.host/auth/Entry.php

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

193.203.121.166 , Switzerland, ASN31004 (SBB-CFF-FFS Telecom SBB, CH),

Reverse DNS

Software

Apache /

Resource Hash

c337d42ed7979c6be0282900bd957dd9d112a430dc7761463d655eb8f0d9bc07

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://swisspassidsbbcff.sviluppo.host/
Accept-Language: it-IT,it;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Sun, 28 Apr 2024 05:07:28 GMT
Strict-Transport-Security: max-age=16070400
X-Content-Type-Options: nosniff
Connection: Keep-Alive
Content-Length: 139971
X-XSS-Protection: 1; mode=block
Referrer-Policy: same-origin
last-modified: Thu, 25 Apr 2024 12:06:57 GMT
Server: Apache
etag: "662a4761-222c3"
X-Frame-Options: SAMEORIGIN
Content-Type: image/svg+xml
cache-control: max-age=31536000, private
Feature-Policy: autoplay 'self'; camera 'self'; display-capture 'self'; document-domain 'self'; encrypted-media 'self'; fullscreen 'self'; geolocation 'self'; microphone 'self'; midi 'self'; payment 'self'; xr-spatial-tracking 'self'
accept-ranges: bytes
Keep-Alive: timeout=10, max=500
expires: Mon, 28 Apr 2025 05:07:28 GMT

GET
H/1.1 200
OK logo-20200819.svg
login.swisspass.ch/resources/img/ 7 KB
8 KB 182ms
54ms Image
image/svg+xml 193.203.121.166
SBB-CFF-FFS Telec...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://login.swisspass.ch/resources/img/logo-20200819.svg

Requested by

Host: swisspassidsbbcff.sviluppo.host
URL: https://swisspassidsbbcff.sviluppo.host/auth/Entry.php

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

193.203.121.166 , Switzerland, ASN31004 (SBB-CFF-FFS Telecom SBB, CH),

Reverse DNS

Software

Apache /

Resource Hash

deeee170c3759a6ed35c0c05c5b935d0e7638f1c0c5677166918ecff6edb1909

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://swisspassidsbbcff.sviluppo.host/
Accept-Language: it-IT,it;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Sun, 28 Apr 2024 05:07:28 GMT
Strict-Transport-Security: max-age=16070400
X-Content-Type-Options: nosniff
Connection: Keep-Alive
Content-Length: 7374
X-XSS-Protection: 1; mode=block
Referrer-Policy: same-origin
last-modified: Thu, 25 Apr 2024 12:06:57 GMT
Server: Apache
etag: "662a4761-1cce"
X-Frame-Options: SAMEORIGIN
Content-Type: image/svg+xml
cache-control: max-age=31536000, private
Feature-Policy: autoplay 'self'; camera 'self'; display-capture 'self'; document-domain 'self'; encrypted-media 'self'; fullscreen 'self'; geolocation 'self'; microphone 'self'; midi 'self'; payment 'self'; xr-spatial-tracking 'self'
accept-ranges: bytes
Keep-Alive: timeout=10, max=500
expires: Mon, 28 Apr 2025 05:07:28 GMT

GET
H2 200 saved_resource.html Show response
swisspassidsbbcff.sviluppo.host/auth/userapp_files/ Frame 434A 198 B
533 B 117ms
117ms Document
text/html 149.62.187.110
COLTENGINE COLTEN...

General

Check archive.org

Show headers Download Go to

Full URL: https://swisspassidsbbcff.sviluppo.host/auth/userapp_files/saved_resource.html
Requested by: Host: swisspassidsbbcff.sviluppo.host
URL: https://swisspassidsbbcff.sviluppo.host/auth/Entry.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 149.62.187.110 , Italy, ASN47242 (COLTENGINE COLTENGINE Network, IT),
Reverse DNS: w3007.shared.host.it
Software: nginx /
Resource Hash: 7a036d721a3bbb21568fa68822dfb58ab04cc78a274c6608590440becb307ec9

Request headers

Accept-Language: it-IT,it;q=0.9;q=0.9
Referer: https://swisspassidsbbcff.sviluppo.host/auth/Entry.php
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 198
content-type: text/html
date: Sun, 28 Apr 2024 05:07:28 GMT
etag: "c6-6604a8a9-b34b2494ef8c1d0;;;"
last-modified: Wed, 27 Mar 2024 23:15:53 GMT
server: nginx
vary: User-Agent

GET
H2 200 OneTrust_SwissPass_logo_mobile.png
swisspassidsbbcff.sviluppo.host/auth/userapp_files/ 2 KB
2 KB 69ms
68ms Image
image/png 149.62.187.110
COLTENGINE COLTEN...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://swisspassidsbbcff.sviluppo.host/auth/userapp_files/OneTrust_SwissPass_logo_mobile.png
Requested by: Host: swisspassidsbbcff.sviluppo.host
URL: https://swisspassidsbbcff.sviluppo.host/auth/Entry.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 149.62.187.110 , Italy, ASN47242 (COLTENGINE COLTENGINE Network, IT),
Reverse DNS: w3007.shared.host.it
Software: nginx /
Resource Hash: e42fe383c86ab1185425bf334a44f9a311dd06d8ccf9e409d05b45dbe0bc48c6

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://swisspassidsbbcff.sviluppo.host/auth/Entry.php
Accept-Language: it-IT,it;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 28 Apr 2024 05:07:28 GMT
last-modified: Wed, 27 Mar 2024 23:15:53 GMT
server: nginx
etag: "7aa-6604a8a9-e991a040f994559f;;;"
vary: User-Agent
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 1962
expires: Sun, 05 May 2024 05:07:28 GMT

GET
H2 200 powered_by_logo.svg
swisspassidsbbcff.sviluppo.host/auth/userapp_files/ 5 KB
2 KB 72ms
71ms Image
image/svg+xml 149.62.187.110
COLTENGINE COLTEN...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://swisspassidsbbcff.sviluppo.host/auth/userapp_files/powered_by_logo.svg
Requested by: Host: swisspassidsbbcff.sviluppo.host
URL: https://swisspassidsbbcff.sviluppo.host/auth/Entry.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 149.62.187.110 , Italy, ASN47242 (COLTENGINE COLTENGINE Network, IT),
Reverse DNS: w3007.shared.host.it
Software: nginx /
Resource Hash: 5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://swisspassidsbbcff.sviluppo.host/auth/Entry.php
Accept-Language: it-IT,it;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 28 Apr 2024 05:07:28 GMT
content-encoding: br
last-modified: Wed, 27 Mar 2024 23:15:53 GMT
server: nginx
etag: "144a-6604a8a9-278c63b7d7700c76;br"
vary: Accept-Encoding,User-Agent
content-type: image/svg+xml
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 1988
expires: Sun, 05 May 2024 05:07:28 GMT

GET
H/1.1 200
OK login_bg.jpg
resources.swisspass.ch/content/dam/swisspass/co-branding/swiss_ch/ 196 KB
197 KB 251ms
55ms Image
image/jpeg 193.203.121.145
SBB-CFF-FFS Telec...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://resources.swisspass.ch/content/dam/swisspass/co-branding/swiss_ch/login_bg.jpg

Requested by

Host: swisspassidsbbcff.sviluppo.host
URL: https://swisspassidsbbcff.sviluppo.host/auth/Entry.php

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

193.203.121.145 , Switzerland, ASN31004 (SBB-CFF-FFS Telecom SBB, CH),

Reverse DNS

Software

Apache /

Resource Hash

58a037c0bde953b48561826f3df16031f7ddfce33c4018619d3f39c6af6eec1b

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://swisspassidsbbcff.sviluppo.host/
Accept-Language: it-IT,it;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Sun, 28 Apr 2024 05:07:29 GMT
Strict-Transport-Security: max-age=16070400
X-Content-Type-Options: nosniff
X-Cache: HIT
x-url: /content/dam/swisspass/co-branding/swiss_ch/login_bg.jpg
Connection: Keep-Alive
Content-Length: 200933
X-XSS-Protection: 1; mode=block
Referrer-Policy: same-origin
Last-Modified: Sun, 28 Apr 2024 01:04:58 GMT
Server: Apache
ETag: "310e5-6171db9c9e11c"
Vary: User-Agent,X-Requested-With
X-Frame-Options: SAMEORIGIN
X-Varnish: 292226042 288406537
Content-Type: image/jpeg
X-Plattform: cprod
Cache-Control: max-age=21600
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=500
Expires: Sun, 28 Apr 2024 11:04:34 GMT

GET
H2 404 SBBWeb-Light.3f0cdd23274e17f7.woff2
swisspassidsbbcff.sviluppo.host/auth/userapp_files/ 0
0 76ms
75ms Font
text/html 149.62.187.110
COLTENGINE COLTEN...

General

Check archive.org

Show headers Download Go to

Full URL: https://swisspassidsbbcff.sviluppo.host/auth/userapp_files/SBBWeb-Light.3f0cdd23274e17f7.woff2
Requested by: Host: swisspassidsbbcff.sviluppo.host
URL: https://swisspassidsbbcff.sviluppo.host/auth/userapp_files/styles.8501c3a64c32c7c4.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 149.62.187.110 , Italy, ASN47242 (COLTENGINE COLTENGINE Network, IT),
Reverse DNS: w3007.shared.host.it
Software: nginx /
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://swisspassidsbbcff.sviluppo.host/auth/userapp_files/styles.8501c3a64c32c7c4.css
Origin: https://swisspassidsbbcff.sviluppo.host
Accept-Language: it-IT,it;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sun, 28 Apr 2024 05:07:29 GMT
server: nginx
vary: User-Agent
content-type: text/html
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 1251

GET
H2 404 e91f4b90-f9aa-4ace-891b-96dd07595d9f-test.json Show response
swisspassidsbbcff.sviluppo.host/auth/userapp_files/otSDKStub.js/consent/e91f4b90-f9aa-4ace-891b-96dd07595d9f-test/ 1 KB
2 KB 73ms
73ms XHR
text/html 149.62.187.110
COLTENGINE COLTEN...

General

Check archive.org

Show headers Download Go to

Full URL: https://swisspassidsbbcff.sviluppo.host/auth/userapp_files/otSDKStub.js/consent/e91f4b90-f9aa-4ace-891b-96dd07595d9f-test/e91f4b90-f9aa-4ace-891b-96dd07595d9f-test.json
Requested by: Host: swisspassidsbbcff.sviluppo.host
URL: https://swisspassidsbbcff.sviluppo.host/auth/userapp_files/otSDKStub.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 149.62.187.110 , Italy, ASN47242 (COLTENGINE COLTENGINE Network, IT),
Reverse DNS: w3007.shared.host.it
Software: nginx /
Resource Hash: 4c13d452dd5d49671bd93ca32f2b4f85c78e39b6ab0ad1f38d98ed267f8fd896

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://swisspassidsbbcff.sviluppo.host/auth/Entry.php
Accept-Language: it-IT,it;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sun, 28 Apr 2024 05:07:28 GMT
server: nginx
vary: User-Agent
content-type: text/html
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 1251

GET
H/1.1 200
OK favicon.ico
login.swisspass.ch/v3/oevlogin/ui/assets/custom/img/ 1 KB
2 KB 41ms
41ms Other
image/x-icon 193.203.121.166
SBB-CFF-FFS Telec...

General

Check archive.org

Show headers Download Go to

Full URL

https://login.swisspass.ch/v3/oevlogin/ui/assets/custom/img/favicon.ico

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

193.203.121.166 , Switzerland, ASN31004 (SBB-CFF-FFS Telecom SBB, CH),

Reverse DNS

Software

Apache /

Resource Hash

7c1925da382279a72f94990d0a1456f78918619f35780ea0905e4ae0db684677

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://swisspassidsbbcff.sviluppo.host/
Accept-Language: it-IT,it;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Sun, 28 Apr 2024 05:07:29 GMT
Strict-Transport-Security: max-age=16070400
X-Content-Type-Options: nosniff
Server-Timing: intid;desc=1b22c50736a944f1
Connection: Keep-Alive
Content-Length: 1150
X-XSS-Protection: 1; mode=block
Referrer-Policy: same-origin
Last-Modified: Thu, 18 Apr 2024 09:38:38 GMT
Server: Apache
ETag: W/"1150-1713433118000"
X-Frame-Options: SAMEORIGIN
Content-Type: image/x-icon;charset=UTF-8
Feature-Policy: autoplay 'self'; camera 'self'; display-capture 'self'; document-domain 'self'; encrypted-media 'self'; fullscreen 'self'; geolocation 'self'; microphone 'self'; midi 'self'; payment 'self'; xr-spatial-tracking 'self'
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=499

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Schweizerische Bundesbahnen (Transportation)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| OneTrustStub

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.swisspass.ch/	1969-12-31 23:59:59	Name: AL_SESS-S Value: AZxyg4dWIMesigyr7pW_rgGxjM9mvSjEU!h9nzFSrxMpRRxqD3DRYs7zcI3BL5Ps_vKm

7 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	warning	URL: https://swisspassidsbbcff.sviluppo.host/auth/Entry.php Message: [DOM] Found 2 elements with non-unique id #username: (More info: https://goo.gl/9p2vKq) %o %o
intervention	info	URL: https://swisspassidsbbcff.sviluppo.host/auth/Entry.php Message: Slow network is detected. See https://www.chromestatus.com/feature/5636954674692096 for more details. Fallback font will be used while loading: https://swisspassidsbbcff.sviluppo.host/auth/userapp_files/SBBWeb-Light.3f0cdd23274e17f7.woff2
network	error	URL: https://swisspassidsbbcff.sviluppo.host/auth/userapp_files/otSDKStub.js/consent/e91f4b90-f9aa-4ace-891b-96dd07595d9f-test/e91f4b90-f9aa-4ace-891b-96dd07595d9f-test.json Message: Failed to load resource: the server responded with a status of 404 ()
other	warning	URL: https://swisspassidsbbcff.sviluppo.host/auth/Entry.php Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://swisspassidsbbcff.sviluppo.host/auth/Entry.php Message: Third-party cookie will be blocked. Learn more in the Issues tab.
network	error	URL: https://swisspassidsbbcff.sviluppo.host/auth/userapp_files/SBBWeb-Light.3f0cdd23274e17f7.woff2 Message: Failed to load resource: the server responded with a status of 404 ()
other	warning	URL: https://swisspassidsbbcff.sviluppo.host/auth/Entry.php Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

login.swisspass.ch
resources.swisspass.ch
swisspassidsbbcff.sviluppo.host
149.62.187.110
193.203.121.145
193.203.121.166
15de250a16ce58a10f84bebab59b9005ce36df4ec8e87c3bb1acc92726cfa971
4c13d452dd5d49671bd93ca32f2b4f85c78e39b6ab0ad1f38d98ed267f8fd896
58a037c0bde953b48561826f3df16031f7ddfce33c4018619d3f39c6af6eec1b
5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d
729063f305e6efcd4a5eac69b799c96da4403fc5f082219d68f824b66213402d
7a036d721a3bbb21568fa68822dfb58ab04cc78a274c6608590440becb307ec9
7c1925da382279a72f94990d0a1456f78918619f35780ea0905e4ae0db684677
8e12bf257a56e15f5cb4fcc36e706ae4615dc43b497e24933a52886fc15587a1
92e4588c227a58321a728574129e52ec244df30b90fc9a64a30ee65410104c41
c337d42ed7979c6be0282900bd957dd9d112a430dc7761463d655eb8f0d9bc07
deeee170c3759a6ed35c0c05c5b935d0e7638f1c0c5677166918ecff6edb1909
e42fe383c86ab1185425bf334a44f9a311dd06d8ccf9e409d05b45dbe0bc48c6
f2f0d94a5141a75ef227f2699b6a43588741ede3edd2fe2d075a65b3d413b2f8

swisspassidsbbcff.sviluppo.host Open in urlscan Pro 149.62.187.110 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

14 Requests

100 %HTTPS

0 %IPv6

2 Domains

3 Subdomains

3 IPs

2 Countries

507 kBTransfer

1121 kBSize

1 Cookies

0 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

1 Cookies

7 Console Messages

Indicators

swisspassidsbbcff.sviluppo.host Open in urlscan Pro
149.62.187.110 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

3
IPs

2
Countries

507 kB
Transfer

1121 kB
Size

1
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!