swingnuttours.com Open in urlscan Pro
45.64.104.223 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://swingnuttours.com/online/
Submission: On July 19 via automatic, source openphish (July 19th 2022, 2:09:17 am UTC) — Scanned from DE

Summary HTTP 11 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 11 HTTP transactions. The main IP is 45.64.104.223, located in Pune, India and belongs to NETWORK-LEAPSWITCH-IN LeapSwitch Networks Pvt Ltd, IN. The main domain is swingnuttours.com.
TLS certificate: Issued by R3 on June 14th 2022. Valid for: 3 months.

This is the only time swingnuttours.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: HSBC (Banking)

Domain & IP information

	IP Address		AS Autonomous System
11	45.64.104.223 45.64.104.223		132335 (NETWORK-L...) (NETWORK-LEAPSWITCH-IN LeapSwitch Networks Pvt Ltd)
11	1

11 45.64.104.223 (Pune, India)

ASN132335 (NETWORK-LEAPSWITCH-IN LeapSwitch Networks Pvt Ltd, IN)
PTR: in-pun-ln-srv139.advancedserverdns.com

swingnuttours.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	swingnuttours.com swingnuttours.com	279 KB
11	1

	Domain	Requested by
11	swingnuttours.com	swingnuttours.com
11	1

This site contains links to these domains. Also see Links.

Domain
www.hsbc.bm

Subject Issuer	Validity	Valid
*.swingnuttours.com R3	`2022-06-14` - `2022-09-12`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://swingnuttours.com/online/
Frame ID: AB59D535EF1A066F40D0D81C7A916F28
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Security

Page Statistics

11
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

279 kB
Transfer

1252 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.hsbc.bm/legal/cross-border-banking/
Title: Cross-border notice

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response swingnuttours.com/online/	24 KB 4 KB	1607ms 259ms	Document text/html	45.64.104.223 NETWORK-LEAPSWITC...
General Check archive.org Show headers Download Go to Full URL https://swingnuttours.com/online/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.64.104.223 Pune, India, ASN132335 (NETWORK-LEAPSWITCH-IN LeapSwitch Networks Pvt Ltd, IN), Reverse DNS in-pun-ln-srv139.advancedserverdns.com Software LiteSpeed / Resource Hash `869b8c9cbe965118e91186e32e369d98245516e5d4d2578b25a7ab01af15b35f` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-encoding br content-type text/html; charset=UTF-8 date Tue, 19 Jul 2022 02:09:11 GMT server LiteSpeed vary Accept-Encoding
GET H2	200	clientlib-default.min.91f7ec1e1f900424d14d513cd9754029.css swingnuttours.com/online/css/	841 KB 85 KB	342ms 334ms	Stylesheet text/css	45.64.104.223 NETWORK-LEAPSWITC...
General Check archive.org Show headers Download Go to Full URL https://swingnuttours.com/online/css/clientlib-default.min.91f7ec1e1f900424d14d513cd9754029.css Requested by Host: swingnuttours.com URL: https://swingnuttours.com/online/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.64.104.223 Pune, India, ASN132335 (NETWORK-LEAPSWITCH-IN LeapSwitch Networks Pvt Ltd, IN), Reverse DNS in-pun-ln-srv139.advancedserverdns.com Software LiteSpeed / Resource Hash `ab71ec6b8e00b06dd9b7f1e18e6b9150cbe3c39d116e5c873bb024c960b265e8` Request headers accept-language de-DE,de;q=0.9 Referer https://swingnuttours.com/online/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Tue, 19 Jul 2022 02:09:12 GMT content-encoding br last-modified Mon, 28 Mar 2022 14:34:30 GMT server LiteSpeed vary Accept-Encoding content-type text/css cache-control public, max-age=604800 accept-ranges bytes content-length 86870 expires Tue, 26 Jul 2022 02:09:12 GMT
GET H2	200	Transmitmain.min.05f3070217973d9301ad.css swingnuttours.com/online/css/	226 KB 36 KB	500ms 499ms	Stylesheet text/css	45.64.104.223 NETWORK-LEAPSWITC...
General Check archive.org Show headers Download Go to Full URL https://swingnuttours.com/online/css/Transmitmain.min.05f3070217973d9301ad.css Requested by Host: swingnuttours.com URL: https://swingnuttours.com/online/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.64.104.223 Pune, India, ASN132335 (NETWORK-LEAPSWITCH-IN LeapSwitch Networks Pvt Ltd, IN), Reverse DNS in-pun-ln-srv139.advancedserverdns.com Software LiteSpeed / Resource Hash `dde77b09e3847fee5d80279c4f9508195d63a1c8ca7b63b95f12ee6442ee1f87` Request headers accept-language de-DE,de;q=0.9 Referer https://swingnuttours.com/online/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Tue, 19 Jul 2022 02:09:12 GMT content-encoding br last-modified Mon, 17 Jan 2022 05:09:30 GMT server LiteSpeed vary Accept-Encoding content-type text/css cache-control public, max-age=604800 accept-ranges bytes content-length 36465 expires Tue, 26 Jul 2022 02:09:12 GMT
GET H2	200	clientlib-all.min.5c23575dd2a45b73c671a7797acc5d2d.css swingnuttours.com/online/css/	5 KB 572 B	500ms 499ms	Stylesheet text/css	45.64.104.223 NETWORK-LEAPSWITC...
General Check archive.org Show headers Download Go to Full URL https://swingnuttours.com/online/css/clientlib-all.min.5c23575dd2a45b73c671a7797acc5d2d.css Requested by Host: swingnuttours.com URL: https://swingnuttours.com/online/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.64.104.223 Pune, India, ASN132335 (NETWORK-LEAPSWITCH-IN LeapSwitch Networks Pvt Ltd, IN), Reverse DNS in-pun-ln-srv139.advancedserverdns.com Software LiteSpeed / Resource Hash `57e3bae6d7e9b1a74f9ad1420cdb3cb5e8bae34830b2c963c6317a261fa015d4` Request headers accept-language de-DE,de;q=0.9 Referer https://swingnuttours.com/online/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Tue, 19 Jul 2022 02:09:12 GMT content-encoding br last-modified Fri, 14 Jan 2022 22:04:56 GMT server LiteSpeed vary Accept-Encoding content-type text/css cache-control public, max-age=604800 accept-ranges bytes content-length 516 expires Tue, 26 Jul 2022 02:09:12 GMT
GET H2	200	hsbc-logo.svg swingnuttours.com/online/images/	5 KB 2 KB	460ms 460ms	Image image/svg+xml	45.64.104.223 NETWORK-LEAPSWITC...
General Check archive.org Show headers Download Go to Show image Full URL https://swingnuttours.com/online/images/hsbc-logo.svg Requested by Host: swingnuttours.com URL: https://swingnuttours.com/online/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.64.104.223 Pune, India, ASN132335 (NETWORK-LEAPSWITCH-IN LeapSwitch Networks Pvt Ltd, IN), Reverse DNS in-pun-ln-srv139.advancedserverdns.com Software LiteSpeed / Resource Hash `392961169ed068757ca4ccfba64f9a1e5cfd0e5c2467039ec5f0315afcb4de50` Request headers accept-language de-DE,de;q=0.9 Referer https://swingnuttours.com/online/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Tue, 19 Jul 2022 02:09:12 GMT content-encoding br last-modified Fri, 14 Jan 2022 22:00:12 GMT server LiteSpeed vary Accept-Encoding content-type image/svg+xml cache-control public, max-age=604800 accept-ranges bytes content-length 1879 expires Tue, 26 Jul 2022 02:09:12 GMT
GET H2	200	UniversNextforHSBC-Regular.woff swingnuttours.com/online/css/assets/fonts/UniversNextforHSBC-Regular/	26 KB 26 KB	171ms 165ms	Font font/woff	45.64.104.223 NETWORK-LEAPSWITC...
General Check archive.org Show headers Download Go to Full URL https://swingnuttours.com/online/css/assets/fonts/UniversNextforHSBC-Regular/UniversNextforHSBC-Regular.woff Requested by Host: swingnuttours.com URL: https://swingnuttours.com/online/css/clientlib-all.min.5c23575dd2a45b73c671a7797acc5d2d.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.64.104.223 Pune, India, ASN132335 (NETWORK-LEAPSWITCH-IN LeapSwitch Networks Pvt Ltd, IN), Reverse DNS in-pun-ln-srv139.advancedserverdns.com Software LiteSpeed / Resource Hash `f2c9f8279b2f7f4864ff4a2685306c9d978a30b82d0c396ed20752f22374c82f` Request headers Referer https://swingnuttours.com/online/css/clientlib-all.min.5c23575dd2a45b73c671a7797acc5d2d.css Origin https://swingnuttours.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Tue, 19 Jul 2022 02:09:12 GMT last-modified Mon, 22 Nov 2021 08:55:20 GMT server LiteSpeed content-type font/woff cache-control public, max-age=604800 accept-ranges bytes content-length 26196 expires Tue, 26 Jul 2022 02:09:12 GMT
GET H2	200	UniversNextforHSBCW02-Bd.woff swingnuttours.com/online/css/common/fonts/	26 KB 26 KB	172ms 167ms	Font font/woff	45.64.104.223 NETWORK-LEAPSWITC...
General Check archive.org Show headers Download Go to Full URL https://swingnuttours.com/online/css/common/fonts/UniversNextforHSBCW02-Bd.woff Requested by Host: swingnuttours.com URL: https://swingnuttours.com/online/css/clientlib-default.min.91f7ec1e1f900424d14d513cd9754029.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.64.104.223 Pune, India, ASN132335 (NETWORK-LEAPSWITCH-IN LeapSwitch Networks Pvt Ltd, IN), Reverse DNS in-pun-ln-srv139.advancedserverdns.com Software LiteSpeed / Resource Hash `1fe93d773a537c17456fc95e7dbfb69cba2914ac73c5f9b01d4db046667c688e` Request headers Referer https://swingnuttours.com/online/css/clientlib-default.min.91f7ec1e1f900424d14d513cd9754029.css Origin https://swingnuttours.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Tue, 19 Jul 2022 02:09:12 GMT last-modified Tue, 30 Nov 2021 05:28:26 GMT server LiteSpeed content-type font/woff cache-control public, max-age=604800 accept-ranges bytes content-length 26328 expires Tue, 26 Jul 2022 02:09:12 GMT
GET H2	200	UniversNextforHSBCW02-Rg.woff swingnuttours.com/online/css/common/fonts/	27 KB 27 KB	173ms 169ms	Font font/woff	45.64.104.223 NETWORK-LEAPSWITC...
General Check archive.org Show headers Download Go to Full URL https://swingnuttours.com/online/css/common/fonts/UniversNextforHSBCW02-Rg.woff Requested by Host: swingnuttours.com URL: https://swingnuttours.com/online/css/clientlib-default.min.91f7ec1e1f900424d14d513cd9754029.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.64.104.223 Pune, India, ASN132335 (NETWORK-LEAPSWITCH-IN LeapSwitch Networks Pvt Ltd, IN), Reverse DNS in-pun-ln-srv139.advancedserverdns.com Software LiteSpeed / Resource Hash `e57fa923e1242b94093a29bc1497e22d7b5f78d6f124fe5ffc651383af545e13` Request headers Referer https://swingnuttours.com/online/css/clientlib-default.min.91f7ec1e1f900424d14d513cd9754029.css Origin https://swingnuttours.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Tue, 19 Jul 2022 02:09:12 GMT last-modified Tue, 16 Nov 2021 06:11:12 GMT server LiteSpeed content-type font/woff cache-control public, max-age=604800 accept-ranges bytes content-length 27464 expires Tue, 26 Jul 2022 02:09:12 GMT
GET H2	200	HSBCIcon-Font.woff swingnuttours.com/online/css/assets/fonts/HSBCIcon-Font/	23 KB 23 KB	174ms 170ms	Font font/woff	45.64.104.223 NETWORK-LEAPSWITC...
General Check archive.org Show headers Download Go to Full URL https://swingnuttours.com/online/css/assets/fonts/HSBCIcon-Font/HSBCIcon-Font.woff Requested by Host: swingnuttours.com URL: https://swingnuttours.com/online/css/clientlib-all.min.5c23575dd2a45b73c671a7797acc5d2d.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.64.104.223 Pune, India, ASN132335 (NETWORK-LEAPSWITCH-IN LeapSwitch Networks Pvt Ltd, IN), Reverse DNS in-pun-ln-srv139.advancedserverdns.com Software LiteSpeed / Resource Hash `e9a3b36151838b0f414f746033f07a79989e9b4bbe327190e395ffe631ff7a31` Request headers Referer https://swingnuttours.com/online/css/clientlib-all.min.5c23575dd2a45b73c671a7797acc5d2d.css Origin https://swingnuttours.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Tue, 19 Jul 2022 02:09:12 GMT last-modified Mon, 15 Nov 2021 22:29:46 GMT server LiteSpeed content-type font/woff cache-control public, max-age=604800 accept-ranges bytes content-length 23724 expires Tue, 26 Jul 2022 02:09:12 GMT
GET H2	200	UniversNextforHSBC-Light.woff swingnuttours.com/online/css/assets/fonts/UniversNextforHSBC-Light/	24 KB 24 KB	174ms 171ms	Font font/woff	45.64.104.223 NETWORK-LEAPSWITC...
General Check archive.org Show headers Download Go to Full URL https://swingnuttours.com/online/css/assets/fonts/UniversNextforHSBC-Light/UniversNextforHSBC-Light.woff Requested by Host: swingnuttours.com URL: https://swingnuttours.com/online/css/clientlib-all.min.5c23575dd2a45b73c671a7797acc5d2d.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.64.104.223 Pune, India, ASN132335 (NETWORK-LEAPSWITCH-IN LeapSwitch Networks Pvt Ltd, IN), Reverse DNS in-pun-ln-srv139.advancedserverdns.com Software LiteSpeed / Resource Hash `9546a2b27fb48b2fcd03c45591d0c74aad14f707365f55b366937762204c41fa` Request headers Referer https://swingnuttours.com/online/css/clientlib-all.min.5c23575dd2a45b73c671a7797acc5d2d.css Origin https://swingnuttours.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Tue, 19 Jul 2022 02:09:12 GMT last-modified Sun, 14 Nov 2021 12:40:18 GMT server LiteSpeed content-type font/woff cache-control public, max-age=604800 accept-ranges bytes content-length 24956 expires Tue, 26 Jul 2022 02:09:12 GMT
GET H2	200	UniversNextforHSBCW02-Lt.woff swingnuttours.com/online/css/common/fonts/	26 KB 26 KB	175ms 172ms	Font font/woff	45.64.104.223 NETWORK-LEAPSWITC...
General Check archive.org Show headers Download Go to Full URL https://swingnuttours.com/online/css/common/fonts/UniversNextforHSBCW02-Lt.woff Requested by Host: swingnuttours.com URL: https://swingnuttours.com/online/css/clientlib-default.min.91f7ec1e1f900424d14d513cd9754029.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.64.104.223 Pune, India, ASN132335 (NETWORK-LEAPSWITCH-IN LeapSwitch Networks Pvt Ltd, IN), Reverse DNS in-pun-ln-srv139.advancedserverdns.com Software LiteSpeed / Resource Hash `1410bf3ef15162a56d0c7ea0f851483738179ce8281a269f4ed88612e9c9a695` Request headers Referer https://swingnuttours.com/online/css/clientlib-default.min.91f7ec1e1f900424d14d513cd9754029.css Origin https://swingnuttours.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Tue, 19 Jul 2022 02:09:12 GMT last-modified Wed, 12 Jan 2022 05:03:42 GMT server LiteSpeed content-type font/woff cache-control public, max-age=604800 accept-ranges bytes content-length 26300 expires Tue, 26 Jul 2022 02:09:12 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: HSBC (Banking)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

swingnuttours.com
45.64.104.223
1410bf3ef15162a56d0c7ea0f851483738179ce8281a269f4ed88612e9c9a695
1fe93d773a537c17456fc95e7dbfb69cba2914ac73c5f9b01d4db046667c688e
392961169ed068757ca4ccfba64f9a1e5cfd0e5c2467039ec5f0315afcb4de50
57e3bae6d7e9b1a74f9ad1420cdb3cb5e8bae34830b2c963c6317a261fa015d4
869b8c9cbe965118e91186e32e369d98245516e5d4d2578b25a7ab01af15b35f
9546a2b27fb48b2fcd03c45591d0c74aad14f707365f55b366937762204c41fa
ab71ec6b8e00b06dd9b7f1e18e6b9150cbe3c39d116e5c873bb024c960b265e8
dde77b09e3847fee5d80279c4f9508195d63a1c8ca7b63b95f12ee6442ee1f87
e57fa923e1242b94093a29bc1497e22d7b5f78d6f124fe5ffc651383af545e13
e9a3b36151838b0f414f746033f07a79989e9b4bbe327190e395ffe631ff7a31
f2c9f8279b2f7f4864ff4a2685306c9d978a30b82d0c396ed20752f22374c82f

swingnuttours.com Open in urlscan Pro 45.64.104.223 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

11 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

279 kBTransfer

1252 kBSize

0 Cookies

1 Outgoing links

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

0 Cookies

Indicators

swingnuttours.com Open in urlscan Pro
45.64.104.223 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

279 kB
Transfer

1252 kB
Size

0
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!