login.sso.bluewin.ch
Open in
urlscan Pro
195.186.196.30
Malicious Activity!
Public Scan
Effective URL: https://login.sso.bluewin.ch/login?SNA=webmail&RURL=https%3A%2F%2Frich-v01.bluewin.ch%2Fcp%2Fapplink%2Fsso%2FServiceEntryHand...
Submission: On December 04 via api from CZ
Summary
TLS certificate: Issued by SwissSign EV Gold CA 2014 - G22 on March 21st 2018. Valid for: 2 years.
This is the only time login.sso.bluewin.ch was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Swisscom (Telecommunication)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 213.3.75.34 213.3.75.34 | 3303 (SWISSCOM ...) (SWISSCOM Swisscom (Switzerland) Ltd) | |
1 1 | 195.186.122.188 195.186.122.188 | 3303 (SWISSCOM ...) (SWISSCOM Swisscom (Switzerland) Ltd) | |
1 1 | 195.186.122.189 195.186.122.189 | 3303 (SWISSCOM ...) (SWISSCOM Swisscom (Switzerland) Ltd) | |
13 | 195.186.196.30 195.186.196.30 | 3303 (SWISSCOM ...) (SWISSCOM Swisscom (Switzerland) Ltd) | |
13 | 1 |
ASN3303 (SWISSCOM Swisscom (Switzerland) Ltd, CH)
webmail.bluewin.ch |
ASN3303 (SWISSCOM Swisscom (Switzerland) Ltd, CH)
rich-v01.bluewin.ch |
ASN3303 (SWISSCOM Swisscom (Switzerland) Ltd, CH)
login.sso.bluewin.ch |
Apex Domain Subdomains |
Transfer | |
---|---|---|
16 |
bluewin.ch
3 redirects
www.bluewin.ch webmail.bluewin.ch rich-v01.bluewin.ch login.sso.bluewin.ch |
406 KB |
13 | 1 |
Domain | Requested by | |
---|---|---|
13 | login.sso.bluewin.ch |
login.sso.bluewin.ch
|
1 | rich-v01.bluewin.ch | 1 redirects |
1 | webmail.bluewin.ch | 1 redirects |
1 | www.bluewin.ch | 1 redirects |
13 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.swisscom.ch |
Subject Issuer | Validity | Valid | |
---|---|---|---|
login.sso.bluewin.ch SwissSign EV Gold CA 2014 - G22 |
2018-03-21 - 2020-03-21 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://login.sso.bluewin.ch/login?SNA=webmail&RURL=https%3A%2F%2Frich-v01.bluewin.ch%2Fcp%2Fapplink%2Fsso%2FServiceEntryHandler%3Fd%3Dbluewin.ch%26l%3Dde%26m%3Dfalse&L=de
Frame ID: 3E5073B85F0AC7DE6CA57B6D4AC9C7A3
Requests: 13 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://www.bluewin.ch/de/email/
HTTP 302
https://webmail.bluewin.ch/?l=de HTTP 302
https://rich-v01.bluewin.ch/cp/applink/sso/ServiceEntry?d=bluewin.ch&l=de HTTP 302
https://login.sso.bluewin.ch/login?SNA=webmail&RURL=https%3A%2F%2Frich-v01.bluewin.ch%2Fcp%2Fapplink%2Fss... Page URL
Page Statistics
5 Outgoing links
These are links going to different origins than the main page.
Title: Jetzt gratis E-Mail Adresse erstellen
Search URL Search Domain Scan URL
Title: Fragen zum Thema E-Mail
Search URL Search Domain Scan URL
Title: Mobile ID nutzen
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title: Über Swisscom Login
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://www.bluewin.ch/de/email/
HTTP 302
https://webmail.bluewin.ch/?l=de HTTP 302
https://rich-v01.bluewin.ch/cp/applink/sso/ServiceEntry?d=bluewin.ch&l=de HTTP 302
https://login.sso.bluewin.ch/login?SNA=webmail&RURL=https%3A%2F%2Frich-v01.bluewin.ch%2Fcp%2Fapplink%2Fsso%2FServiceEntryHandler%3Fd%3Dbluewin.ch%26l%3Dde%26m%3Dfalse&L=de Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
13 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
Cookie set
login
login.sso.bluewin.ch/ Redirect Chain
|
9 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sdx.min.css
login.sso.bluewin.ch/resources/sdx/css/ |
307 KB 39 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
nwmain.css
login.sso.bluewin.ch/resources/styles/ |
10 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
webmail.png;jsessionid=9C294EA7D1673FCE009133256CDD5E6D
login.sso.bluewin.ch/resources/images/relying-party/ |
562 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
all.js
login.sso.bluewin.ch/resources/scripts/ |
103 KB 35 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
critical.js
login.sso.bluewin.ch/resources/scripts/ |
17 KB 7 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sdx.min.js
login.sso.bluewin.ch/resources/sdx/js/ |
339 KB 92 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Logo_Lifeform.png
login.sso.bluewin.ch/resources/images/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
TheSansB_400_.woff2
login.sso.bluewin.ch/resources/sdx/fonts/TheSans/ |
50 KB 50 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
lifeform-spritesheet.png
login.sso.bluewin.ch/resources/sdx/images/ |
38 KB 38 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
TheSansB_600_.woff2
login.sso.bluewin.ch/resources/sdx/fonts/TheSans/ |
54 KB 54 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sdx-icons.woff2
login.sso.bluewin.ch/resources/sdx/fonts/sdx-icons/ |
24 KB 24 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
TheSansB_300_.woff2
login.sso.bluewin.ch/resources/sdx/fonts/TheSans/ |
55 KB 55 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Swisscom (Telecommunication)81 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| handleSelect boolean| Ba object| webfont object| WebFont object| PubSub object| __core-js_shared__ object| Modernizr function| __extends function| __assign function| __rest function| __decorate function| __param function| __metadata function| __awaiter function| __generator function| __exportStar function| __values function| __read function| __spread function| __await function| __asyncGenerator function| __asyncDelegator function| __asyncValues function| __makeTemplateObject function| __importStar function| __importDefault function| flatpickr object| _gsQueue object| GreenSockGlobals object| com function| _gsDefine function| Ease function| Power4 function| Strong function| Quint function| Power3 function| Quart function| Power2 function| Cubic function| Power1 function| Quad function| Power0 function| Linear function| TweenLite function| TweenPlugin function| TweenMax function| TimelineLite function| TimelineMax function| BezierPlugin function| CSSPlugin function| BackOut function| BackIn function| BackInOut object| Back function| SlowMo function| SteppedEase function| RoughEase function| BounceOut function| BounceIn function| BounceInOut object| Bounce function| CircOut function| CircIn function| CircInOut object| Circ function| ElasticOut function| ElasticIn function| ElasticInOut object| Elastic function| ExpoOut function| ExpoIn function| ExpoInOut object| Expo function| SineOut function| SineIn function| SineInOut object| Sine object| EaseLookup object| sdx4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
login.sso.bluewin.ch/ | Name: JSESSIONID Value: E38ECB1FD271E66A4D5C2C6E15EEBCF1 |
|
.login.sso.bluewin.ch/ | Name: uxtype Value: new |
|
login.sso.bluewin.ch/ | Name: hazelcast.sessionId Value: HZ4C89C5EDC5404C819744DB2B86EA80CA |
|
.bluewin.ch/ | Name: pscbr Value: vimdzmsp-rich29.bluewin.ch_1996682659306028305984 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Frame-Options | DENY |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
login.sso.bluewin.ch
rich-v01.bluewin.ch
webmail.bluewin.ch
www.bluewin.ch
195.186.122.188
195.186.122.189
195.186.196.30
213.3.75.34
06f449cdf9a25d9d55a22e797374da2fa5313c892e523e5aeb601db6e92fc53d
416e243e6ac013c2ce428f5707887796719657f13e7e52a08fe2b6a1a57e5c1b
4d548d98cba42e47876b305aa4a1715f6467633aac66ad376d2648031d82fa3d
5e39a8bb7dc50616b9f41997f90bbb8330be6eb35bb973995618c38a0e3c21f4
8390fbc9533f4baba09fc5d92999ce77139e089c02991fd4e006f8ac19f1b9dc
8c236766f23c140010dd8da2f231017bdd9d46293b6b75cd10e584638d9a4319
a6bab48f290efd74478d95eab8bc0610cc32ffa78dc5adbb8fbc34f30ce8d930
aea14de2f15479f33a2cdfab1cdf996596cd10de05d4c2f1f5137ad1f16a2d4c
ceec9c385bc2d10345fad2a8a467959754825aa9ed50a163e38401476ee1b87a
e0bc3a627d23f2f2e1467bb520cf1a686a8b0e7ef12589e3e0aede4c350ad67e
f07b8927a11190e0d9988dd003bb5079a5905678ad8951eb424ab7c71dcaba33
f0cc4ee9dc83925f474ab0b5ed3a5395038c979e157d4bae8e67225f1b0922d8
f9adb57dca9cbd2514ed249714b613d65e78a81cadda2882679a9672c812d25e