www.gunnerstown.bid Open in urlscan Pro
104.18.38.116  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
5 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/	57 KB 12 KB	119ms 85ms	Document text/html	104.18.38.116 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/ Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.18.38.116 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 3a91c52f22f491ff4db14982224e823e55e39cb4641f159dead810225be4b8ce Request headers :path /Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/ pragma no-cache accept-encoding gzip, deflate upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8 cache-control no-cache :authority www.gunnerstown.bid :scheme https :method GET Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers date Wed, 28 Mar 2018 15:56:12 GMT content-encoding gzip server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/html; charset=UTF-8 status 200 x-turbo-charged-by LiteSpeed set-cookie __cfduid=d5c50392a95c76a79539af1ce4c17426d1522252572; expires=Thu, 28-Mar-19 15:56:12 GMT; path=/; domain=.gunnerstown.bid; HttpOnly cf-ray 402b49123ddd97fe-FRA
GET H2	200	ubs_styles.min.css www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/de_DE_base_UBS/	42 KB 19 KB	99ms 99ms	Stylesheet text/css	104.18.38.116 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/de_DE_base_UBS/ubs_styles.min.css Requested by Host: www.gunnerstown.bid URL: https://www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/ Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.18.38.116 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 360e24b70bf0e9feb60d6ad1b06c0e18979ccd5f8dbadc23579c798d32bb0573 Request headers :path /Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/de_DE_base_UBS/ubs_styles.min.css pragma no-cache cookie __cfduid=d5c50392a95c76a79539af1ce4c17426d1522252572 accept-encoding gzip, deflate user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 accept text/css,*/*;q=0.1 cache-control no-cache :authority www.gunnerstown.bid referer https://www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/ :scheme https :method GET Referer https://www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers date Wed, 28 Mar 2018 15:56:12 GMT content-encoding gzip cf-cache-status MISS last-modified Tue, 27 Mar 2018 07:05:30 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css status 200 cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes cf-ray 402b4912cec697fe-FRA content-length 19557 expires Wed, 04 Apr 2018 15:56:12 GMT
GET H2	200	x-out.js Show response www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/de_DE_base_UBS/	4 KB 2 KB	73ms 73ms	Script application/javascript	104.18.38.116 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/de_DE_base_UBS/x-out.js Requested by Host: www.gunnerstown.bid URL: https://www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/ Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.18.38.116 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 327b92231325994099d667ba75555c94b2c5b54c8e4e51bb39f11487d4d03850 Request headers :path /Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/de_DE_base_UBS/x-out.js pragma no-cache cookie __cfduid=d5c50392a95c76a79539af1ce4c17426d1522252572 accept-encoding gzip, deflate user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 accept */* cache-control no-cache :authority www.gunnerstown.bid referer https://www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/ :scheme https :method GET Referer https://www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers date Wed, 28 Mar 2018 15:56:12 GMT content-encoding gzip cf-cache-status MISS last-modified Tue, 27 Mar 2018 07:05:30 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript status 200 cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes cf-ray 402b4912cec797fe-FRA content-length 1691 expires Wed, 04 Apr 2018 15:56:12 GMT
GET H2	200	pwdbase.js Show response www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/de_DE_base_UBS/	5 KB 2 KB	76ms 76ms	Script application/javascript	104.18.38.116 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/de_DE_base_UBS/pwdbase.js Requested by Host: www.gunnerstown.bid URL: https://www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/ Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.18.38.116 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 26cf336d3db32508b816104373268f622576f806347f851963572c1d43915ab5 Request headers :path /Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/de_DE_base_UBS/pwdbase.js pragma no-cache cookie __cfduid=d5c50392a95c76a79539af1ce4c17426d1522252572 accept-encoding gzip, deflate user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 accept */* cache-control no-cache :authority www.gunnerstown.bid referer https://www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/ :scheme https :method GET Referer https://www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers date Wed, 28 Mar 2018 15:56:12 GMT content-encoding gzip cf-cache-status MISS last-modified Tue, 27 Mar 2018 07:05:30 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript status 200 cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes cf-ray 402b4912cec897fe-FRA content-length 1653 expires Wed, 04 Apr 2018 15:56:12 GMT
GET H2	200	alert-box.js Show response www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/de_DE_base_UBS/	898 B 787 B	76ms 76ms	Script application/javascript	104.18.38.116 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/de_DE_base_UBS/alert-box.js Requested by Host: www.gunnerstown.bid URL: https://www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/ Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.18.38.116 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 28f56a65f74f1869f6734574ad2cf524564b42cdb81b503cebac337205c3a0d4 Request headers :path /Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/de_DE_base_UBS/alert-box.js pragma no-cache cookie __cfduid=d5c50392a95c76a79539af1ce4c17426d1522252572 accept-encoding gzip, deflate user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 accept */* cache-control no-cache :authority www.gunnerstown.bid referer https://www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/ :scheme https :method GET Referer https://www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers date Wed, 28 Mar 2018 15:56:12 GMT content-encoding gzip cf-cache-status MISS last-modified Tue, 27 Mar 2018 07:05:30 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript status 200 cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes cf-ray 402b4912ced297fe-FRA content-length 417 expires Wed, 04 Apr 2018 15:56:12 GMT
GET H2	200	Icon-Message-Warning-36px.png www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/de_DE_base_UBS/images/	612 B 956 B	75ms 74ms	Image image/png	104.18.38.116 Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL https://www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/de_DE_base_UBS/images/Icon-Message-Warning-36px.png Requested by Host: www.gunnerstown.bid URL: https://www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/ Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.18.38.116 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 52d4dde222e154abdb195ebf411bb32d9404ee2c29b4ddacf3e817655c6549c3 Request headers :path /Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/de_DE_base_UBS/images/Icon-Message-Warning-36px.png pragma no-cache cookie __cfduid=d5c50392a95c76a79539af1ce4c17426d1522252572 accept-encoding gzip, deflate user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 accept image/webp,image/apng,image/*,*/*;q=0.8 cache-control no-cache :authority www.gunnerstown.bid referer https://www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/ :scheme https :method GET Referer https://www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers date Wed, 28 Mar 2018 15:56:12 GMT cf-cache-status MISS last-modified Tue, 27 Mar 2018 07:05:30 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/png status 200 cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes cf-ray 402b49137fa997fe-FRA content-length 612 expires Wed, 04 Apr 2018 15:56:12 GMT
GET H2	200	info-tip.png www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/de_DE_base_UBS/images/	675 B 1019 B	72ms 71ms	Image image/png	104.18.38.116 Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL https://www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/de_DE_base_UBS/images/info-tip.png Requested by Host: www.gunnerstown.bid URL: https://www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/ Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.18.38.116 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 09089d396309f5e00444ea381bed3228a6b65c175d9fafc38bfeb03ec9ca322b Request headers :path /Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/de_DE_base_UBS/images/info-tip.png pragma no-cache cookie __cfduid=d5c50392a95c76a79539af1ce4c17426d1522252572 accept-encoding gzip, deflate user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 accept image/webp,image/apng,image/*,*/*;q=0.8 cache-control no-cache :authority www.gunnerstown.bid referer https://www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/ :scheme https :method GET Referer https://www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers date Wed, 28 Mar 2018 15:56:12 GMT cf-cache-status MISS last-modified Tue, 27 Mar 2018 07:05:30 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/png status 200 cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes cf-ray 402b49137fab97fe-FRA content-length 675 expires Wed, 04 Apr 2018 15:56:12 GMT
GET H2	200	Credit_Card-Security_Code_2x.png www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/de_DE_base_UBS/images/	849 B 1 KB	74ms 73ms	Image image/png	104.18.38.116 Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL https://www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/de_DE_base_UBS/images/Credit_Card-Security_Code_2x.png Requested by Host: www.gunnerstown.bid URL: https://www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/ Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.18.38.116 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 65647f984e67ba00b2ee540d351f7fa717fbae95485d89e43d46aaf02d89d63a Request headers :path /Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/de_DE_base_UBS/images/Credit_Card-Security_Code_2x.png pragma no-cache cookie __cfduid=d5c50392a95c76a79539af1ce4c17426d1522252572 accept-encoding gzip, deflate user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 accept image/webp,image/apng,image/*,*/*;q=0.8 cache-control no-cache :authority www.gunnerstown.bid referer https://www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/ :scheme https :method GET Referer https://www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers date Wed, 28 Mar 2018 15:56:12 GMT cf-cache-status MISS last-modified Tue, 27 Mar 2018 07:05:30 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/png status 200 cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes cf-ray 402b49137fac97fe-FRA content-length 849 expires Wed, 04 Apr 2018 15:56:12 GMT
GET DATA	200 OK	truncated /	1 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 6646272c709ebd37f57f3ac621ec5ed2f45193f64f720952562a64153c7ae0af Request headers Response headers Access-Control-Allow-Origin * Content-Type image/svg+xml
GET DATA	200 OK	truncated /	1 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 6b5a54a14224f8cfc903e17afb3be18c2bd3b86b7223acd3435136d567ea7eab Request headers Response headers Access-Control-Allow-Origin * Content-Type image/svg+xml
GET DATA	200 OK	truncated /	4 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 7865525be8e3ad6b21468201db9c78a76e2398c17a1a88363e3d3e5d3d7cdd8d Request headers Response headers Access-Control-Allow-Origin * Content-Type image/svg+xml
GET DATA	200 OK	truncated /	4 KB 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 2aff7a73f46b3be0d835625a429aa7981750c0e12045c772c833553dd46d93ab Request headers Response headers Access-Control-Allow-Origin * Content-Type image/gif
GET DATA	200 OK	truncated /	526 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 329a54a4d1966abb2a846911add2bbee0944c6afd17cff49f3a86cb24a2e2c37 Request headers Response headers Access-Control-Allow-Origin * Content-Type image/svg+xml
GET H2	404	frutiger-light-webfont.woff www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/de_DE_base_UBS/fonts/	0 0	70ms 70ms	Font text/html	104.18.38.116 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/de_DE_base_UBS/fonts/frutiger-light-webfont.woff Requested by Host: www.gunnerstown.bid URL: https://www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/ Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.18.38.116 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash Request headers :path /Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/de_DE_base_UBS/fonts/frutiger-light-webfont.woff pragma no-cache cookie __cfduid=d5c50392a95c76a79539af1ce4c17426d1522252572 origin https://www.gunnerstown.bid accept-encoding gzip, deflate user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 accept */* cache-control no-cache :authority www.gunnerstown.bid referer https://www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/de_DE_base_UBS/ubs_styles.min.css :scheme https :method GET User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Referer https://www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/de_DE_base_UBS/ubs_styles.min.css Origin https://www.gunnerstown.bid Response headers pragma no-cache date Wed, 28 Mar 2018 15:56:12 GMT content-encoding gzip cf-cache-status MISS server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/html status 404 cache-control private, no-cache, no-store, must-revalidate, max-age=0 x-turbo-charged-by LiteSpeed cf-ray 402b49137fb897fe-FRA
GET H2	404	frutiger-light-webfont.ttf www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/de_DE_base_UBS/fonts/	0 0	70ms 69ms	Font text/html	104.18.38.116 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/de_DE_base_UBS/fonts/frutiger-light-webfont.ttf Requested by Host: www.gunnerstown.bid URL: https://www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/ Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.18.38.116 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash Request headers :path /Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/de_DE_base_UBS/fonts/frutiger-light-webfont.ttf pragma no-cache cookie __cfduid=d5c50392a95c76a79539af1ce4c17426d1522252572 origin https://www.gunnerstown.bid accept-encoding gzip, deflate user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 accept */* cache-control no-cache :authority www.gunnerstown.bid referer https://www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/de_DE_base_UBS/ubs_styles.min.css :scheme https :method GET User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Referer https://www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/de_DE_base_UBS/ubs_styles.min.css Origin https://www.gunnerstown.bid Response headers pragma no-cache date Wed, 28 Mar 2018 15:56:12 GMT content-encoding gzip cf-cache-status MISS server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/html status 404 cache-control private, no-cache, no-store, must-revalidate, max-age=0 x-turbo-charged-by LiteSpeed cf-ray 402b4913e86297fe-FRA
GET H2	404	frutiger-webfont.woff www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/de_DE_base_UBS/fonts/	0 0	71ms 71ms	Font text/html	104.18.38.116 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/de_DE_base_UBS/fonts/frutiger-webfont.woff Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.18.38.116 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash Request headers :path /Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/de_DE_base_UBS/fonts/frutiger-webfont.woff pragma no-cache cookie __cfduid=d5c50392a95c76a79539af1ce4c17426d1522252572 origin https://www.gunnerstown.bid accept-encoding gzip, deflate user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 accept */* cache-control no-cache :authority www.gunnerstown.bid referer https://www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/de_DE_base_UBS/ubs_styles.min.css :scheme https :method GET User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Referer https://www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/de_DE_base_UBS/ubs_styles.min.css Origin https://www.gunnerstown.bid Response headers pragma no-cache date Wed, 28 Mar 2018 15:56:12 GMT content-encoding gzip cf-cache-status MISS server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/html status 404 cache-control private, no-cache, no-store, must-revalidate, max-age=0 x-turbo-charged-by LiteSpeed cf-ray 402b4914693497fe-FRA
GET H2	404	frutiger-webfont.ttf www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/de_DE_base_UBS/fonts/	0 0	70ms 70ms	Font text/html	104.18.38.116 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/de_DE_base_UBS/fonts/frutiger-webfont.ttf Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.18.38.116 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash Request headers :path /Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/de_DE_base_UBS/fonts/frutiger-webfont.ttf pragma no-cache cookie __cfduid=d5c50392a95c76a79539af1ce4c17426d1522252572 origin https://www.gunnerstown.bid accept-encoding gzip, deflate user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 accept */* cache-control no-cache :authority www.gunnerstown.bid referer https://www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/de_DE_base_UBS/ubs_styles.min.css :scheme https :method GET User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Referer https://www.gunnerstown.bid/Themes/core/ups/web_PASS/portailinternet/Transactionnel/a920f14dbf808018af922246c592790e/de_DE_base_UBS/ubs_styles.min.css Origin https://www.gunnerstown.bid Response headers pragma no-cache date Wed, 28 Mar 2018 15:56:12 GMT content-encoding gzip cf-cache-status MISS server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/html status 404 cache-control private, no-cache, no-store, must-revalidate, max-age=0 x-turbo-charged-by LiteSpeed cf-ray 402b4914d9c997fe-FRA

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: UBS (Banking) Generic (Online)

63 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| CAPTURE_XOUT boolean| TRAP_RIGHT_CLICK number| KEY_F5 number| KEY_LEFT number| KEY_HOME number| KEY_R number| BTN_RIGHT boolean| isNS boolean| isIE boolean| isNS4 string| formTags function| gatherFormData function| onUnloadHandler function| OnClickHandler function| onDocClick function| onDocKeyDown function| ChipCardInAuthList function| ChipCardSelected function| CanFallBack function| AuthSelectExists function| SecurityWindow function| HelpWindow function| IsNetscapeOnSolaris function| OnCancelHandler function| OnCancelHandler2 function| OnSubmitHandler function| letterNumber function| SetSubmit function| ResetSubmit function| ClearPin function| OnFPWDHandler boolean| refreshing boolean| navigating boolean| closing string| tocName boolean| IsCancelButton string| optinLang function| OnPageInit function| ForceCancel function| OpenWindow function| infoU function| onBeforeUnloadHandler function| onFocusHandler function| OnLocaleChange object| loadError function| objError function| validateNotEmpty function| trimAll function| OnUserInput function| OnSubmitHandler1 function| setEngDisplay function| setFrenchDisplay function| setGermanDisplay function| setItalianDisplay function| fix function| setLocale function| setOpened function| processKey function| goAhead function| enrollmentFormOnSubmit function| Accept function| setType object| b

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.gunnerstown.bid/	1970-01-18 23:36:28	Name: __cfduid Value: d5c50392a95c76a79539af1ce4c17426d1522252572

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.gunnerstown.bid
104.18.38.116
09089d396309f5e00444ea381bed3228a6b65c175d9fafc38bfeb03ec9ca322b
26cf336d3db32508b816104373268f622576f806347f851963572c1d43915ab5
28f56a65f74f1869f6734574ad2cf524564b42cdb81b503cebac337205c3a0d4
2aff7a73f46b3be0d835625a429aa7981750c0e12045c772c833553dd46d93ab
327b92231325994099d667ba75555c94b2c5b54c8e4e51bb39f11487d4d03850
329a54a4d1966abb2a846911add2bbee0944c6afd17cff49f3a86cb24a2e2c37
360e24b70bf0e9feb60d6ad1b06c0e18979ccd5f8dbadc23579c798d32bb0573
3a91c52f22f491ff4db14982224e823e55e39cb4641f159dead810225be4b8ce
52d4dde222e154abdb195ebf411bb32d9404ee2c29b4ddacf3e817655c6549c3
65647f984e67ba00b2ee540d351f7fa717fbae95485d89e43d46aaf02d89d63a
6646272c709ebd37f57f3ac621ec5ed2f45193f64f720952562a64153c7ae0af
6b5a54a14224f8cfc903e17afb3be18c2bd3b86b7223acd3435136d567ea7eab
7865525be8e3ad6b21468201db9c78a76e2398c17a1a88363e3d3e5d3d7cdd8d