suisserapostale.000webhostapp.com
Open in
urlscan Pro
2a02:4780:dead:37c9::1
Malicious Activity!
Public Scan
Submitted URL: http://www.asmomagic.com/js/a/
Effective URL: https://suisserapostale.000webhostapp.com/GovCERTch/sss/
Submission: On April 20 via api from JP — Scanned from JP
Effective URL: https://suisserapostale.000webhostapp.com/GovCERTch/sss/
Submission: On April 20 via api from JP — Scanned from JP
Summary
This website contacted 3 IPs
in 2 countries
across 2 domains to perform 13 HTTP transactions.
The main IP is 2a02:4780:dead:37c9::1, located in
United States and
belongs to AWEX, CY.
The main domain is suisserapostale.000webhostapp.com.
TLS certificate: Issued by RapidSSL TLS DV RSA Mixed SHA256 2020... on July 10th 2021. Valid for: a year.
This is the only time suisserapostale.000webhostapp.com was scanned on urlscan.io!
TLS certificate: Issued by RapidSSL TLS DV RSA Mixed SHA256 2020... on July 10th 2021. Valid for: a year.
This is the only time suisserapostale.000webhostapp.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Swiss Post (Transportation)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 | 178.128.219.46 178.128.219.46 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
| 11 | 2a02:4780:dea... 2a02:4780:dead:37c9::1 | 204915 (AWEX) (AWEX) | |
| 13 | 3 |
1
178.128.219.46
(Singapore, Singapore)
ASN14061 (DIGITALOCEAN-ASN, US)
PTR: 292360.cloudwaysapps.com
ASN14061 (DIGITALOCEAN-ASN, US)
PTR: 292360.cloudwaysapps.com
| www.asmomagic.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 11 |
000webhostapp.com
suisserapostale.000webhostapp.com |
92 KB |
| 1 |
asmomagic.com
www.asmomagic.com |
459 B |
| 13 | 2 |
| Domain | Requested by | |
|---|---|---|
| 11 | suisserapostale.000webhostapp.com |
suisserapostale.000webhostapp.com
|
| 1 | www.asmomagic.com | |
| 13 | 2 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.post.ch |
| www.bbc.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| *.000webhostapp.com RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1 |
2021-07-10 - 2022-08-10 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://suisserapostale.000webhostapp.com/GovCERTch/sss/
Frame ID: 81D46D71F71502CC21BDA3A7F4AE616A
Requests: 13 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- http://www.asmomagic.com/js/a/ Page URL
- https://suisserapostale.000webhostapp.com/GovCERTch/sss/ Page URL
Detected technologies
Bootstrap
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
URL: https://www.post.ch/de/
Title: Suche
Title: Suche
Search URL Search Domain Scan URL
URL: https://www.bbc.com/news/live/world-europe-60517447
Title: HERE
Title: HERE
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://www.asmomagic.com/js/a/ Page URL
- https://suisserapostale.000webhostapp.com/GovCERTch/sss/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
13 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
/
www.asmomagic.com/js/a/ |
101 B 459 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
Primary Request
/
suisserapostale.000webhostapp.com/GovCERTch/sss/ |
29 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bootstrap.min.css
suisserapostale.000webhostapp.com/GovCERTch/sss/index_files/ |
152 KB 29 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
jquery.js.t%C3%A9l%C3%A9chargement
suisserapostale.000webhostapp.com/GovCERTch/sss/index_files/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
index.css
suisserapostale.000webhostapp.com/GovCERTch/sss/index_files/ |
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
logo.png
suisserapostale.000webhostapp.com/GovCERTch/sss/index_files/ |
31 KB 32 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
search.svg
suisserapostale.000webhostapp.com/GovCERTch/sss/index_files/ |
694 B 909 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
user.svg
suisserapostale.000webhostapp.com/GovCERTch/sss/index_files/ |
802 B 1017 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
menu.svg
suisserapostale.000webhostapp.com/GovCERTch/sss/index_files/ |
722 B 937 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
icon-viza.png
suisserapostale.000webhostapp.com/GovCERTch/sss/index_files/ |
12 KB 12 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
icon-mastercard.png
suisserapostale.000webhostapp.com/GovCERTch/sss/index_files/ |
9 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery.js.t%C3%A9l%C3%A9chargement
suisserapostale.000webhostapp.com/GovCERTch/sss/index_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bootstrap.min.js.t%C3%A9l%C3%A9chargement
suisserapostale.000webhostapp.com/GovCERTch/sss/index_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- suisserapostale.000webhostapp.com
- URL
- https://suisserapostale.000webhostapp.com/GovCERTch/sss/index_files/jquery.js.t%C3%A9l%C3%A9chargement
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Swiss Post (Transportation)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| structuredClone object| oncontextlost object| oncontextrestored function| getScreenDetails0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
suisserapostale.000webhostapp.com
www.asmomagic.com
suisserapostale.000webhostapp.com
178.128.219.46
2a02:4780:dead:37c9::1
077439ea3716d63dae933cb63191214e8f9e6d78c51b36d1c99125f529206028
22566385067e3b9d672eeeefe4ae56af11389b988404f36b3adaac86d4a31788
2622b2c25f421b5871ba1916c96a9caba87634a84299778c7c5287998a00ce52
3ccf9b38c48e021de2191c3af9e8bba6f3eb8cbdf8763e85920d7f7248eb8577
553f8ca5047af59fcb8cd87060d056552715a072b5d8471f38b79ae77292348c
60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36
6798395b760cc84ee69eeb14d0d23e49d334033d05f7c6cd20e2a358bfa5d0e2
9535a7e85248902077b5a8bc431da64ef990f88b5ca8496a9f9b891e830477f4
b8d34de8de0e7cfdc8b1ab414aac93c814a47a0eb264761a10ebfe0ad12a5ff8
c73d5355aaea905c2a68ecf3b76f689954bfcce031e733f4b70dd12114c4c8a8