captcha.eduid.ch Open in urlscan Pro
2001:620:0:ff::76 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://captcha.eduid.ch/
Submission Tags: phishingrod
Submission: On June 21 via api (June 21st 2024, 6:11:43 am UTC) from DE — Scanned from CH

Summary HTTP 9 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 9 HTTP transactions. The main IP is 2001:620:0:ff::76, located in Hurden, Switzerland and belongs to SWITCH Peering requests: peering@switch.ch, CH. The main domain is captcha.eduid.ch.
TLS certificate: Issued by DigiCert EV RSA CA G2 on March 15th 2024. Valid for: a year.

This is the only time captcha.eduid.ch was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	2001:620:0:ff... 2001:620:0:ff::76	559 (SWITCH Pe...) (SWITCH Peering requests: peering@switch.ch)
3	2001:620:0:ff... 2001:620:0:ff::5c	559 (SWITCH Pe...) (SWITCH Peering requests: peering@switch.ch)
9	3

2 2001:620:0:ff::76 (Hurden, Switzerland)

ASN559 (SWITCH Peering requests: peering@switch.ch, CH)

captcha.eduid.ch	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2001:620:0:ff::5c (Hurden, Switzerland)

ASN559 (SWITCH Peering requests: peering@switch.ch, CH)

portal.switch.ch	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	switch.ch portal.switch.ch	196 KB
2	eduid.ch captcha.eduid.ch	3 KB
9	2

	Domain	Requested by
3	portal.switch.ch	captcha.eduid.ch portal.switch.ch
2	captcha.eduid.ch
9	2

This site contains links to these domains. Also see Links.

Domain
www.switch.ch

Subject Issuer	Validity	Valid
node1.lb.trid.switch.ch DigiCert EV RSA CA G2	`2024-03-15` - `2025-03-14`	a year	crt.sh
portal.switch.ch DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-06-17` - `2025-06-16`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://captcha.eduid.ch/
Frame ID: 4C8525DCA79A77C3BA01183F89DAC623
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

403 Forbidden - SWITCH

Page Statistics

9
Requests

56 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

199 kB
Transfer

339 kB
Size

0
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://www.switch.ch/
Title: Homepage

Search URL Search Domain Scan URL

URL: https://www.switch.ch/about/disclaimer/
Title: Legal Notice

Search URL Search Domain Scan URL

URL: https://www.switch.ch/about/imprint/
Title: Imprint

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 403 Primary Request / Show response
captcha.eduid.ch/ 2 KB
2 KB 112ms
16ms Document
text/html 2001:620:0:ff::76
SWITCH Peering re...

General

Check archive.org

Show headers Download Go to

Full URL: https://captcha.eduid.ch/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2001:620:0:ff::76 Hurden, Switzerland, ASN559 (SWITCH Peering requests: peering@switch.ch, CH),
Reverse DNS
Software: /
Resource Hash: 5ad77f58888d8784a8b63465e796adf2394beeb23faf1e741f93fe729d3e5b96

Request headers

Accept-Language: de-CH,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

cache-control: no-cache
content-type: text/html

GET
H/1.1 200
OK styles.css
portal.switch.ch/global-error-msgs/res/css/ 168 KB
27 KB 140ms
22ms Stylesheet
text/css 2001:620:0:ff::5c
SWITCH Peering re...

General

Check archive.org

Show headers Download Go to

Full URL

https://portal.switch.ch/global-error-msgs/res/css/styles.css

Requested by

Host: captcha.eduid.ch
URL: https://captcha.eduid.ch/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2001:620:0:ff::5c Hurden, Switzerland, ASN559 (SWITCH Peering requests: peering@switch.ch, CH),

Reverse DNS

Software

Apache /

Resource Hash

3e6db53df15731a7e40b360a985625aa6934111f94e9acf409c457d765108851

Security Headers

Name	Value
Content-Security-Policy	default-src .switch.ch; style-src 'unsafe-inline' .switch.ch; script-src 'unsafe-inline' 'unsafe-eval' 'self' .switch.ch; img-src data: .switch.ch; object-src 'none'; form-action 'self' ; font-src data: .switch.ch; frame-ancestors .switch.ch; frame-src
Strict-Transport-Security	max-age=63072000

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://captcha.eduid.ch/
Accept-Language: de-CH,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Fri, 21 Jun 2024 06:11:39 GMT
Strict-Transport-Security: max-age=63072000
Content-Encoding: gzip
Content-Security-Policy: default-src *.switch.ch; style-src 'unsafe-inline' *.switch.ch; script-src 'unsafe-inline' 'unsafe-eval' 'self' *.switch.ch; img-src data: *.switch.ch; object-src 'none'; form-action 'self' *; font-src data: *.switch.ch; frame-ancestors *.switch.ch; frame-src *
Last-Modified: Wed, 08 Feb 2017 13:12:58 GMT
Server: Apache
ETag: "2a1ab-548049f9f3e30-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=43200
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 27213
Expires: Fri, 21 Jun 2024 18:11:39 GMT

GET
H/1.1 200
OK error_bg.jpg
portal.switch.ch/global-error-msgs/res/images/ 164 KB
165 KB 17ms
16ms Image
image/jpeg 2001:620:0:ff::5c
SWITCH Peering re...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://portal.switch.ch/global-error-msgs/res/images/error_bg.jpg

Requested by

Host: portal.switch.ch
URL: https://portal.switch.ch/global-error-msgs/res/css/styles.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2001:620:0:ff::5c Hurden, Switzerland, ASN559 (SWITCH Peering requests: peering@switch.ch, CH),

Reverse DNS

Software

Apache /

Resource Hash

55f6ef011c4ad51f449b8c966b85c595ee5f2901c61db99faee4b0d92cfb8aff

Security Headers

Name	Value
Content-Security-Policy	default-src .switch.ch; style-src 'unsafe-inline' .switch.ch; script-src 'unsafe-inline' 'unsafe-eval' 'self' .switch.ch; img-src data: .switch.ch; object-src 'none'; form-action 'self' ; font-src data: .switch.ch; frame-ancestors .switch.ch; frame-src
Strict-Transport-Security	max-age=63072000

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://portal.switch.ch/global-error-msgs/res/css/styles.css
Accept-Language: de-CH,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Fri, 21 Jun 2024 06:11:39 GMT
Strict-Transport-Security: max-age=63072000
Content-Security-Policy: default-src *.switch.ch; style-src 'unsafe-inline' *.switch.ch; script-src 'unsafe-inline' 'unsafe-eval' 'self' *.switch.ch; img-src data: *.switch.ch; object-src 'none'; form-action 'self' *; font-src data: *.switch.ch; frame-ancestors *.switch.ch; frame-src *
Last-Modified: Wed, 08 Feb 2017 13:12:58 GMT
Server: Apache
ETag: "28faf-548049f9f6158"
Content-Type: image/jpeg
Cache-Control: max-age=43200
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 167855
Expires: Fri, 21 Jun 2024 18:11:39 GMT

GET
H/1.1 200
OK error_logo.png
portal.switch.ch/global-error-msgs/res/images/ 3 KB
4 KB 55ms
16ms Image
image/png 2001:620:0:ff::5c
SWITCH Peering re...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://portal.switch.ch/global-error-msgs/res/images/error_logo.png

Requested by

Host: portal.switch.ch
URL: https://portal.switch.ch/global-error-msgs/res/css/styles.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2001:620:0:ff::5c Hurden, Switzerland, ASN559 (SWITCH Peering requests: peering@switch.ch, CH),

Reverse DNS

Software

Apache /

Resource Hash

3f3d0e33aacd7479616d4888335a0247903b131a518e893d416bf78211314d8c

Security Headers

Name	Value
Content-Security-Policy	default-src .switch.ch; style-src 'unsafe-inline' .switch.ch; script-src 'unsafe-inline' 'unsafe-eval' 'self' .switch.ch; img-src data: .switch.ch; object-src 'none'; form-action 'self' ; font-src data: .switch.ch; frame-ancestors .switch.ch; frame-src
Strict-Transport-Security	max-age=63072000

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://portal.switch.ch/global-error-msgs/res/css/styles.css
Accept-Language: de-CH,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Fri, 21 Jun 2024 06:11:39 GMT
Strict-Transport-Security: max-age=63072000
Content-Security-Policy: default-src *.switch.ch; style-src 'unsafe-inline' *.switch.ch; script-src 'unsafe-inline' 'unsafe-eval' 'self' *.switch.ch; img-src data: *.switch.ch; object-src 'none'; form-action 'self' *; font-src data: *.switch.ch; frame-ancestors *.switch.ch; frame-src *
Last-Modified: Wed, 08 Feb 2017 13:12:58 GMT
Server: Apache
ETag: "d82-548049f9f6158"
Content-Type: image/png
Cache-Control: max-age=43200
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 3458
Expires: Fri, 21 Jun 2024 18:11:39 GMT

GET 889bdee1-8c94-46f0-9aa3-18470143c3ff.woff
portal.switch.ch/global-error-msgs/res/webfonts/ 0
0

GET 62100580-a2d1-4d98-bb14-d4c4c3f1a5ba.woff
portal.switch.ch/global-error-msgs/res/webfonts/ 0
0

GET
H2 403 favicon.ico
captcha.eduid.ch/ 2 KB
2 KB 17ms
16ms Other
text/html 2001:620:0:ff::76
SWITCH Peering re...

General

Check archive.org

Show headers Download Go to

Full URL: https://captcha.eduid.ch/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2001:620:0:ff::76 Hurden, Switzerland, ASN559 (SWITCH Peering requests: peering@switch.ch, CH),
Reverse DNS
Software: /
Resource Hash: 5ad77f58888d8784a8b63465e796adf2394beeb23faf1e741f93fe729d3e5b96

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://captcha.eduid.ch/
Accept-Language: de-CH,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

cache-control: no-cache
content-type: text/html

GET 7ae8e168-1c29-4fcb-bb59-0043c943df3b.ttf
portal.switch.ch/global-error-msgs/res/webfonts/ 0
0

GET 595cfe27-f15d-4a60-a589-c727a09e2bd8.ttf
portal.switch.ch/global-error-msgs/res/webfonts/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: portal.switch.ch
URL: https://portal.switch.ch/global-error-msgs/res/webfonts/889bdee1-8c94-46f0-9aa3-18470143c3ff.woff

Domain: portal.switch.ch
URL: https://portal.switch.ch/global-error-msgs/res/webfonts/62100580-a2d1-4d98-bb14-d4c4c3f1a5ba.woff

Domain: portal.switch.ch
URL: https://portal.switch.ch/global-error-msgs/res/webfonts/7ae8e168-1c29-4fcb-bb59-0043c943df3b.ttf

Domain: portal.switch.ch
URL: https://portal.switch.ch/global-error-msgs/res/webfonts/595cfe27-f15d-4a60-a589-c727a09e2bd8.ttf

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| event object| fence object| sharedStorage

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

10 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://captcha.eduid.ch/ Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://captcha.eduid.ch/favicon.ico Message: Failed to load resource: the server responded with a status of 403 ()
javascript	error	URL: https://captcha.eduid.ch/ Message: Access to font at 'https://portal.switch.ch/global-error-msgs/res/webfonts/62100580-a2d1-4d98-bb14-d4c4c3f1a5ba.woff' from origin 'https://captcha.eduid.ch' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://portal.switch.ch/global-error-msgs/res/webfonts/62100580-a2d1-4d98-bb14-d4c4c3f1a5ba.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://captcha.eduid.ch/ Message: Access to font at 'https://portal.switch.ch/global-error-msgs/res/webfonts/889bdee1-8c94-46f0-9aa3-18470143c3ff.woff' from origin 'https://captcha.eduid.ch' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://portal.switch.ch/global-error-msgs/res/webfonts/889bdee1-8c94-46f0-9aa3-18470143c3ff.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://captcha.eduid.ch/ Message: Access to font at 'https://portal.switch.ch/global-error-msgs/res/webfonts/7ae8e168-1c29-4fcb-bb59-0043c943df3b.ttf' from origin 'https://captcha.eduid.ch' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://portal.switch.ch/global-error-msgs/res/webfonts/7ae8e168-1c29-4fcb-bb59-0043c943df3b.ttf Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://captcha.eduid.ch/ Message: Access to font at 'https://portal.switch.ch/global-error-msgs/res/webfonts/595cfe27-f15d-4a60-a589-c727a09e2bd8.ttf' from origin 'https://captcha.eduid.ch' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://portal.switch.ch/global-error-msgs/res/webfonts/595cfe27-f15d-4a60-a589-c727a09e2bd8.ttf Message: Failed to load resource: net::ERR_FAILED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

captcha.eduid.ch
portal.switch.ch
portal.switch.ch
2001:620:0:ff::5c
2001:620:0:ff::76
3e6db53df15731a7e40b360a985625aa6934111f94e9acf409c457d765108851
3f3d0e33aacd7479616d4888335a0247903b131a518e893d416bf78211314d8c
55f6ef011c4ad51f449b8c966b85c595ee5f2901c61db99faee4b0d92cfb8aff
5ad77f58888d8784a8b63465e796adf2394beeb23faf1e741f93fe729d3e5b96

captcha.eduid.ch Open in urlscan Pro 2001:620:0:ff::76 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

9 Requests

56 %HTTPS

100 %IPv6

2 Domains

2 Subdomains

3 IPs

1 Countries

199 kBTransfer

339 kBSize

0 Cookies

3 Outgoing links

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

0 Cookies

10 Console Messages

Indicators

captcha.eduid.ch Open in urlscan Pro
2001:620:0:ff::76 Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

56 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

199 kB
Transfer

339 kB
Size

0
Cookies

9 HTTP transactions
0 data transactions