tulefibi.myhostpoint.ch
Open in
urlscan Pro
2a00:d70:0:b:2002:0:d91a:340f
Malicious Activity!
Public Scan
Submitted URL: https://tulefibi.myhostpoint.ch/fr/
Effective URL: https://tulefibi.myhostpoint.ch/fr/formulaireInfos.php?op=c%26url=aHR0cHM6Ly9jZnNwYXJ0LmltcG90cy5nb3V2LmZyLw==
Submission: On March 19 via manual from NL — Scanned from CH
Effective URL: https://tulefibi.myhostpoint.ch/fr/formulaireInfos.php?op=c%26url=aHR0cHM6Ly9jZnNwYXJ0LmltcG90cy5nb3V2LmZyLw==
Submission: On March 19 via manual from NL — Scanned from CH
Summary
This website contacted 5 IPs
in 3 countries
across 5 domains to perform 16 HTTP transactions.
The main IP is 2a00:d70:0:b:2002:0:d91a:340f, located in
Switzerland and
belongs to HOSTPOINT-AS, CH.
The main domain is tulefibi.myhostpoint.ch.
TLS certificate: Issued by R3 on March 18th 2024. Valid for: 3 months.
This is the only time tulefibi.myhostpoint.ch was scanned on urlscan.io!
TLS certificate: Issued by R3 on March 18th 2024. Valid for: 3 months.
This is the only time tulefibi.myhostpoint.ch was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Assurance Maladie (Healthcare)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 12 | 2a00:d70:0:b:... 2a00:d70:0:b:2002:0:d91a:340f | 29097 (HOSTPOINT-AS) (HOSTPOINT-AS) | |
| 1 | 50.62.137.55 50.62.137.55 | 398101 (GO-DADDY-...) (GO-DADDY-COM-LLC) | |
| 1 | 146.75.120.193 146.75.120.193 | 54113 (FASTLY) (FASTLY) | |
| 1 | 2a00:1450:400... 2a00:1450:4001:828::200a | 15169 (GOOGLE) (GOOGLE) | |
| 1 | 2a00:1450:400... 2a00:1450:4001:80f::2003 | 15169 (GOOGLE) (GOOGLE) | |
| 16 | 5 |
1
50.62.137.55
(United States)
ASN398101 (GO-DADDY-COM-LLC, US)
PTR: 55.137.62.50.host.secureserver.net
ASN398101 (GO-DADDY-COM-LLC, US)
PTR: 55.137.62.50.host.secureserver.net
| www.trainsandtravel.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 12 |
myhostpoint.ch
tulefibi.myhostpoint.ch |
266 KB |
| 1 |
gstatic.com
fonts.gstatic.com |
19 KB |
| 1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 110 |
2 KB |
| 1 |
imgur.com
i.imgur.com — Cisco Umbrella Rank: 7266 |
24 KB |
| 1 |
trainsandtravel.com
www.trainsandtravel.com |
46 KB |
| 16 | 5 |
| Domain | Requested by | |
|---|---|---|
| 12 | tulefibi.myhostpoint.ch |
tulefibi.myhostpoint.ch
|
| 1 | fonts.gstatic.com |
fonts.googleapis.com
|
| 1 | fonts.googleapis.com |
tulefibi.myhostpoint.ch
|
| 1 | i.imgur.com |
tulefibi.myhostpoint.ch
|
| 1 | www.trainsandtravel.com |
tulefibi.myhostpoint.ch
|
| 16 | 5 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| tulefibi.myhostpoint.ch R3 |
2024-03-18 - 2024-06-16 |
3 months | crt.sh |
| trainsandtravel.com Go Daddy Secure Certificate Authority - G2 |
2023-12-09 - 2024-05-22 |
5 months | crt.sh |
| *.imgur.com Sectigo RSA Domain Validation Secure Server CA |
2024-02-15 - 2025-02-14 |
a year | crt.sh |
| upload.video.google.com GTS CA 1C3 |
2024-02-19 - 2024-05-13 |
3 months | crt.sh |
| *.gstatic.com GTS CA 1C3 |
2024-02-19 - 2024-05-13 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://tulefibi.myhostpoint.ch/fr/formulaireInfos.php?op=c%26url=aHR0cHM6Ly9jZnNwYXJ0LmltcG90cy5nb3V2LmZyLw==
Frame ID: 6C061E6D3DA4E350FC4E42EE663F7445
Requests: 16 HTTP requests in this frame
Screenshot
Page Title
Formulaire de remboursement électronique | AmeliPage URL History Show full URLs
- https://tulefibi.myhostpoint.ch/fr/ Page URL
- https://tulefibi.myhostpoint.ch/fr/formulaireInfos.php?op=c%26url=aHR0cHM6Ly9jZnNwYXJ0LmltcG90cy5nb3V2LmZyLw== Page URL
Detected technologies
WordPress
(CMS)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- /wp-(?:content|includes)/
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- \.php(?:$|\?)
Bootstrap
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Font Awesome
(Font Scripts)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://tulefibi.myhostpoint.ch/fr/ Page URL
- https://tulefibi.myhostpoint.ch/fr/formulaireInfos.php?op=c%26url=aHR0cHM6Ly9jZnNwYXJ0LmltcG90cy5nb3V2LmZyLw== Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
16 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
/
tulefibi.myhostpoint.ch/fr/ |
324 B 361 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
Primary Request
formulaireInfos.php
tulefibi.myhostpoint.ch/fr/ |
9 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bootstrap.min.css
tulefibi.myhostpoint.ch/fr/templates/styles/ |
105 KB 17 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
commun.css
tulefibi.myhostpoint.ch/fr/templates/styles/ |
6 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
mire.css
tulefibi.myhostpoint.ch/fr/templates/styles/ |
2 KB 963 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
dac.css
tulefibi.myhostpoint.ch/fr/templates/styles/ |
771 B 526 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
font-awesome.min.css
tulefibi.myhostpoint.ch/fr/templates/fa/css/ |
30 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
109-credit-cards-accepted-logo.jpg
www.trainsandtravel.com/wp-content/uploads/2017/10/ |
46 KB 46 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
apbqYpg.png
i.imgur.com/ |
23 KB 24 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery.min.js
tulefibi.myhostpoint.ch/fr/templates/js/ |
84 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bootstrap.min.js
tulefibi.myhostpoint.ch/fr/templates/js/ |
33 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery.details.js
tulefibi.myhostpoint.ch/fr/templates/js/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
css
fonts.googleapis.com/ |
6 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
logo.png
tulefibi.myhostpoint.ch/fr/templates/styles/ |
120 KB 120 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2
fonts.gstatic.com/s/opensans/v40/ |
18 KB 19 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
fontawesome-webfont.woff2
tulefibi.myhostpoint.ch/fr/templates/fa/fonts/ |
75 KB 75 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Assurance Maladie (Healthcare)5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| date function| checkValue object| newInput function| $ function| jQuery0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
fonts.gstatic.com
i.imgur.com
tulefibi.myhostpoint.ch
www.trainsandtravel.com
146.75.120.193
2a00:1450:4001:80f::2003
2a00:1450:4001:828::200a
2a00:d70:0:b:2002:0:d91a:340f
50.62.137.55
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
07a4d78d858bb93b3220fd4af3f599035ea5e4f932bfb53b1196ee328116c5b9
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
5855e46c06a579710d4830ccd092c4735c9380a193b5dad9b61b6752f3450b47
75b52a07e8d4d433f8dc2dd323b7661d7945611c3258161ce37772f4dda615ad
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
9a6bbae7a8486cff86f36b0a14cd93824f5cba396cfb99b0d20889dd06b98c55
9cddc7c4103da2c7fc0e4aaefc621dfb5686d61776d71b97df63fa59205f430e
c3061c3788ad5783ef8a5d10c454bafe7eb942c48200dccc852cc6d3c9f303d4
c3eb3265dddf3a7527147670249ad8a956870e0fa4c3dfaf99a3b4d737ca56c8
caf5f9dd911eee56bf9b602dd8aaf29fc5f7f0bdceb9e755f1a7ed22a0ec457a
cece61d8fd5fbeb96fa77967e4bbc4aa19e4111468133b5cd1521c1b823b43bc
e705a4927f1869ce7c82aa679a6cd8d48b004e8ad36f3f9f1888a17162a4b814
e7af9d60d875eb1c1b1037bbbfdec41fcb096d0ebcf98a48717ad8b07906ced6
e8a155d7bfd6bd83dcfe9105bef4e233573cb9cf3d55d051f9143888ec4fa564
feb2c90181ca199fe02f5f33f99d418953958a514fd8952f771ffe8210808e20