139.59.38.201
Open in
urlscan Pro
139.59.38.201
Malicious Activity!
Public Scan
Effective URL: http://139.59.38.201/Rechnung/_privatkunden/a6SDJUhg/index.php?lang=&locale.x=de-DE_YdDa2fIXkKUR3JLMb8TjA1i9GZBQOgEFS...
Submission Tags: 6041713
Submission: On May 13 via api from PL
Summary
This is the only time 139.59.38.201 was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Sunrise (Telecommunication)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 178.62.250.52 178.62.250.52 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN - DigitalOcean) | |
1 6 | 139.59.38.201 139.59.38.201 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN - DigitalOcean) | |
8 | 212.35.60.35 212.35.60.35 | 6730 (SUNRISE) (SUNRISE) | |
1 | 205.185.208.52 205.185.208.52 | 20446 (HIGHWINDS3) (HIGHWINDS3 - Highwinds Network Group) | |
15 | 4 |
ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US)
PTR: 272884.cloudwaysapps.com
phpstack-272884-847071.cloudwaysapps.com |
ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US)
PTR: 273355.cloudwaysapps.com
139.59.38.201 |
ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)
PTR: vip052.ssl.hwcdn.net
code.jquery.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
sunrise.ch
www.sunrise.ch |
221 KB |
1 |
jquery.com
code.jquery.com |
78 KB |
1 |
cloudwaysapps.com
phpstack-272884-847071.cloudwaysapps.com |
514 B |
15 | 3 |
Domain | Requested by | |
---|---|---|
8 | www.sunrise.ch |
139.59.38.201
code.jquery.com |
1 | code.jquery.com |
139.59.38.201
|
1 | phpstack-272884-847071.cloudwaysapps.com | |
15 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.sunrise.ch Thawte TLS RSA CA G1 |
2018-07-11 - 2019-11-08 |
a year | crt.sh |
jquery.org COMODO RSA Domain Validation Secure Server CA |
2018-10-17 - 2020-10-16 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
http://139.59.38.201/Rechnung/_privatkunden/a6SDJUhg/index.php?lang=&locale.x=de-DE_YdDa2fIXkKUR3JLMb8TjA1i9GZBQOgEFSHce75h6PC4NWV
Frame ID: A241D34199C02322BE51FDB610C3EBEC
Requests: 15 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- http://phpstack-272884-847071.cloudwaysapps.com/Rechnung/jhmXCifTmMgDs6nNP7UvU4o10B3LgAjpHNot8woTNEefibqKKtpxfAx4FRO2gPrSzN2... Page URL
-
http://139.59.38.201/Rechnung/
HTTP 302
http://139.59.38.201/Rechnung/_privatkunden/a6SDJUhg/index.php?lang=&locale.x=de-DE_YdDa2fIXkKUR3... Page URL
Detected technologies
Adobe Experience Manager (CMS) ExpandDetected patterns
- script /\/etc\/designs\//i
Java (Programming Languages) Expand
Detected patterns
- script /\/etc\/designs\//i
Nginx (Web Servers) Expand
Detected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Modernizr (JavaScript Libraries) Expand
Detected patterns
- env /^Modernizr$/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
- script /jquery.*\.js/i
- env /^jQuery$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://phpstack-272884-847071.cloudwaysapps.com/Rechnung/jhmXCifTmMgDs6nNP7UvU4o10B3LgAjpHNot8woTNEefibqKKtpxfAx4FRO2gPrSzN2q.html Page URL
-
http://139.59.38.201/Rechnung/
HTTP 302
http://139.59.38.201/Rechnung/_privatkunden/a6SDJUhg/index.php?lang=&locale.x=de-DE_YdDa2fIXkKUR3JLMb8TjA1i9GZBQOgEFSHce75h6PC4NWV Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
jhmXCifTmMgDs6nNP7UvU4o10B3LgAjpHNot8woTNEefibqKKtpxfAx4FRO2gPrSzN2q.html
phpstack-272884-847071.cloudwaysapps.com/Rechnung/ |
208 B 514 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
Cookie set
index.php
139.59.38.201/Rechnung/_privatkunden/a6SDJUhg/ Redirect Chain
|
17 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
head.min.js
www.sunrise.ch/etc/designs/sunrise/ |
13 KB 6 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main-blessed1.css
www.sunrise.ch/etc/designs/sunrise/clientlibs/dist/css/ |
350 KB 50 KB |
Script
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
default.min.css
www.sunrise.ch/etc/designs/sunrise/ |
21 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
react.min.css
www.sunrise.ch/etc/designs/sunrise/ |
708 B 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-1.9.1.js
code.jquery.com/ |
262 KB 78 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-latest.min.js
139.59.38.201/Rechnung/_privatkunden/a6SDJUhg/sxf/mask/ |
94 KB 33 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.mask.min.js
139.59.38.201/Rechnung/_privatkunden/a6SDJUhg/sxf/mask/ |
6 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.ccvalidator.js
139.59.38.201/Rechnung/_privatkunden/a6SDJUhg/sxf/val/ |
6 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sunrise-logo.png
139.59.38.201/Rechnung/_privatkunden/a6SDJUhg/img/ |
9 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main-blessed2.css
www.sunrise.ch/etc/designs/sunrise/clientlibs/dist/css/ |
318 KB 37 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main-blessed1.css
www.sunrise.ch/etc/designs/sunrise/clientlibs/dist/css/ |
350 KB 50 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
91799b0e-0ef8-446e-b274-5509412e1242.woff2
www.sunrise.ch/etc/designs/sunrise/clientlibs/dist/fonts/ |
35 KB 36 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ed4b9060-b5ab-4379-8840-0b50a15258b7.woff2
www.sunrise.ch/etc/designs/sunrise/clientlibs/dist/fonts/ |
34 KB 35 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Sunrise (Telecommunication)17 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask boolean| IS_FIREFOX boolean| IS_WINDOWS_PHONE boolean| IS_IOS boolean| IS_ANDROID boolean| IE_VERSION function| detectIE object| handled_resources function| toast object| html5 object| Modernizr function| $ function| jQuery function| type_carte function| isNumberKey0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
code.jquery.com
phpstack-272884-847071.cloudwaysapps.com
www.sunrise.ch
139.59.38.201
178.62.250.52
205.185.208.52
212.35.60.35
0331b3feab910d381c29abbce46945895803b9e7d55d8bb758e4d5035dbee962
472fb7e68670d22171a3cc2a3a65121fd9124bd9d62c4810870168e4b33db8f2
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
5cc976d8f5c800a4aad487102cf81466b72e7cd86cf5d4f29573f5fa5c068ec4
68d1601c0d15c38bc446a60dc1267c6827cd9b0c33a469deba350d4098b72937
765d3288d525e64c140c29b1e756574f2336d8c706f3a6768e83a108c19925ee
7bd80d06c01c0340c1b9159b9b4a197db882ca18cbac8e9b9aa025e68f998d40
9c06ef4a69503ae33116496011f690cf97933cdeca5597693878ae5f882449df
9e3fe286735ce4531e59b94167a041e010af4a75d829e47383acfa7ecd1815b4
b5126fc2442428281d6093ef7a145328fbffffd4886de29c99b3e4f980656710
c83a949cafb97909de26491ff7139900e187041224556a805c340289638f45bc
e0ef803f8bb9cbe07f2407212c2422f87d48dbd08addb5bb994c5f485b2dcc6a
e292ee85c203cd1681ee1d32b835236f6e11277c9f7caddd5f627292e0d5a796
f370918cf7d37909e6be6092b32a6bd25197a526e8a929ce2cb1e5c0286ba912