chpost.swissdatacenters.ch
195.22.153.143 Malicious Activity! Public Scan Open in urlscan Pro

Go To Rescan
Add Verdict Report

URL:
https://chpost.swissdatacenters.ch/slap/ 4yr old
Submission Tags: 7437599
Submission: On February 07 via api (February 7th 2022, 4:37:25 pm UTC) from US — Scanned from DE

Summary HTTP 21 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 21 HTTP transactions. The main IP is 195.22.153.143, located in Russian Federation and belongs to GARANT-PARK-INTERNET, RU. The main domain is chpost.swissdatacenters.ch. 4yr old
TLS certificate: Issued by R3 on February 7th 2022. Valid for: 3mo.

This is the only time chpost.swissdatacenters.ch was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Swiss Post (Transportation)

Domain & IP information

	IP Address		AS Autonomous System
21	195.22.153.143 195.22.153.143		47196 (GARANT-PA...) (GARANT-PARK-INTERNET)
21	1

21 195.22.153.143 (Russian Federation)

ASN47196 (GARANT-PARK-INTERNET, RU)

chpost.swissdatacenters.ch 4yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

	Apex Domain Subdomains	Transfer
21	swissdatacenters.ch chpost.swissdatacenters.ch 4yr old	406 KB
21	1

	Domain	Requested by
21	chpost.swissdatacenters.ch	chpost.swissdatacenters.ch
21	1

This site contains no links.

Subject Issuer	Validity	Valid
chpost.swissdatacenters.ch R3	`2022-02-07` - `2022-05-08`	3mo	crt.sh

This page contains 2 frames:

Primary Page: https://chpost.swissdatacenters.ch/slap/
Frame ID: 4F0603F2C6AA4FBC754640FCB530EF04
Requests: 9 HTTP requests in this frame

Frame: https://chpost.swissdatacenters.ch/slap/sandokhan.html
Frame ID: 9CAF3BA0B088F5776C6163BD3A2E7684
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Facturation en ligne

Detected technologies

Bootstrap (UI frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css

jQuery (JavaScript libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

21
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

406 kB
Transfer

401 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

21 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response chpost.swissdatacenters.ch/slap/	2 KB 2 KB	202ms 50ms	Document text/html	195.22.153.143 GARANT-PARK-INTERNET
General Check archive.org Download Go to Full URL https://chpost.swissdatacenters.ch/slap/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 195.22.153.143 , Russian Federation, ASN47196 (GARANT-PARK-INTERNET, RU), Reverse DNS Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 / Resource Hash `9b1c3a337e04ffbfee4fb17e746c58ddb290f6b2b037b6b615e34027522a5e85` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers Date Mon, 07 Feb 2022 16:37:25 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 Last-Modified Mon, 07 Sep 2020 18:00:46 GMT ETag "793-5aebcff6d6f80" Accept-Ranges bytes Content-Length 1939 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	bootstrap.min.css chpost.swissdatacenters.ch/slap/ekos/	107 KB 107 KB	52ms 51ms	Stylesheet text/css	195.22.153.143 GARANT-PARK-INTERNET
General Check archive.org Download Go to Full URL https://chpost.swissdatacenters.ch/slap/ekos/bootstrap.min.css Requested by Host: chpost.swissdatacenters.ch URL: https://chpost.swissdatacenters.ch/slap/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 195.22.153.143 , Russian Federation, ASN47196 (GARANT-PARK-INTERNET, RU), Reverse DNS Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 / Resource Hash `b5fd723750763ebb731f9221e413e7d64d58d5192dc040e42292ed3dcccca732` Request headers Accept-Language de-DE,de;q=0.9 Referer https://chpost.swissdatacenters.ch/slap/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Mon, 07 Feb 2022 16:37:25 GMT Last-Modified Mon, 27 Jul 2020 23:52:56 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 ETag "1abce-5ab750589e600" Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 109518
GET H/1.1	200 OK	desktop.css chpost.swissdatacenters.ch/slap/ekos/	10 KB 10 KB	148ms 48ms	Stylesheet text/css	195.22.153.143 GARANT-PARK-INTERNET
General Check archive.org Download Go to Full URL https://chpost.swissdatacenters.ch/slap/ekos/desktop.css Requested by Host: chpost.swissdatacenters.ch URL: https://chpost.swissdatacenters.ch/slap/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 195.22.153.143 , Russian Federation, ASN47196 (GARANT-PARK-INTERNET, RU), Reverse DNS Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 / Resource Hash `93e92f15020c203962ba140cc23ce3b9b377bb6355517e5a1afa1bef7cc41d75` Request headers Accept-Language de-DE,de;q=0.9 Referer https://chpost.swissdatacenters.ch/slap/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Mon, 07 Feb 2022 16:37:25 GMT Last-Modified Mon, 17 Aug 2020 23:54:10 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 ETag "28aa-5ad1b7c9dec80" Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 10410
GET H/1.1	200 OK	pubup.css chpost.swissdatacenters.ch/slap/	3 KB 4 KB	152ms 51ms	Stylesheet text/css	195.22.153.143 GARANT-PARK-INTERNET
General Check archive.org Download Go to Full URL https://chpost.swissdatacenters.ch/slap/pubup.css Requested by Host: chpost.swissdatacenters.ch URL: https://chpost.swissdatacenters.ch/slap/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 195.22.153.143 , Russian Federation, ASN47196 (GARANT-PARK-INTERNET, RU), Reverse DNS Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 / Resource Hash `2ad8aa586c18feb7a17ab5e0a3150dac220d13a4a393a2ef618d2524f94a5ad1` Request headers Accept-Language de-DE,de;q=0.9 Referer https://chpost.swissdatacenters.ch/slap/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Mon, 07 Feb 2022 16:37:25 GMT Last-Modified Tue, 18 Aug 2020 22:12:06 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 ETag "d09-5ad2e2d707980" Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 3337
GET H/1.1	200 OK	post-logo-svg_FR.svg chpost.swissdatacenters.ch/slap/	2 KB 2 KB	153ms 50ms	Image image/svg+xml	195.22.153.143 GARANT-PARK-INTERNET
General Check archive.org Download Go to Show image Full URL https://chpost.swissdatacenters.ch/slap/post-logo-svg_FR.svg Requested by Host: chpost.swissdatacenters.ch URL: https://chpost.swissdatacenters.ch/slap/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 195.22.153.143 , Russian Federation, ASN47196 (GARANT-PARK-INTERNET, RU), Reverse DNS Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 / Resource Hash `99caecb8475a08fc86c812cf804ddc904f6e6d3fd1591848a09f2413952f2a97` Request headers Accept-Language de-DE,de;q=0.9 Referer https://chpost.swissdatacenters.ch/slap/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Mon, 07 Feb 2022 16:37:25 GMT Last-Modified Mon, 07 Sep 2020 18:05:32 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 ETag "834-5aebd10797300" Content-Type image/svg+xml Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 2100
GET H/1.1	200 OK	ifram.css chpost.swissdatacenters.ch/slap/	807 B 1 KB	153ms 50ms	Stylesheet text/css	195.22.153.143 GARANT-PARK-INTERNET
General Check archive.org Download Go to Full URL https://chpost.swissdatacenters.ch/slap/ifram.css Requested by Host: chpost.swissdatacenters.ch URL: https://chpost.swissdatacenters.ch/slap/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 195.22.153.143 , Russian Federation, ASN47196 (GARANT-PARK-INTERNET, RU), Reverse DNS Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 / Resource Hash `aa0cec019b9949decffa697083d6529db01073164e758ed7c65ed51b83a9df08` Request headers Accept-Language de-DE,de;q=0.9 Referer https://chpost.swissdatacenters.ch/slap/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Mon, 07 Feb 2022 16:37:25 GMT Last-Modified Tue, 18 Aug 2020 22:08:58 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 ETag "327-5ad2e223bd280" Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 807
GET H/1.1	200 OK	2020-08-18_151724.png chpost.swissdatacenters.ch/slap/images/	945 B 1 KB	153ms 50ms	Image image/png	195.22.153.143 GARANT-PARK-INTERNET
General Check archive.org Download Go to Show image Full URL https://chpost.swissdatacenters.ch/slap/images/2020-08-18_151724.png Requested by Host: chpost.swissdatacenters.ch URL: https://chpost.swissdatacenters.ch/slap/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 195.22.153.143 , Russian Federation, ASN47196 (GARANT-PARK-INTERNET, RU), Reverse DNS Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 / Resource Hash `5e108c691f15b699121d1ce7f636a766b90202982d411a9dc11bcd209cc8aaf4` Request headers Accept-Language de-DE,de;q=0.9 Referer https://chpost.swissdatacenters.ch/slap/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Mon, 07 Feb 2022 16:37:25 GMT Last-Modified Mon, 07 Sep 2020 18:02:40 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 ETag "3b1-5aebd0638f000" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 945
GET H/1.1	200 OK	DF1N5_n.svg chpost.swissdatacenters.ch/slap/	6 KB 6 KB	59ms 58ms	Image image/svg+xml	195.22.153.143 GARANT-PARK-INTERNET
General Check archive.org Download Go to Show image Full URL https://chpost.swissdatacenters.ch/slap/DF1N5_n.svg Requested by Host: chpost.swissdatacenters.ch URL: https://chpost.swissdatacenters.ch/slap/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 195.22.153.143 , Russian Federation, ASN47196 (GARANT-PARK-INTERNET, RU), Reverse DNS Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 / Resource Hash `fa203714974b8949ce4049bd87cff044eaacf679dcec75275f53044e798831b8` Request headers Accept-Language de-DE,de;q=0.9 Referer https://chpost.swissdatacenters.ch/slap/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Mon, 07 Feb 2022 16:37:25 GMT Last-Modified Mon, 07 Sep 2020 18:01:30 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 ETag "184e-5aebd020cd280" Content-Type image/svg+xml Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 6222
GET H/1.1	200 OK	sandokhan.html Show response chpost.swissdatacenters.ch/slap/ Frame 9CAF	21 KB 21 KB	50ms 50ms	Document text/html	195.22.153.143 GARANT-PARK-INTERNET
General Check archive.org Download Go to Full URL https://chpost.swissdatacenters.ch/slap/sandokhan.html Requested by Host: chpost.swissdatacenters.ch URL: https://chpost.swissdatacenters.ch/slap/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 195.22.153.143 , Russian Federation, ASN47196 (GARANT-PARK-INTERNET, RU), Reverse DNS Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 / Resource Hash `4aa1b86d2f7e14f50ca43f2aac3eabac365ce9003e5c53dafc65eea8e4244c33` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://chpost.swissdatacenters.ch/slap/ Response headers Date Mon, 07 Feb 2022 16:37:25 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 Last-Modified Mon, 07 Sep 2020 18:08:18 GMT ETag "533c-5aebd1a5e6880" Accept-Ranges bytes Content-Length 21308 Keep-Alive timeout=5, max=98 Connection Keep-Alive Content-Type text/html; charset=UTF-8
GET H/1.1	404 Not Found	Open_Sans.woff chpost.swissdatacenters.ch/slap/ekos/	0 0	49ms 49ms	Font text/html	195.22.153.143 GARANT-PARK-INTERNET
General Check archive.org Download Go to Full URL https://chpost.swissdatacenters.ch/slap/ekos/Open_Sans.woff Requested by Host: chpost.swissdatacenters.ch URL: https://chpost.swissdatacenters.ch/slap/ekos/desktop.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 195.22.153.143 , Russian Federation, ASN47196 (GARANT-PARK-INTERNET, RU), Reverse DNS Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 / Resource Hash Request headers Referer https://chpost.swissdatacenters.ch/slap/ekos/desktop.css Origin https://chpost.swissdatacenters.ch Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Mon, 07 Feb 2022 16:37:25 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 Connection Keep-Alive Keep-Alive timeout=5, max=98 Content-Length 222 Content-Type text/html; charset=iso-8859-1
GET H/1.1	404 Not Found	cvv.css chpost.swissdatacenters.ch/slap/ Frame 9CAF	0 0	50ms 49ms	Stylesheet text/html	195.22.153.143 GARANT-PARK-INTERNET
General Check archive.org Download Go to Full URL https://chpost.swissdatacenters.ch/slap/cvv.css Requested by Host: chpost.swissdatacenters.ch URL: https://chpost.swissdatacenters.ch/slap/sandokhan.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 195.22.153.143 , Russian Federation, ASN47196 (GARANT-PARK-INTERNET, RU), Reverse DNS Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 / Resource Hash Request headers Accept-Language de-DE,de;q=0.9 Referer https://chpost.swissdatacenters.ch/slap/sandokhan.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Mon, 07 Feb 2022 16:37:25 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 Connection Keep-Alive Keep-Alive timeout=5, max=97 Content-Length 210 Content-Type text/html; charset=iso-8859-1
GET H/1.1	200 OK	index.css chpost.swissdatacenters.ch/slap/ Frame 9CAF	11 KB 11 KB	57ms 57ms	Stylesheet text/css	195.22.153.143 GARANT-PARK-INTERNET
General Check archive.org Download Go to Full URL https://chpost.swissdatacenters.ch/slap/index.css Requested by Host: chpost.swissdatacenters.ch URL: https://chpost.swissdatacenters.ch/slap/sandokhan.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 195.22.153.143 , Russian Federation, ASN47196 (GARANT-PARK-INTERNET, RU), Reverse DNS Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 / Resource Hash `f750aeb876d9004473a3d991c67e5c29be28b1c910d6abe4faddc9a015b5fe87` Request headers Accept-Language de-DE,de;q=0.9 Referer https://chpost.swissdatacenters.ch/slap/sandokhan.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Mon, 07 Feb 2022 16:37:25 GMT Last-Modified Thu, 20 Aug 2020 22:10:00 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 ETag "2bb0-5ad56619c9e00" Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 11184
GET H/1.1	200 OK	jquery-3.1.1.slim.min.js Show response chpost.swissdatacenters.ch/slap/tpl-v17/js/ Frame 9CAF	95 KB 96 KB	52ms 51ms	Script application/javascript	195.22.153.143 GARANT-PARK-INTERNET
General Check archive.org Download Go to Full URL https://chpost.swissdatacenters.ch/slap/tpl-v17/js/jquery-3.1.1.slim.min.js Requested by Host: chpost.swissdatacenters.ch URL: https://chpost.swissdatacenters.ch/slap/sandokhan.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 195.22.153.143 , Russian Federation, ASN47196 (GARANT-PARK-INTERNET, RU), Reverse DNS Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 / Resource Hash `736b1afd105ee5b36ae35ba0890827ed7df113d16e58d14afad7c20c811d8b81` Request headers Accept-Language de-DE,de;q=0.9 Referer https://chpost.swissdatacenters.ch/slap/sandokhan.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Mon, 07 Feb 2022 16:37:25 GMT Last-Modified Mon, 17 Feb 2020 21:49:46 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 ETag "17d82-59ecc889c1280" Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 97666
GET H/1.1	200 OK	jquery-1.9.1.min.js Show response chpost.swissdatacenters.ch/slap/tpl-v17/js/ Frame 9CAF	87 KB 88 KB	54ms 54ms	Script application/javascript	195.22.153.143 GARANT-PARK-INTERNET
General Check archive.org Download Go to Full URL https://chpost.swissdatacenters.ch/slap/tpl-v17/js/jquery-1.9.1.min.js Requested by Host: chpost.swissdatacenters.ch URL: https://chpost.swissdatacenters.ch/slap/sandokhan.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 195.22.153.143 , Russian Federation, ASN47196 (GARANT-PARK-INTERNET, RU), Reverse DNS Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 / Resource Hash `0ac0bf83bcf10aaf186a1445ecee2e89d0374be5387b0f8bb6ebba69bd5177a8` Request headers Accept-Language de-DE,de;q=0.9 Referer https://chpost.swissdatacenters.ch/slap/sandokhan.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Mon, 07 Feb 2022 16:37:25 GMT Last-Modified Wed, 15 Jul 2020 18:55:40 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 ETag "15db7-5aa7f7855a300" Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 89527
GET H/1.1	200 OK	jquery-confirm.min.css chpost.swissdatacenters.ch/slap/tpl-v17/css/ Frame 9CAF	23 KB 24 KB	50ms 49ms	Stylesheet text/css	195.22.153.143 GARANT-PARK-INTERNET
General Check archive.org Download Go to Full URL https://chpost.swissdatacenters.ch/slap/tpl-v17/css/jquery-confirm.min.css Requested by Host: chpost.swissdatacenters.ch URL: https://chpost.swissdatacenters.ch/slap/sandokhan.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 195.22.153.143 , Russian Federation, ASN47196 (GARANT-PARK-INTERNET, RU), Reverse DNS Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 / Resource Hash `024cfcb5e3188b2f14901e5d3c04c0fe48a5d17abe7e736187bca676b6ca154d` Request headers Accept-Language de-DE,de;q=0.9 Referer https://chpost.swissdatacenters.ch/slap/sandokhan.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Mon, 07 Feb 2022 16:37:25 GMT Last-Modified Fri, 04 Sep 2020 04:37:32 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 ETag "5df6-5ae756d513b00" Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 24054
GET H/1.1	200 OK	jquery-confirm.min.js Show response chpost.swissdatacenters.ch/slap/tpl-v17/js/ Frame 9CAF	21 KB 21 KB	56ms 55ms	Script application/javascript	195.22.153.143 GARANT-PARK-INTERNET
General Check archive.org Download Go to Full URL https://chpost.swissdatacenters.ch/slap/tpl-v17/js/jquery-confirm.min.js Requested by Host: chpost.swissdatacenters.ch URL: https://chpost.swissdatacenters.ch/slap/sandokhan.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 195.22.153.143 , Russian Federation, ASN47196 (GARANT-PARK-INTERNET, RU), Reverse DNS Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 / Resource Hash `4a5ebdffe9774fc0a9226dd6625db53aee3de99b53511e0b096d5963eb2b7a6d` Request headers Accept-Language de-DE,de;q=0.9 Referer https://chpost.swissdatacenters.ch/slap/sandokhan.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Mon, 07 Feb 2022 16:37:25 GMT Last-Modified Wed, 15 Jul 2020 18:55:54 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 ETag "5373-5aa7f792b4280" Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 21363
GET H/1.1	200 OK	img0001.png chpost.swissdatacenters.ch/slap/images/ Frame 9CAF	476 B 790 B	50ms 50ms	Image image/png	195.22.153.143 GARANT-PARK-INTERNET
General Check archive.org Download Go to Show image Full URL https://chpost.swissdatacenters.ch/slap/images/img0001.png Requested by Host: chpost.swissdatacenters.ch URL: https://chpost.swissdatacenters.ch/slap/sandokhan.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 195.22.153.143 , Russian Federation, ASN47196 (GARANT-PARK-INTERNET, RU), Reverse DNS Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 / Resource Hash `5aa43b88b4981de5446b3f2ba92d716441f952d206716d89252b247478a2428c` Request headers Accept-Language de-DE,de;q=0.9 Referer https://chpost.swissdatacenters.ch/slap/sandokhan.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Mon, 07 Feb 2022 16:37:25 GMT Last-Modified Thu, 20 Aug 2020 22:10:00 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 ETag "1dc-5ad56619c9e00" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=96 Content-Length 476
GET H/1.1	200 OK	img0002.png chpost.swissdatacenters.ch/slap/images/ Frame 9CAF	476 B 790 B	49ms 49ms	Image image/png	195.22.153.143 GARANT-PARK-INTERNET
General Check archive.org Download Go to Show image Full URL https://chpost.swissdatacenters.ch/slap/images/img0002.png Requested by Host: chpost.swissdatacenters.ch URL: https://chpost.swissdatacenters.ch/slap/sandokhan.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 195.22.153.143 , Russian Federation, ASN47196 (GARANT-PARK-INTERNET, RU), Reverse DNS Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 / Resource Hash `5aa43b88b4981de5446b3f2ba92d716441f952d206716d89252b247478a2428c` Request headers Accept-Language de-DE,de;q=0.9 Referer https://chpost.swissdatacenters.ch/slap/sandokhan.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Mon, 07 Feb 2022 16:37:25 GMT Last-Modified Thu, 20 Aug 2020 22:10:00 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 ETag "1dc-5ad56619c9e00" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=95 Content-Length 476
GET H/1.1	200 OK	2020-08-18_150938.png chpost.swissdatacenters.ch/slap/images/ Frame 9CAF	9 KB 9 KB	50ms 50ms	Image image/png	195.22.153.143 GARANT-PARK-INTERNET
General Check archive.org Download Go to Show image Full URL https://chpost.swissdatacenters.ch/slap/images/2020-08-18_150938.png Requested by Host: chpost.swissdatacenters.ch URL: https://chpost.swissdatacenters.ch/slap/sandokhan.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 195.22.153.143 , Russian Federation, ASN47196 (GARANT-PARK-INTERNET, RU), Reverse DNS Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 / Resource Hash `8c375a5e13d13b36298483e3b0fc768a91db7e21610f2e0971b406d07ef642c9` Request headers Accept-Language de-DE,de;q=0.9 Referer https://chpost.swissdatacenters.ch/slap/sandokhan.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Mon, 07 Feb 2022 16:37:25 GMT Last-Modified Tue, 18 Aug 2020 20:16:26 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 ETag "234a-5ad2c8fc87a80" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 9034
GET H/1.1	404 Not Found	jquery-3.1.1.slim.min.js chpost.swissdatacenters.ch/slap/js/ Frame 9CAF	0 0	51ms 51ms	Script text/html	195.22.153.143 GARANT-PARK-INTERNET
General Check archive.org Download Go to Full URL https://chpost.swissdatacenters.ch/slap/js/jquery-3.1.1.slim.min.js Requested by Host: chpost.swissdatacenters.ch URL: https://chpost.swissdatacenters.ch/slap/sandokhan.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 195.22.153.143 , Russian Federation, ASN47196 (GARANT-PARK-INTERNET, RU), Reverse DNS Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 / Resource Hash Request headers Accept-Language de-DE,de;q=0.9 Referer https://chpost.swissdatacenters.ch/slap/sandokhan.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Mon, 07 Feb 2022 16:37:25 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 Connection Keep-Alive Keep-Alive timeout=5, max=96 Content-Length 230 Content-Type text/html; charset=iso-8859-1
GET H/1.1	404 Not Found	jquery-3.1.1.slim.min.js chpost.swissdatacenters.ch/slap/js/ Frame 9CAF	0 0	50ms 50ms	Script text/html	195.22.153.143 GARANT-PARK-INTERNET
General Check archive.org Download Go to Full URL https://chpost.swissdatacenters.ch/slap/js/jquery-3.1.1.slim.min.js Requested by Host: chpost.swissdatacenters.ch URL: https://chpost.swissdatacenters.ch/slap/sandokhan.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 195.22.153.143 , Russian Federation, ASN47196 (GARANT-PARK-INTERNET, RU), Reverse DNS Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 / Resource Hash Request headers Accept-Language de-DE,de;q=0.9 Referer https://chpost.swissdatacenters.ch/slap/sandokhan.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Mon, 07 Feb 2022 16:37:25 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 Connection Keep-Alive Keep-Alive timeout=5, max=98 Content-Length 230 Content-Type text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Swiss Post (Transportation)

1 JavaScript Window variables

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

object| 0

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://chpost.swissdatacenters.ch/slap/ekos/Open_Sans.woff Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://chpost.swissdatacenters.ch/slap/cvv.css Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://chpost.swissdatacenters.ch/slap/js/jquery-3.1.1.slim.min.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://chpost.swissdatacenters.ch/slap/js/jquery-3.1.1.slim.min.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

chpost.swissdatacenters.ch
195.22.153.143
024cfcb5e3188b2f14901e5d3c04c0fe48a5d17abe7e736187bca676b6ca154d
0ac0bf83bcf10aaf186a1445ecee2e89d0374be5387b0f8bb6ebba69bd5177a8
2ad8aa586c18feb7a17ab5e0a3150dac220d13a4a393a2ef618d2524f94a5ad1
4a5ebdffe9774fc0a9226dd6625db53aee3de99b53511e0b096d5963eb2b7a6d
4aa1b86d2f7e14f50ca43f2aac3eabac365ce9003e5c53dafc65eea8e4244c33
5aa43b88b4981de5446b3f2ba92d716441f952d206716d89252b247478a2428c
5e108c691f15b699121d1ce7f636a766b90202982d411a9dc11bcd209cc8aaf4
736b1afd105ee5b36ae35ba0890827ed7df113d16e58d14afad7c20c811d8b81
8c375a5e13d13b36298483e3b0fc768a91db7e21610f2e0971b406d07ef642c9
93e92f15020c203962ba140cc23ce3b9b377bb6355517e5a1afa1bef7cc41d75
99caecb8475a08fc86c812cf804ddc904f6e6d3fd1591848a09f2413952f2a97
9b1c3a337e04ffbfee4fb17e746c58ddb290f6b2b037b6b615e34027522a5e85
aa0cec019b9949decffa697083d6529db01073164e758ed7c65ed51b83a9df08
b5fd723750763ebb731f9221e413e7d64d58d5192dc040e42292ed3dcccca732
f750aeb876d9004473a3d991c67e5c29be28b1c910d6abe4faddc9a015b5fe87
fa203714974b8949ce4049bd87cff044eaacf679dcec75275f53044e798831b8

chpost.swissdatacenters.ch 195.22.153.143 Malicious Activity! Public Scan Open in urlscan Pro

Internal

Effective Hostname

Submitted URL

Effective IP

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

IP Lookup

ASN Lookup

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

21 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

406 kBTransfer

401 kBSize

0 Cookies

0 Outgoing links

Redirected requests

21 HTTP transactions Everything HTML Script Fetch XHR CSS Image Font Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Window variables

0 Cookies

4 Console Messages

Indicators

chpost.swissdatacenters.ch
195.22.153.143 Malicious Activity! Public Scan Open in urlscan Pro

Screenshot
Live screenshot

Full Image

21
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

406 kB
Transfer

401 kB
Size

0
Cookies

21 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!