kat.zcr.mybluehost.me
Open in
urlscan Pro
162.241.230.119
Malicious Activity!
Public Scan
Effective URL: https://kat.zcr.mybluehost.me/part/
Submission: On April 07 via api from HU — Scanned from CH
Summary
TLS certificate: Issued by R3 on April 5th 2024. Valid for: 3 months.
This is the only time kat.zcr.mybluehost.me was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Schweizerische Bundesbahnen (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 77.164.164.132 77.164.164.132 | 1136 (KPN KPN N...) (KPN KPN National) | |
1 20 | 162.241.230.119 162.241.230.119 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
1 2 | 18.66.186.57 18.66.186.57 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 188.114.97.3 188.114.97.3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
23 | 4 |
ASN1136 (KPN KPN National, NL)
PTR: 77-164-164-132.fixed.kpn.net
ip4da4a484.direct-adsl.nl |
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: box5320.bluehost.com
kat.zcr.mybluehost.me |
ASN16509 (AMAZON-02, US)
PTR: server-18-66-186-57.muc50.r.cloudfront.net
logs1407.xiti.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
20 |
mybluehost.me
1 redirects
kat.zcr.mybluehost.me |
408 KB |
2 |
xiti.com
1 redirects
logs1407.xiti.com — Cisco Umbrella Rank: 123675 |
1 KB |
2 |
direct-adsl.nl
ip4da4a484.direct-adsl.nl |
3 KB |
1 |
userstatics.com
userstatics.com — Cisco Umbrella Rank: 92069 |
704 B |
23 | 4 |
Domain | Requested by | |
---|---|---|
20 | kat.zcr.mybluehost.me |
1 redirects
kat.zcr.mybluehost.me
|
2 | logs1407.xiti.com |
1 redirects
kat.zcr.mybluehost.me
|
2 | ip4da4a484.direct-adsl.nl | |
1 | userstatics.com |
kat.zcr.mybluehost.me
|
23 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
synology Synology Inc. CA |
2023-12-03 - 2024-12-03 |
a year | crt.sh |
webdisk.kat.zcr.mybluehost.me R3 |
2024-04-05 - 2024-07-04 |
3 months | crt.sh |
userstatics.com E1 |
2024-03-28 - 2024-06-26 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://kat.zcr.mybluehost.me/part/
Frame ID: 9DCC67DFCD3B18D784595D161941AD4D
Requests: 23 HTTP requests in this frame
Screenshot
Page Title
Anmeldung | SwissPassPage URL History Show full URLs
-
http://ip4da4a484.direct-adsl.nl/wordpress/wp-content/
HTTP 307
https://ip4da4a484.direct-adsl.nl/wordpress/wp-content/ Page URL
-
https://kat.zcr.mybluehost.me/part
HTTP 301
https://kat.zcr.mybluehost.me/part/ Page URL
Detected technologies
WordPress (CMS) ExpandDetected patterns
- /wp-(?:content|includes)/
Modernizr (JavaScript Libraries) Expand
Detected patterns
- ([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js
OneTrust (Cookie compliance) Expand
Detected patterns
- otSDKStub\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://ip4da4a484.direct-adsl.nl/wordpress/wp-content/
HTTP 307
https://ip4da4a484.direct-adsl.nl/wordpress/wp-content/ Page URL
-
https://kat.zcr.mybluehost.me/part
HTTP 301
https://kat.zcr.mybluehost.me/part/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://ip4da4a484.direct-adsl.nl/wordpress/wp-content/ HTTP 307
- https://ip4da4a484.direct-adsl.nl/wordpress/wp-content/
- https://logs1407.xiti.com/event?s=611076 HTTP 307
- https://logs1407.xiti.com/event?s=611076&Rdt=On
23 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
ip4da4a484.direct-adsl.nl/wordpress/wp-content/ Redirect Chain
|
81 B 217 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
kat.zcr.mybluehost.me/part/ Redirect Chain
|
25 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
ip4da4a484.direct-adsl.nl/ |
3 KB 3 KB |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sso.min-20200819.css
kat.zcr.mybluehost.me/part/css/ |
180 KB 34 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
modernizr-20200819.js
kat.zcr.mybluehost.me/part/js/ |
8 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
otSDKStub.js
kat.zcr.mybluehost.me/part/js/ |
21 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
launch-6cc731e967aa.min.js
kat.zcr.mybluehost.me/part/js/ |
124 KB 49 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo_text_de-20200819.svg
kat.zcr.mybluehost.me/part/images/ |
137 KB 137 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo-20200819.svg
kat.zcr.mybluehost.me/part/images/ |
7 KB 7 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
loader-20200819.png
kat.zcr.mybluehost.me/part/images/ |
272 B 351 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-20200819.js
kat.zcr.mybluehost.me/part/js/ |
95 KB 42 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vendor.min-20200819.js
kat.zcr.mybluehost.me/part/js/ |
176 KB 67 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
swisspass.min-20200819.js
kat.zcr.mybluehost.me/part/js/ |
97 KB 36 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
SBBWeb-Light.woff2
kat.zcr.mybluehost.me/part/fonts/ |
14 KB 14 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
e91f4b90-f9aa-4ace-891b-96dd07595d9f-test.json
kat.zcr.mybluehost.me/part/js/otSDKStub.js/consent/e91f4b90-f9aa-4ace-891b-96dd07595d9f-test/ |
315 B 343 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login_bg.jpg
kat.zcr.mybluehost.me/part/resources/img/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icomoon.woff2
kat.zcr.mybluehost.me/fonts/icomoon/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icomoon.ttf
kat.zcr.mybluehost.me/fonts/icomoon/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
co-branding
kat.zcr.mybluehost.me/idp/ |
3 KB 1 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
event
logs1407.xiti.com/ Redirect Chain
|
0 332 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icomoon.woff
kat.zcr.mybluehost.me/fonts/icomoon/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
kat.zcr.mybluehost.me/part/ |
1 KB 1 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
script.js
userstatics.com/get/ |
133 B 704 B |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Schweizerische Bundesbahnen (Transportation)32 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| digitalDataLayer object| html5 object| Modernizr object| OneTrustStub object| digitalData object| dataLayerEvent function| OptanonWrapper function| validateForm function| closeModal function| $ function| jQuery object| jQuery11200878450316495365 function| A11yDialog function| iFrameResize function| Cleave function| OevcResourceLoader object| dp object| oevc object| webtrends boolean| isMobile function| validate object| options object| attrs object| allowedProviders object| rememberMe boolean| providerAllowsRememberMe object| _satellite boolean| __satelliteLoaded object| _pac object| pdl object| _paqueue object| pa4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
kat.zcr.mybluehost.me/part | Name: PHPREFS Value: full |
|
.mybluehost.me/ | Name: pa_privacy Value: %22optin%22 |
|
.mybluehost.me/ | Name: _pctx Value: %7Bu%7DN4IgrgzgpgThIC4B2YA2qA05owMoBcBDfSREQpAeyRCwgEt8oBJAE0RXSwH18yBbQqwCeAdkoAGAB4AfVGAAOAK0IA2SsJABfIA |
|
.xiti.com/ | Name: atid Value: 7940EB84-AF9A-453C-89D0-4A58D01EA06D |
11 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ip4da4a484.direct-adsl.nl
kat.zcr.mybluehost.me
logs1407.xiti.com
userstatics.com
162.241.230.119
18.66.186.57
188.114.97.3
77.164.164.132
17f8f67cb7891d3740b45b45b85e282c9d6f80806af1e4374e56fca6778b0b25
1f6e67bc886cbf171ee9cb58e9985ddbf7e636315cec4f2034625a758d1f5b45
233ddeda2a0fbeee053d13f25669fe187bdef4fe708aacfadddd560905d209f1
2b2485b0669a2f73c4846e82eb5a37421358591a8ac8ba21d8149bfb88adcbfb
5c7f0e173844556da7ca5eb8936fa3dab1c00206960920a49a1eea9cde2bfaaf
6d72fa0f78c80b1874d3ee4aadf43d973edc442a65fef83d37e684ac559893b7
7a9fa521a58ee93001981f3a7db498c589233d8cc616e8d09af0119388a865bc
7c1925da382279a72f94990d0a1456f78918619f35780ea0905e4ae0db684677
9c50211b34ab0377f3b35c243c98e402315127bfa5b51e147cb22c702174ca60
c337d42ed7979c6be0282900bd957dd9d112a430dc7761463d655eb8f0d9bc07
c365cf63e0edecc072b99e919e45604dfbca32ec0a19dac39275c9c67d334caf
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
deeee170c3759a6ed35c0c05c5b935d0e7638f1c0c5677166918ecff6edb1909
df9690fea031319de38a437cb6d393026c4aae70642ed394c4254ed64f035b26
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f053f049a78c3afbce0d34f57d0bea4a24f7964d0e1e45197a35c06124b5e357
f766c7457c6ec463eaa85778aa47261344f1772e0b7cf1987ad212f889f472f5