zahlung-fees.ch Open in urlscan Pro
13.85.7.130 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://zahlung-fees.ch/195.162.166.20/index.php?ip=195.162.166.20
Submission Tags: 7332373
Submission: On October 28 via api (October 28th 2021, 6:57:39 am UTC) from NL — Scanned from DE

Summary HTTP 22 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 22 HTTP transactions. The main IP is 13.85.7.130, located in San Antonio, United States and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is zahlung-fees.ch.
TLS certificate: Issued by cPanel, Inc. Certification Authority on October 25th 2021. Valid for: 3 months.

This is the only time zahlung-fees.ch was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Swisscom (Telecommunication)

Domain & IP information

	IP Address		AS Autonomous System
20	13.85.7.130 13.85.7.130		8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
22	2

20 13.85.7.130 (San Antonio, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

zahlung-fees.ch	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
20	zahlung-fees.ch zahlung-fees.ch	791 KB
0	bluewin.ch Failed service-login.sso.bluewin.ch Failed
22	2

	Domain	Requested by
20	zahlung-fees.ch	zahlung-fees.ch
0	service-login.sso.bluewin.ch Failed	zahlung-fees.ch
22	2

This site contains links to these domains. Also see Links.

Domain
service-login.sso.bluewin.ch
www.swisscom.ch

Subject Issuer	Validity	Valid
zahlung-fees.ch cPanel, Inc. Certification Authority	`2021-10-25` - `2022-01-23`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://zahlung-fees.ch/195.162.166.20/index.php?ip=195.162.166.20
Frame ID: 20282633E1720E52CEED749CD2B01C49
Requests: 22 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Swisscom Login

Page Statistics

22
Requests

91 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

791 kB
Transfer

789 kB
Size

0
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://service-login.sso.bluewin.ch/

Search URL Search Domain Scan URL

URL: https://www.swisscom.ch/de/privatkunden/hilfe/daten-und-rechnungen/das-swisscom-login.html
Title: Über Swisscom Login

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

22 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request index.php Show response zahlung-fees.ch/195.162.166.20/	22 KB 22 KB	439ms 140ms	Document text/html	13.85.7.130 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://zahlung-fees.ch/195.162.166.20/index.php?ip=195.162.166.20 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 13.85.7.130 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash `1144829a9ad0289481915946a961245b8b88402d635a2e7bca9e3e589903c243` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers Date Thu, 28 Oct 2021 06:57:34 GMT Server Apache Keep-Alive timeout=5, max=100 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	commons.css zahlung-fees.ch/195.162.166.20/index_files/	351 KB 351 KB	256ms 139ms	Stylesheet text/css	13.85.7.130 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://zahlung-fees.ch/195.162.166.20/index_files/commons.css Requested by Host: zahlung-fees.ch URL: https://zahlung-fees.ch/195.162.166.20/index.php?ip=195.162.166.20 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 13.85.7.130 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash `5ad15e30f915778a7f512d442dd2e6aad992f1e0aa44dbcd3b3a19ba7002f324` Request headers Accept-Language de-DE,de;q=0.9 Referer https://zahlung-fees.ch/195.162.166.20/index.php?ip=195.162.166.20 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Thu, 28 Oct 2021 06:57:35 GMT Last-Modified Thu, 28 Oct 2021 05:31:13 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 358978
GET H/1.1	200 OK	password.css zahlung-fees.ch/195.162.166.20/index_files/	223 B 464 B	423ms 141ms	Stylesheet text/css	13.85.7.130 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://zahlung-fees.ch/195.162.166.20/index_files/password.css Requested by Host: zahlung-fees.ch URL: https://zahlung-fees.ch/195.162.166.20/index.php?ip=195.162.166.20 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 13.85.7.130 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash `5b852a24046a17a29ddca92bee7b9f7f8cef9d770154ce3b12c7456239e1aba9` Request headers Accept-Language de-DE,de;q=0.9 Referer https://zahlung-fees.ch/195.162.166.20/index.php?ip=195.162.166.20 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Thu, 28 Oct 2021 06:57:35 GMT Last-Modified Thu, 28 Oct 2021 05:31:13 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 223
GET H/1.1	200 OK	webcomponents_002.js Show response zahlung-fees.ch/195.162.166.20/index_files/	23 KB 24 KB	428ms 143ms	Script application/javascript	13.85.7.130 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://zahlung-fees.ch/195.162.166.20/index_files/webcomponents_002.js Requested by Host: zahlung-fees.ch URL: https://zahlung-fees.ch/195.162.166.20/index.php?ip=195.162.166.20 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 13.85.7.130 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash `a2d412121620524a5a34997c31f2ea9cf9fcb5c4f7b8a4e73afe88e8a4988c1c` Request headers Referer https://zahlung-fees.ch/195.162.166.20/index.php?ip=195.162.166.20 Origin https://zahlung-fees.ch Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Thu, 28 Oct 2021 06:57:35 GMT Last-Modified Thu, 28 Oct 2021 05:31:13 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 23905
GET H/1.1	200 OK	myswisscom_logo.png zahlung-fees.ch/195.162.166.20/index_files/	1 KB 1 KB	147ms 147ms	Image image/png	13.85.7.130 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://zahlung-fees.ch/195.162.166.20/index_files/myswisscom_logo.png Requested by Host: zahlung-fees.ch URL: https://zahlung-fees.ch/195.162.166.20/index.php?ip=195.162.166.20 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 13.85.7.130 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash `1573af38d48a35675d955142f69dcc06c6e5d5b78193f86763d2750f39770d6b` Request headers Accept-Language de-DE,de;q=0.9 Referer https://zahlung-fees.ch/195.162.166.20/index.php?ip=195.162.166.20 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Thu, 28 Oct 2021 06:57:35 GMT Last-Modified Thu, 28 Oct 2021 05:31:13 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 1274
GET H/1.1	200 OK	webcomponents.js Show response zahlung-fees.ch/195.162.166.20/index_files/	2 KB 2 KB	323ms 147ms	Script application/javascript	13.85.7.130 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://zahlung-fees.ch/195.162.166.20/index_files/webcomponents.js Requested by Host: zahlung-fees.ch URL: https://zahlung-fees.ch/195.162.166.20/index.php?ip=195.162.166.20 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 13.85.7.130 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash `3b3d4c57d3694575c88a29fb1c9faad1a6e361778ba705dbe017e699fbe4a79d` Request headers Accept-Language de-DE,de;q=0.9 Referer https://zahlung-fees.ch/195.162.166.20/index.php?ip=195.162.166.20 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Thu, 28 Oct 2021 06:57:35 GMT Last-Modified Thu, 28 Oct 2021 05:31:13 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 2199
GET H/1.1	200 OK	commons.js Show response zahlung-fees.ch/195.162.166.20/index_files/	383 KB 383 KB	417ms 139ms	Script application/javascript	13.85.7.130 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://zahlung-fees.ch/195.162.166.20/index_files/commons.js Requested by Host: zahlung-fees.ch URL: https://zahlung-fees.ch/195.162.166.20/index.php?ip=195.162.166.20 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 13.85.7.130 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash `a482ff648905575cfbe2e0a4dbb570441656fc8715e86ed8796f99ea5f1d345c` Request headers Accept-Language de-DE,de;q=0.9 Referer https://zahlung-fees.ch/195.162.166.20/index.php?ip=195.162.166.20 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Thu, 28 Oct 2021 06:57:35 GMT Last-Modified Thu, 28 Oct 2021 05:31:13 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 392224
GET H/1.1	200 OK	login-layout.js Show response zahlung-fees.ch/195.162.166.20/index_files/	4 KB 4 KB	440ms 146ms	Script application/javascript	13.85.7.130 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://zahlung-fees.ch/195.162.166.20/index_files/login-layout.js Requested by Host: zahlung-fees.ch URL: https://zahlung-fees.ch/195.162.166.20/index.php?ip=195.162.166.20 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 13.85.7.130 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash `231fefe41695871b5d409e94c22520bafb7ba46d37071ab956ba73f9ad0f1905` Request headers Accept-Language de-DE,de;q=0.9 Referer https://zahlung-fees.ch/195.162.166.20/index.php?ip=195.162.166.20 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Thu, 28 Oct 2021 06:57:35 GMT Last-Modified Thu, 28 Oct 2021 05:31:13 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 3648
GET H/1.1	200 OK	password.js Show response zahlung-fees.ch/195.162.166.20/index_files/	2 KB 3 KB	141ms 141ms	Script application/javascript	13.85.7.130 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://zahlung-fees.ch/195.162.166.20/index_files/password.js Requested by Host: zahlung-fees.ch URL: https://zahlung-fees.ch/195.162.166.20/index.php?ip=195.162.166.20 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 13.85.7.130 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash `8cd1ddd3283f6cd5ac76b3bcc3a0b839431659ad65f024dca082234f84773257` Request headers Accept-Language de-DE,de;q=0.9 Referer https://zahlung-fees.ch/195.162.166.20/index.php?ip=195.162.166.20 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Thu, 28 Oct 2021 06:57:35 GMT Last-Modified Thu, 28 Oct 2021 05:31:13 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 2539
GET H/1.1	404 Not Found	lifeform-spritesheet.png zahlung-fees.ch/195.162.166.20/	315 B 315 B	139ms 139ms	Image text/html	13.85.7.130 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://zahlung-fees.ch/195.162.166.20/lifeform-spritesheet.png Requested by Host: zahlung-fees.ch URL: https://zahlung-fees.ch/195.162.166.20/index_files/commons.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 13.85.7.130 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash `d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3` Request headers Accept-Language de-DE,de;q=0.9 Referer https://zahlung-fees.ch/195.162.166.20/index_files/commons.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Thu, 28 Oct 2021 06:57:35 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=98 Content-Length 315 Content-Type text/html; charset=iso-8859-1
GET H/1.1	404 Not Found	TheSansB_400_.woff2 zahlung-fees.ch/195.162.166.20/	0 0	147ms 146ms	Font text/html	13.85.7.130 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://zahlung-fees.ch/195.162.166.20/TheSansB_400_.woff2 Requested by Host: zahlung-fees.ch URL: https://zahlung-fees.ch/195.162.166.20/index_files/commons.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 13.85.7.130 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash Request headers Referer https://zahlung-fees.ch/195.162.166.20/index_files/commons.css Origin https://zahlung-fees.ch Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Thu, 28 Oct 2021 06:57:35 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=98 Content-Length 315 Content-Type text/html; charset=iso-8859-1
GET H/1.1	404 Not Found	sdx-icons.woff2 zahlung-fees.ch/195.162.166.20/	0 0	143ms 142ms	Font text/html	13.85.7.130 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://zahlung-fees.ch/195.162.166.20/sdx-icons.woff2 Requested by Host: zahlung-fees.ch URL: https://zahlung-fees.ch/195.162.166.20/index_files/commons.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 13.85.7.130 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash Request headers Referer https://zahlung-fees.ch/195.162.166.20/index_files/commons.css Origin https://zahlung-fees.ch Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Thu, 28 Oct 2021 06:57:35 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=99 Content-Length 315 Content-Type text/html; charset=iso-8859-1
GET H/1.1	404 Not Found	TheSansB_300_.woff2 zahlung-fees.ch/195.162.166.20/	0 0	142ms 141ms	Font text/html	13.85.7.130 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://zahlung-fees.ch/195.162.166.20/TheSansB_300_.woff2 Requested by Host: zahlung-fees.ch URL: https://zahlung-fees.ch/195.162.166.20/index_files/commons.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 13.85.7.130 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash Request headers Referer https://zahlung-fees.ch/195.162.166.20/index_files/commons.css Origin https://zahlung-fees.ch Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Thu, 28 Oct 2021 06:57:35 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=98 Content-Length 315 Content-Type text/html; charset=iso-8859-1
GET H/1.1	404 Not Found	webcomponents.lgd0guuk.js zahlung-fees.ch/195.162.166.20/index_files/webcomponents/	0 0	147ms 147ms	Script text/html	13.85.7.130 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://zahlung-fees.ch/195.162.166.20/index_files/webcomponents/webcomponents.lgd0guuk.js Requested by Host: zahlung-fees.ch URL: https://zahlung-fees.ch/195.162.166.20/index_files/webcomponents.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 13.85.7.130 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash Request headers Referer https://zahlung-fees.ch/195.162.166.20/index.php?ip=195.162.166.20 Origin https://zahlung-fees.ch Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Thu, 28 Oct 2021 06:57:35 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=99 Content-Length 315 Content-Type text/html; charset=iso-8859-1
GET H/1.1	404 Not Found	TheSansB_300_.woff zahlung-fees.ch/195.162.166.20/	0 0	141ms 141ms	Font text/html	13.85.7.130 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://zahlung-fees.ch/195.162.166.20/TheSansB_300_.woff Requested by Host: zahlung-fees.ch URL: https://zahlung-fees.ch/195.162.166.20/index_files/commons.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 13.85.7.130 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash Request headers Referer https://zahlung-fees.ch/195.162.166.20/index_files/commons.css Origin https://zahlung-fees.ch Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Thu, 28 Oct 2021 06:57:35 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=97 Content-Length 315 Content-Type text/html; charset=iso-8859-1
GET H/1.1	404 Not Found	sdx-icons.woff zahlung-fees.ch/195.162.166.20/	0 0	143ms 142ms	Font text/html	13.85.7.130 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://zahlung-fees.ch/195.162.166.20/sdx-icons.woff Requested by Host: zahlung-fees.ch URL: https://zahlung-fees.ch/195.162.166.20/index_files/commons.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 13.85.7.130 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash Request headers Referer https://zahlung-fees.ch/195.162.166.20/index_files/commons.css Origin https://zahlung-fees.ch Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Thu, 28 Oct 2021 06:57:35 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=98 Content-Length 315 Content-Type text/html; charset=iso-8859-1
GET H/1.1	404 Not Found	TheSansB_400_.woff zahlung-fees.ch/195.162.166.20/	0 0	147ms 147ms	Font text/html	13.85.7.130 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://zahlung-fees.ch/195.162.166.20/TheSansB_400_.woff Requested by Host: zahlung-fees.ch URL: https://zahlung-fees.ch/195.162.166.20/index_files/commons.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 13.85.7.130 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash Request headers Referer https://zahlung-fees.ch/195.162.166.20/index_files/commons.css Origin https://zahlung-fees.ch Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Thu, 28 Oct 2021 06:57:35 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=97 Content-Length 315 Content-Type text/html; charset=iso-8859-1
GET H/1.1	404 Not Found	TheSansB_300_.ttf zahlung-fees.ch/195.162.166.20/	0 0	141ms 141ms	Font text/html	13.85.7.130 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://zahlung-fees.ch/195.162.166.20/TheSansB_300_.ttf Requested by Host: zahlung-fees.ch URL: https://zahlung-fees.ch/195.162.166.20/index_files/commons.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 13.85.7.130 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash Request headers Referer https://zahlung-fees.ch/195.162.166.20/index_files/commons.css Origin https://zahlung-fees.ch Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Thu, 28 Oct 2021 06:57:35 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=96 Content-Length 315 Content-Type text/html; charset=iso-8859-1
GET H/1.1	404 Not Found	sdx-icons.ttf zahlung-fees.ch/195.162.166.20/	0 0	142ms 142ms	Font text/html	13.85.7.130 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://zahlung-fees.ch/195.162.166.20/sdx-icons.ttf Requested by Host: zahlung-fees.ch URL: https://zahlung-fees.ch/195.162.166.20/index_files/commons.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 13.85.7.130 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash Request headers Referer https://zahlung-fees.ch/195.162.166.20/index_files/commons.css Origin https://zahlung-fees.ch Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Thu, 28 Oct 2021 06:57:35 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=97 Content-Length 315 Content-Type text/html; charset=iso-8859-1
GET H/1.1	404 Not Found	TheSansB_400_.ttf zahlung-fees.ch/195.162.166.20/	0 0	147ms 146ms	Font text/html	13.85.7.130 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://zahlung-fees.ch/195.162.166.20/TheSansB_400_.ttf Requested by Host: zahlung-fees.ch URL: https://zahlung-fees.ch/195.162.166.20/index_files/commons.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 13.85.7.130 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash Request headers Referer https://zahlung-fees.ch/195.162.166.20/index_files/commons.css Origin https://zahlung-fees.ch Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Thu, 28 Oct 2021 06:57:35 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=96 Content-Length 315 Content-Type text/html; charset=iso-8859-1
GET		ty0ne4z6.entry.js service-login.sso.bluewin.ch/node_modules/sdx/dist/js/webcomponents/webcomponents/	0 0

GET		mibbflfq.entry.js service-login.sso.bluewin.ch/node_modules/sdx/dist/js/webcomponents/webcomponents/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: service-login.sso.bluewin.ch
URL: https://service-login.sso.bluewin.ch/node_modules/sdx/dist/js/webcomponents/webcomponents/ty0ne4z6.entry.js

Domain: service-login.sso.bluewin.ch
URL: https://service-login.sso.bluewin.ch/node_modules/sdx/dist/js/webcomponents/webcomponents/mibbflfq.entry.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Swisscom (Telecommunication)

37 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

15 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://zahlung-fees.ch/195.162.166.20/lifeform-spritesheet.png Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://zahlung-fees.ch/195.162.166.20/TheSansB_300_.woff2 Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://zahlung-fees.ch/195.162.166.20/sdx-icons.woff2 Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://zahlung-fees.ch/195.162.166.20/TheSansB_400_.woff2 Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://zahlung-fees.ch/195.162.166.20/index_files/webcomponents/webcomponents.lgd0guuk.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://zahlung-fees.ch/195.162.166.20/TheSansB_300_.woff Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://zahlung-fees.ch/195.162.166.20/sdx-icons.woff Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://zahlung-fees.ch/195.162.166.20/TheSansB_400_.woff Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://zahlung-fees.ch/195.162.166.20/TheSansB_300_.ttf Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://zahlung-fees.ch/195.162.166.20/sdx-icons.ttf Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://zahlung-fees.ch/195.162.166.20/TheSansB_400_.ttf Message: Failed to load resource: the server responded with a status of 404 (Not Found)
javascript	error	URL: https://zahlung-fees.ch/195.162.166.20/index.php?ip=195.162.166.20 Message: Access to script at 'https://service-login.sso.bluewin.ch/node_modules/sdx/dist/js/webcomponents/webcomponents/ty0ne4z6.entry.js' from origin 'https://zahlung-fees.ch' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://service-login.sso.bluewin.ch/node_modules/sdx/dist/js/webcomponents/webcomponents/ty0ne4z6.entry.js Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://zahlung-fees.ch/195.162.166.20/index.php?ip=195.162.166.20 Message: Access to script at 'https://service-login.sso.bluewin.ch/node_modules/sdx/dist/js/webcomponents/webcomponents/mibbflfq.entry.js' from origin 'https://zahlung-fees.ch' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://service-login.sso.bluewin.ch/node_modules/sdx/dist/js/webcomponents/webcomponents/mibbflfq.entry.js Message: Failed to load resource: net::ERR_FAILED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

service-login.sso.bluewin.ch
zahlung-fees.ch
service-login.sso.bluewin.ch
13.85.7.130
1144829a9ad0289481915946a961245b8b88402d635a2e7bca9e3e589903c243
1573af38d48a35675d955142f69dcc06c6e5d5b78193f86763d2750f39770d6b
231fefe41695871b5d409e94c22520bafb7ba46d37071ab956ba73f9ad0f1905
3b3d4c57d3694575c88a29fb1c9faad1a6e361778ba705dbe017e699fbe4a79d
5ad15e30f915778a7f512d442dd2e6aad992f1e0aa44dbcd3b3a19ba7002f324
5b852a24046a17a29ddca92bee7b9f7f8cef9d770154ce3b12c7456239e1aba9
8cd1ddd3283f6cd5ac76b3bcc3a0b839431659ad65f024dca082234f84773257
a2d412121620524a5a34997c31f2ea9cf9fcb5c4f7b8a4e73afe88e8a4988c1c
a482ff648905575cfbe2e0a4dbb570441656fc8715e86ed8796f99ea5f1d345c
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

zahlung-fees.ch Open in urlscan Pro 13.85.7.130 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

22 Requests

91 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

791 kBTransfer

789 kBSize

0 Cookies

2 Outgoing links

Redirected requests

22 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

37 JavaScript Global Variables

0 Cookies

15 Console Messages

Indicators

zahlung-fees.ch Open in urlscan Pro
13.85.7.130 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

22
Requests

91 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

791 kB
Transfer

789 kB
Size

0
Cookies

22 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!