![](/screenshots/a1102d37-738b-43cc-afdb-9e195f2d82ca.png)
confitec.mx
Open in
urlscan Pro
173.249.29.54
Malicious Activity!
Public Scan
Effective URL: https://confitec.mx/wp-admin/switzerl/
Submission: On November 14 via api from IN — Scanned from DE
Summary
TLS certificate: Issued by R3 on September 28th 2023. Valid for: 3 months.
This is the only time confitec.mx was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Swisscom (Telecommunication)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 9 | 173.249.29.54 173.249.29.54 | 51167 (CONTABO) (CONTABO) | |
2 4 | 104.21.233.197 104.21.233.197 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 195.186.209.225 195.186.209.225 | 3303 (SWISSCOM ...) (SWISSCOM Swisscom Switzerland Ltd) | |
20 | 4 |
ASN3303 (SWISSCOM Swisscom Switzerland Ltd, CH)
login.scl.swisscom.ch |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
confitec.mx
1 redirects
confitec.mx |
375 KB |
4 |
zupimages.net
2 redirects
zupimages.net — Cisco Umbrella Rank: 45088 www.zupimages.net — Cisco Umbrella Rank: 49086 |
3 KB |
1 |
swisscom.ch
login.scl.swisscom.ch — Cisco Umbrella Rank: 477853 |
40 KB |
20 | 3 |
Domain | Requested by | |
---|---|---|
9 | confitec.mx |
1 redirects
confitec.mx
|
2 | www.zupimages.net |
confitec.mx
|
2 | zupimages.net | 2 redirects |
1 | login.scl.swisscom.ch |
confitec.mx
|
20 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
confitec.mx R3 |
2023-09-28 - 2023-12-27 |
3 months | crt.sh |
login.scl.swisscom.ch SwissSign RSA TLS OV ICA 2021 - 1 |
2023-02-15 - 2024-02-15 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://confitec.mx/wp-admin/switzerl/
Frame ID: 6D64C305F9E2062A0AF2704A882B008E
Requests: 20 HTTP requests in this frame
Screenshot
![](/screenshots/a1102d37-738b-43cc-afdb-9e195f2d82ca.png)
Page Title
Swisscom LoginPage URL History Show full URLs
-
http://confitec.mx/wp-admin/switzerl/
HTTP 301
https://confitec.mx/wp-admin/switzerl/ Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://confitec.mx/wp-admin/switzerl/
HTTP 301
https://confitec.mx/wp-admin/switzerl/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 4- https://zupimages.net/up/22/18/jsx8.png HTTP 301
- https://www.zupimages.net/up/22/18/jsx8.png
- https://zupimages.net/up/22/19/zl6k.png HTTP 301
- https://www.zupimages.net/up/22/19/zl6k.png
20 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
confitec.mx/wp-admin/switzerl/ Redirect Chain
|
7 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
commons-d5b596036e661ac38f22c70a7cd50323.css
confitec.mx/wp-admin/switzerl/index_files/ |
364 KB 367 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
username-18965c05ee0f844a4bb9fde6dfa6a0f2.css
confitec.mx/wp-admin/switzerl/index_files/ |
218 B 287 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
webcomponents.esm-1f5f3d9c71b67350c64ec55c2acbadc3.js.t%C3%A9l%C3%A9chargement
confitec.mx/wp-admin/switzerl/index_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
webmail_logo.png
confitec.mx/wp-admin/switzerl/index_files/ |
562 B 641 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jsx8.png
www.zupimages.net/up/22/18/ Redirect Chain
|
946 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
zl6k.png
www.zupimages.net/up/22/19/ Redirect Chain
|
759 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
commons.bundle-2538c7403a35e5210ba22639e7ea5da1.js.t%C3%A9l%C3%A9chargement
confitec.mx/wp-admin/switzerl/index_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login-layout.bundle-0ffae2a40defd1bb5020c2f27d2c420d.js.t%C3%A9l%C3%A9chargement
confitec.mx/wp-admin/switzerl/index_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
username.bundle-bbb6eb130f6bd8f1ed56bc3c6520a305.js.t%C3%A9l%C3%A9chargement
confitec.mx/wp-admin/switzerl/index_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
lifeform-spritesheet-db5b9234be03de8612bb31c38e09fcf7.png
login.scl.swisscom.ch/ |
38 KB 40 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
TheSansB_700_-7dac4ba6f5bfb4ba199e7fe3454a6780.woff2
login.scl.swisscom.ch/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
TheSansB_400_-4f0d59a18ca1c88dcfbbce6510b21da5.woff2
login.scl.swisscom.ch/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
TheSansB_300_-725d06aefcb68dc767cf1bc91d7b5c1e.woff2
login.scl.swisscom.ch/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
TheSansB_400_-f5ebe8b3d957cb3898cdfcd302368b82.woff
login.scl.swisscom.ch/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
TheSansB_700_-12f304077148a6519764ab53cef73e8a.woff
login.scl.swisscom.ch/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
TheSansB_300_-241175cc22247923e2aa4702856fa27e.woff
login.scl.swisscom.ch/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
TheSansB_400_-4bbcd055023eeb44538a47d343e0966f.ttf
login.scl.swisscom.ch/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
TheSansB_700_-389285ef4123a6da054df3bf191c4c25.ttf
login.scl.swisscom.ch/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
TheSansB_300_-ea4a24d490218e110e072acdf4832f9a.ttf
login.scl.swisscom.ch/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- login.scl.swisscom.ch
- URL
- https://login.scl.swisscom.ch/TheSansB_700_-7dac4ba6f5bfb4ba199e7fe3454a6780.woff2
- Domain
- login.scl.swisscom.ch
- URL
- https://login.scl.swisscom.ch/TheSansB_400_-4f0d59a18ca1c88dcfbbce6510b21da5.woff2
- Domain
- login.scl.swisscom.ch
- URL
- https://login.scl.swisscom.ch/TheSansB_300_-725d06aefcb68dc767cf1bc91d7b5c1e.woff2
- Domain
- login.scl.swisscom.ch
- URL
- https://login.scl.swisscom.ch/TheSansB_400_-f5ebe8b3d957cb3898cdfcd302368b82.woff
- Domain
- login.scl.swisscom.ch
- URL
- https://login.scl.swisscom.ch/TheSansB_700_-12f304077148a6519764ab53cef73e8a.woff
- Domain
- login.scl.swisscom.ch
- URL
- https://login.scl.swisscom.ch/TheSansB_300_-241175cc22247923e2aa4702856fa27e.woff
- Domain
- login.scl.swisscom.ch
- URL
- https://login.scl.swisscom.ch/TheSansB_400_-4bbcd055023eeb44538a47d343e0966f.ttf
- Domain
- login.scl.swisscom.ch
- URL
- https://login.scl.swisscom.ch/TheSansB_700_-389285ef4123a6da054df3bf191c4c25.ttf
- Domain
- login.scl.swisscom.ch
- URL
- https://login.scl.swisscom.ch/TheSansB_300_-ea4a24d490218e110e072acdf4832f9a.ttf
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Swisscom (Telecommunication)1 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
confitec.mx/ | Name: SID Value: d2doun03899ouud22t026efqk2 |
22 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
confitec.mx
login.scl.swisscom.ch
www.zupimages.net
zupimages.net
login.scl.swisscom.ch
104.21.233.197
173.249.29.54
195.186.209.225
609eabc85950bc368927ad227bafcf74ececbcacd94feba83bf2295435ba7d94
ad2eb9b7eae171b724fd8ecf0ae384de4580980df92cef676be1548fcd2c5dd4
dc6e583306e31702a329f953bebef01332b457bac82dd28e51cd3095e2a06d83
ef871a6fc64d3235225cf03da396ac7276fcaf902d799bc967eee7a5d6148b22
f07b8927a11190e0d9988dd003bb5079a5905678ad8951eb424ab7c71dcaba33
f974ce31c6ace01e0f69069b5a040ed7e856974be629f3dfaf844f23ab4a2efd
f9adb57dca9cbd2514ed249714b613d65e78a81cadda2882679a9672c812d25e