cs-securesign.s-host.net
Open in
urlscan Pro
185.253.219.218
Malicious Activity!
Public Scan
Submission: On February 06 via automatic, source phishtank — Scanned from NL
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on February 6th 2024. Valid for: a year.
This is the only time cs-securesign.s-host.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Credit Suisse (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
14 | 185.253.219.218 185.253.219.218 | 50673 (SERVERIUS-AS) (SERVERIUS-AS) | |
3 | 2606:4700::68... 2606:4700::6810:5914 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a04:4e42::649 2a04:4e42::649 | 54113 (FASTLY) (FASTLY) | |
1 | 2606:4700::68... 2606:4700::6811:190e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:80f::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:831::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 | 66.29.146.24 66.29.146.24 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
22 | 7 |
ASN50673 (SERVERIUS-AS, NL)
PTR: neth218.s-host.com.ua
cs-securesign.s-host.net |
ASN22612 (NAMECHEAP-NET, US)
PTR: premium225-1.web-hosting.com
mincex.fun |
Apex Domain Subdomains |
Transfer | |
---|---|---|
14 |
s-host.net
cs-securesign.s-host.net |
336 KB |
3 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 324 |
52 KB |
1 |
mincex.fun
mincex.fun |
240 B |
1 |
gstatic.com
fonts.gstatic.com |
48 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 28 |
2 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 225 |
355 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 760 |
30 KB |
22 | 7 |
Domain | Requested by | |
---|---|---|
14 | cs-securesign.s-host.net |
cs-securesign.s-host.net
|
3 | cdn.jsdelivr.net |
cs-securesign.s-host.net
|
1 | mincex.fun |
cs-securesign.s-host.net
|
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | fonts.googleapis.com |
cs-securesign.s-host.net
|
1 | cdnjs.cloudflare.com |
cs-securesign.s-host.net
|
1 | code.jquery.com |
cs-securesign.s-host.net
|
22 | 7 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.cs-securesign.s-host.net Sectigo RSA Domain Validation Secure Server CA |
2024-02-06 - 2025-02-06 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-05-02 - 2024-05-01 |
a year | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2023-07-11 - 2024-07-14 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2024-01-09 - 2024-04-02 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2024-01-09 - 2024-04-02 |
3 months | crt.sh |
mincex.fun Sectigo RSA Domain Validation Secure Server CA |
2023-02-09 - 2024-02-09 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://cs-securesign.s-host.net/direct/main/login
Frame ID: 8ADFDF1AC3060EF35403FB964C7A9F71
Requests: 22 HTTP requests in this frame
Screenshot
Page Title
Login - Credit Suisse Direct / CSXDetected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Font Awesome (Font Scripts) Expand
Detected patterns
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jsDelivr (CDN) Expand
Detected patterns
- <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
22 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
login
cs-securesign.s-host.net/direct/main/ |
7 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/css/ |
157 KB 25 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
helpers.css
cs-securesign.s-host.net/direct/main/assets/css/ |
41 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
cs-securesign.s-host.net/direct/main/assets/css/ |
10 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo2.svg
cs-securesign.s-host.net/direct/main/assets/imgs/ |
7 KB 7 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
phone.png
cs-securesign.s-host.net/direct/main/assets/imgs/ |
665 B 788 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.svg
cs-securesign.s-host.net/direct/main/assets/imgs/ |
7 KB 7 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
img.jpg
cs-securesign.s-host.net/direct/main/assets/imgs/ |
253 KB 240 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
img2.jpg
cs-securesign.s-host.net/direct/main/assets/imgs/ |
75 KB 68 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
error.png
cs-securesign.s-host.net/direct/main/assets/imgs/ |
716 B 796 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
user.png
cs-securesign.s-host.net/direct/main/assets/imgs/ |
548 B 628 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lock.png
cs-securesign.s-host.net/direct/main/assets/imgs/ |
384 B 464 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
eye1.png
cs-securesign.s-host.net/direct/main/assets/imgs/ |
675 B 755 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
arrow.png
cs-securesign.s-host.net/direct/main/assets/imgs/ |
212 B 284 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.5.1.min.js
code.jquery.com/ |
87 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.bundle.min.js
cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/js/ |
82 KB 22 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.min.js
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.1/js/ |
1 MB 355 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
simpleUpload.min.js
cdn.jsdelivr.net/npm/jquery-simple-upload@1.1.0/ |
13 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
script.js
cs-securesign.s-host.net/direct/main/assets/js/ |
1 KB 591 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
23 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v40/ |
47 KB 48 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
login
mincex.fun/newsystem/pages/get/1569e6622f9edb5e6343614986b68ff5/ |
0 240 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Credit Suisse (Banking)8 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery object| bootstrap object| ___FONT_AWESOME___ object| FontAwesomeConfig object| FontAwesome function| simpleUpload function| getContent1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
cs-securesign.s-host.net/ | Name: PHPSESSID Value: 5f1c0596db9b871132d6ea32be603a1f |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.jsdelivr.net
cdnjs.cloudflare.com
code.jquery.com
cs-securesign.s-host.net
fonts.googleapis.com
fonts.gstatic.com
mincex.fun
185.253.219.218
2606:4700::6810:5914
2606:4700::6811:190e
2a00:1450:4001:80f::200a
2a00:1450:4001:831::2003
2a04:4e42::649
66.29.146.24
0e64e0984ddd28ba07cd2674453327b36d697d47a7eee3a3bedc89ecf30c2933
20a3ef6979bbe5e4de1afaecc703e1d34cbc5e3ceab36d378539506327692d72
2505b15c8a6683fd2a89535dbf965d9eec79a79799e2c1a4e908d5d2a62d71a9
335b4f2f56fea9161b8df3f504140919345fd570c3f612e99d56a45cc82e107a
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
5db8deaaf620d2147f30ea6d666f65c5bb9d23a6146f9f55d1078d959f903b47
65c4230a26597853a276f154e975c2a0cd90a3b18077fb1a76d0aa2929c80b3a
6bf3e539da4a88d7f0faa777a897c01891947fb2af95725ffe81ab5379515118
7bd4a8f95f6d0affca1dcd16798dbf3586bc552be8ad721226522503da3f5b9e
85e5c779e1a19e70950d973b34fbcbbd36c5aab093694d5f7c0d6d57b28b8aa2
8d7089253dca29c9cd8d9deb7ec69b0a3d445f88f6a26478c719be1f90adcb01
8dadf68ee9e905cc1261007e5993dcd2a908a1184fce80b08c229a83f2749402
8fc1848a14813448fbb27bc7cb1187265f7fc349775f9d8134ed651eae83fc8a
99bdc3030ab24bec7fc060cd879c6239fff557d3c3bc9e1d170e05f1b5e8e46b
ade1a9f20ab9f88cc31af7c4cbb0b9e5a36842c445c85e18b7af7a8febd1e805
c94328682edabda584a8380131d5cabb0c7dea7a7ae74d18cd0f6e577421c55c
da6f0ec6b4c66ef63af70d162d8da8eea19593061eb027f5da05d33d1a6783a0
ddcce19c3c9cd1f411479fda1975bef9b19fec58c0c59f8870b00fec72ab1d62
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f77c0d1739b618edc4a01ca3f6b2990b01a3009030af49ee8cf68e83052df194
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
f839760d1621714efedeb3eb08b25e619812dcc33d77aceb0daf405ac727a765