tobeings2.sakura.ne.jp Open in urlscan Pro
219.94.162.149 Malicious Activity! Private Scan

Go To Rescan
Add Verdict Report

URL:
https://tobeings2.sakura.ne.jp/mt/sbab/sbb.ch_de.bahnhof-services_waehrend-der-reise/SwissPass.html
Submission: On June 13 via api (June 13th 2022, 1:45:56 pm UTC) from GB — Scanned from JP

Summary HTTP 15 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 4 IPs in 4 countries across 4 domains to perform 15 HTTP transactions. The main IP is 219.94.162.149, located in Japan and belongs to SAKURA-C SAKURA Internet Inc., JP. The main domain is tobeings2.sakura.ne.jp.
TLS certificate: Issued by Gehirn Managed Certification Authorit... on May 9th 2022. Valid for: a year.

This is the only time tobeings2.sakura.ne.jp was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Schweizerische Bundesbahnen (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
12	219.94.162.149 219.94.162.149	9371 (SAKURA-C ...) (SAKURA-C SAKURA Internet Inc.)
1	52.28.109.177 52.28.109.177	16509 (AMAZON-02) (AMAZON-02)
1	193.203.121.145 193.203.121.145	31004 (SBB-CFF-F...) (SBB-CFF-FFS Telecom SBB)
1	13.32.49.135 13.32.49.135	16509 (AMAZON-02) (AMAZON-02)
15	4

12 219.94.162.149 (Japan)

ASN9371 (SAKURA-C SAKURA Internet Inc., JP)
PTR: www1309.sakura.ne.jp

tobeings2.sakura.ne.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.28.109.177 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-28-109-177.eu-central-1.compute.amazonaws.com

cdn.app.sbb.ch	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 193.203.121.145 (Switzerland)

ASN31004 (SBB-CFF-FFS Telecom SBB, CH)

resources.swisspass.ch	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.49.135 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-49-135.nrt57.r.cloudfront.net

logs1407.xiti.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	sakura.ne.jp tobeings2.sakura.ne.jp	894 KB
1	xiti.com logs1407.xiti.com — Cisco Umbrella Rank: 92506	307 B
1	swisspass.ch resources.swisspass.ch	221 KB
1	sbb.ch cdn.app.sbb.ch — Cisco Umbrella Rank: 427708	14 KB
15	4

	Domain	Requested by
12	tobeings2.sakura.ne.jp	tobeings2.sakura.ne.jp
1	logs1407.xiti.com	tobeings2.sakura.ne.jp
1	resources.swisspass.ch	tobeings2.sakura.ne.jp
1	cdn.app.sbb.ch	tobeings2.sakura.ne.jp
15	4

This site contains links to these domains. Also see Links.

Domain
www.swisspass.ch

Subject Issuer	Validity	Valid
*.sakura.ne.jp Gehirn Managed Certification Authority - RSA DV	`2022-05-09` - `2023-05-29`	a year	crt.sh
*.app.sbb.ch Amazon	`2021-09-27` - `2022-10-26`	a year	crt.sh
resources.swisspass.ch SwissSign RSA TLS OV ICA 2021 - 1	`2022-05-04` - `2023-05-04`	a year	crt.sh
*.xiti.com Thawte RSA CA 2018	`2022-04-29` - `2023-04-28`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://tobeings2.sakura.ne.jp/mt/sbab/sbb.ch_de.bahnhof-services_waehrend-der-reise/SwissPass.html
Frame ID: 84D4DAFA38515B9888443065DF821EFF
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

SBB | SwissPass

Detected technologies

AT Internet XiTi (Analytics) Expand

Overall confidence: 100%
Detected patterns

xiti\.com/hit\.xiti

Modernizr (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

15
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

4
Countries

1130 kB
Transfer

1126 kB
Size

0
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://www.swisspass.ch/home

Search URL Search Domain Scan URL

URL: https://www.swisspass.ch//pw-reset?lang=en&provider=sbbkn&callback=oevlogin
Title: Forgotten your password?

Search URL Search Domain Scan URL

URL: https://www.swisspass.ch//register?lang=en&provider=sbbkn&callback=oevlogin
Title: Register for SwissPass.

Search URL Search Domain Scan URL

URL: https://www.swisspass.ch/profile/login-data?lang=en
Title: profile

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request SwissPass.html Show response
tobeings2.sakura.ne.jp/mt/sbab/sbb.ch_de.bahnhof-services_waehrend-der-reise/ 28 KB
29 KB 513ms
463ms Document
text/html 219.94.162.149
SAKURA-C SAKURA I...

General

Check archive.org

Show headers Download Go to

Full URL: https://tobeings2.sakura.ne.jp/mt/sbab/sbb.ch_de.bahnhof-services_waehrend-der-reise/SwissPass.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 219.94.162.149 , Japan, ASN9371 (SAKURA-C SAKURA Internet Inc., JP),
Reverse DNS: www1309.sakura.ne.jp
Software: nginx /
Resource Hash: 2fe0bb38ef9fa7e409d5529d9bbbce8973479f73f4086daa9d6b023b098c4582

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: jp-JP,jp;q=0.9

Response headers

accept-ranges: bytes
content-length: 29095
content-type: text/html
date: Mon, 13 Jun 2022 13:45:51 GMT
server: nginx

GET
H2 200 sso.css
tobeings2.sakura.ne.jp/mt/sbab/sbb.ch_de.bahnhof-services_waehrend-der-reise/SwissPass_files/ 197 KB
197 KB 12ms
10ms Stylesheet
text/css 219.94.162.149
SAKURA-C SAKURA I...

General

Check archive.org

Show headers Download Go to

Full URL: https://tobeings2.sakura.ne.jp/mt/sbab/sbb.ch_de.bahnhof-services_waehrend-der-reise/SwissPass_files/sso.css
Requested by: Host: tobeings2.sakura.ne.jp
URL: https://tobeings2.sakura.ne.jp/mt/sbab/sbb.ch_de.bahnhof-services_waehrend-der-reise/SwissPass.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 219.94.162.149 , Japan, ASN9371 (SAKURA-C SAKURA Internet Inc., JP),
Reverse DNS: www1309.sakura.ne.jp
Software: nginx /
Resource Hash: d9b1cd430af98eca769d5f2d74c3fa6f2a2ac985df9dbc94e73b220f576abc66

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://tobeings2.sakura.ne.jp/mt/sbab/sbb.ch_de.bahnhof-services_waehrend-der-reise/SwissPass.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 13 Jun 2022 13:45:51 GMT
last-modified: Wed, 26 Jan 2022 23:50:32 GMT
server: nginx
accept-ranges: bytes
etag: "31224-5d684ddfe2200"
content-length: 201252
content-type: text/css

GET
H2 200 modernizr-20200819.js Show response
tobeings2.sakura.ne.jp/mt/sbab/sbb.ch_de.bahnhof-services_waehrend-der-reise/SwissPass_files/ 8 KB
8 KB 20ms
19ms Script
application/javascript 219.94.162.149
SAKURA-C SAKURA I...

General

Check archive.org

Show headers Download Go to

Full URL: https://tobeings2.sakura.ne.jp/mt/sbab/sbb.ch_de.bahnhof-services_waehrend-der-reise/SwissPass_files/modernizr-20200819.js
Requested by: Host: tobeings2.sakura.ne.jp
URL: https://tobeings2.sakura.ne.jp/mt/sbab/sbb.ch_de.bahnhof-services_waehrend-der-reise/SwissPass.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 219.94.162.149 , Japan, ASN9371 (SAKURA-C SAKURA Internet Inc., JP),
Reverse DNS: www1309.sakura.ne.jp
Software: nginx /
Resource Hash: 4a3d4cf982535aaf485c6e3af9ad1498df5c065adf94eed056f0aa13c31e92ed

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://tobeings2.sakura.ne.jp/mt/sbab/sbb.ch_de.bahnhof-services_waehrend-der-reise/SwissPass.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 13 Jun 2022 13:45:51 GMT
last-modified: Wed, 26 Jan 2022 23:40:36 GMT
server: nginx
accept-ranges: bytes
etag: "1e59-5d684ba77e500"
content-length: 7769
content-type: application/javascript

GET
H2 200 launch-6cc731e967aa.js Show response
tobeings2.sakura.ne.jp/mt/sbab/sbb.ch_de.bahnhof-services_waehrend-der-reise/SwissPass_files/ 145 KB
146 KB 11ms
10ms Script
application/javascript 219.94.162.149
SAKURA-C SAKURA I...

General

Check archive.org

Show headers Download Go to

Full URL: https://tobeings2.sakura.ne.jp/mt/sbab/sbb.ch_de.bahnhof-services_waehrend-der-reise/SwissPass_files/launch-6cc731e967aa.js
Requested by: Host: tobeings2.sakura.ne.jp
URL: https://tobeings2.sakura.ne.jp/mt/sbab/sbb.ch_de.bahnhof-services_waehrend-der-reise/SwissPass.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 219.94.162.149 , Japan, ASN9371 (SAKURA-C SAKURA Internet Inc., JP),
Reverse DNS: www1309.sakura.ne.jp
Software: nginx /
Resource Hash: 787fde73cc8d5d8f6fd971e4f283415ea57971b3f72e4f26e6dff196a78d4f94

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://tobeings2.sakura.ne.jp/mt/sbab/sbb.ch_de.bahnhof-services_waehrend-der-reise/SwissPass.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 13 Jun 2022 13:45:51 GMT
last-modified: Wed, 26 Jan 2022 23:40:36 GMT
server: nginx
accept-ranges: bytes
etag: "2457a-5d684ba77e500"
content-length: 148858
content-type: application/javascript

GET
H2 200 logo.png
tobeings2.sakura.ne.jp/mt/sbab/sbb.ch_de.bahnhof-services_waehrend-der-reise/SwissPass_files/ 2 KB
2 KB 10ms
10ms Image
image/png 219.94.162.149
SAKURA-C SAKURA I...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tobeings2.sakura.ne.jp/mt/sbab/sbb.ch_de.bahnhof-services_waehrend-der-reise/SwissPass_files/logo.png
Requested by: Host: tobeings2.sakura.ne.jp
URL: https://tobeings2.sakura.ne.jp/mt/sbab/sbb.ch_de.bahnhof-services_waehrend-der-reise/SwissPass.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 219.94.162.149 , Japan, ASN9371 (SAKURA-C SAKURA Internet Inc., JP),
Reverse DNS: www1309.sakura.ne.jp
Software: nginx /
Resource Hash: d45fd2cc05090e4b504f361216b1032409ed3cdf9904f50ce56e8a6b0f3c006e

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://tobeings2.sakura.ne.jp/mt/sbab/sbb.ch_de.bahnhof-services_waehrend-der-reise/SwissPass.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 13 Jun 2022 13:45:51 GMT
last-modified: Wed, 26 Jan 2022 23:40:36 GMT
server: nginx
accept-ranges: bytes
etag: "71a-5d684ba77e500"
content-length: 1818
content-type: image/png

GET
H2 200 logo_text_en-20200819.svg
tobeings2.sakura.ne.jp/mt/sbab/sbb.ch_de.bahnhof-services_waehrend-der-reise/SwissPass_files/ 137 KB
137 KB 11ms
11ms Image
image/svg+xml 219.94.162.149
SAKURA-C SAKURA I...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tobeings2.sakura.ne.jp/mt/sbab/sbb.ch_de.bahnhof-services_waehrend-der-reise/SwissPass_files/logo_text_en-20200819.svg
Requested by: Host: tobeings2.sakura.ne.jp
URL: https://tobeings2.sakura.ne.jp/mt/sbab/sbb.ch_de.bahnhof-services_waehrend-der-reise/SwissPass.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 219.94.162.149 , Japan, ASN9371 (SAKURA-C SAKURA Internet Inc., JP),
Reverse DNS: www1309.sakura.ne.jp
Software: nginx /
Resource Hash: ceb27bfba35e08b536d59228ace4ff893bdc1d78d5c05ca437193192b60b53eb

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://tobeings2.sakura.ne.jp/mt/sbab/sbb.ch_de.bahnhof-services_waehrend-der-reise/SwissPass.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 13 Jun 2022 13:45:51 GMT
last-modified: Wed, 26 Jan 2022 23:40:36 GMT
server: nginx
accept-ranges: bytes
etag: "222c2-5d684ba77e500"
content-length: 139970
content-type: image/svg+xml

GET
H2 200 logo-20200819.svg
tobeings2.sakura.ne.jp/mt/sbab/sbb.ch_de.bahnhof-services_waehrend-der-reise/SwissPass_files/ 7 KB
7 KB 14ms
14ms Image
image/svg+xml 219.94.162.149
SAKURA-C SAKURA I...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tobeings2.sakura.ne.jp/mt/sbab/sbb.ch_de.bahnhof-services_waehrend-der-reise/SwissPass_files/logo-20200819.svg
Requested by: Host: tobeings2.sakura.ne.jp
URL: https://tobeings2.sakura.ne.jp/mt/sbab/sbb.ch_de.bahnhof-services_waehrend-der-reise/SwissPass.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 219.94.162.149 , Japan, ASN9371 (SAKURA-C SAKURA Internet Inc., JP),
Reverse DNS: www1309.sakura.ne.jp
Software: nginx /
Resource Hash: deeee170c3759a6ed35c0c05c5b935d0e7638f1c0c5677166918ecff6edb1909

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://tobeings2.sakura.ne.jp/mt/sbab/sbb.ch_de.bahnhof-services_waehrend-der-reise/SwissPass.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 13 Jun 2022 13:45:51 GMT
last-modified: Wed, 26 Jan 2022 23:40:36 GMT
server: nginx
accept-ranges: bytes
etag: "1cce-5d684ba77e500"
content-length: 7374
content-type: image/svg+xml

GET
H2 200 loader-20200819.png
tobeings2.sakura.ne.jp/mt/sbab/sbb.ch_de.bahnhof-services_waehrend-der-reise/SwissPass_files/ 272 B
415 B 10ms
10ms Image
image/png 219.94.162.149
SAKURA-C SAKURA I...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tobeings2.sakura.ne.jp/mt/sbab/sbb.ch_de.bahnhof-services_waehrend-der-reise/SwissPass_files/loader-20200819.png
Requested by: Host: tobeings2.sakura.ne.jp
URL: https://tobeings2.sakura.ne.jp/mt/sbab/sbb.ch_de.bahnhof-services_waehrend-der-reise/SwissPass.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 219.94.162.149 , Japan, ASN9371 (SAKURA-C SAKURA Internet Inc., JP),
Reverse DNS: www1309.sakura.ne.jp
Software: nginx /
Resource Hash: f766c7457c6ec463eaa85778aa47261344f1772e0b7cf1987ad212f889f472f5

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://tobeings2.sakura.ne.jp/mt/sbab/sbb.ch_de.bahnhof-services_waehrend-der-reise/SwissPass.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 13 Jun 2022 13:45:51 GMT
last-modified: Wed, 26 Jan 2022 23:40:36 GMT
server: nginx
accept-ranges: bytes
etag: "110-5d684ba77e500"
content-length: 272
content-type: image/png

GET
H2 200 jquery-20200819.js Show response
tobeings2.sakura.ne.jp/mt/sbab/sbb.ch_de.bahnhof-services_waehrend-der-reise/SwissPass_files/ 95 KB
95 KB 10ms
10ms Script
application/javascript 219.94.162.149
SAKURA-C SAKURA I...

General

Check archive.org

Show headers Download Go to

Full URL: https://tobeings2.sakura.ne.jp/mt/sbab/sbb.ch_de.bahnhof-services_waehrend-der-reise/SwissPass_files/jquery-20200819.js
Requested by: Host: tobeings2.sakura.ne.jp
URL: https://tobeings2.sakura.ne.jp/mt/sbab/sbb.ch_de.bahnhof-services_waehrend-der-reise/SwissPass.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 219.94.162.149 , Japan, ASN9371 (SAKURA-C SAKURA Internet Inc., JP),
Reverse DNS: www1309.sakura.ne.jp
Software: nginx /
Resource Hash: 24f31a4afb4d98c85b6cff4c9a953654a77986d6c4c9e9cae52cf57e59095e01

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://tobeings2.sakura.ne.jp/mt/sbab/sbb.ch_de.bahnhof-services_waehrend-der-reise/SwissPass.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 13 Jun 2022 13:45:51 GMT
last-modified: Wed, 26 Jan 2022 23:40:36 GMT
server: nginx
accept-ranges: bytes
etag: "17c54-5d684ba77e500"
content-length: 97364
content-type: application/javascript

GET
H2 200 vendor.js Show response
tobeings2.sakura.ne.jp/mt/sbab/sbb.ch_de.bahnhof-services_waehrend-der-reise/SwissPass_files/ 175 KB
175 KB 11ms
11ms Script
application/javascript 219.94.162.149
SAKURA-C SAKURA I...

General

Check archive.org

Show headers Download Go to

Full URL: https://tobeings2.sakura.ne.jp/mt/sbab/sbb.ch_de.bahnhof-services_waehrend-der-reise/SwissPass_files/vendor.js
Requested by: Host: tobeings2.sakura.ne.jp
URL: https://tobeings2.sakura.ne.jp/mt/sbab/sbb.ch_de.bahnhof-services_waehrend-der-reise/SwissPass.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 219.94.162.149 , Japan, ASN9371 (SAKURA-C SAKURA Internet Inc., JP),
Reverse DNS: www1309.sakura.ne.jp
Software: nginx /
Resource Hash: be0223ae72bc8c610c7a5453d349964cbe78ff8646695a58bc13a4cf0a8d81d6

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://tobeings2.sakura.ne.jp/mt/sbab/sbb.ch_de.bahnhof-services_waehrend-der-reise/SwissPass.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 13 Jun 2022 13:45:51 GMT
last-modified: Wed, 26 Jan 2022 23:40:36 GMT
server: nginx
accept-ranges: bytes
etag: "2bc0a-5d684ba77e500"
content-length: 179210
content-type: application/javascript

GET
H2 200 swisspass.js Show response
tobeings2.sakura.ne.jp/mt/sbab/sbb.ch_de.bahnhof-services_waehrend-der-reise/SwissPass_files/ 97 KB
97 KB 10ms
10ms Script
application/javascript 219.94.162.149
SAKURA-C SAKURA I...

General

Check archive.org

Show headers Download Go to

Full URL: https://tobeings2.sakura.ne.jp/mt/sbab/sbb.ch_de.bahnhof-services_waehrend-der-reise/SwissPass_files/swisspass.js
Requested by: Host: tobeings2.sakura.ne.jp
URL: https://tobeings2.sakura.ne.jp/mt/sbab/sbb.ch_de.bahnhof-services_waehrend-der-reise/SwissPass.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 219.94.162.149 , Japan, ASN9371 (SAKURA-C SAKURA Internet Inc., JP),
Reverse DNS: www1309.sakura.ne.jp
Software: nginx /
Resource Hash: 225e078f0432e7459d74e8d9245f1982570a3897d664ca2d219ccd09b244ab95

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://tobeings2.sakura.ne.jp/mt/sbab/sbb.ch_de.bahnhof-services_waehrend-der-reise/SwissPass.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 13 Jun 2022 13:45:51 GMT
last-modified: Wed, 26 Jan 2022 23:40:36 GMT
server: nginx
accept-ranges: bytes
etag: "183fc-5d684ba77e500"
content-length: 99324
content-type: application/javascript

GET
H2 200 SBBWeb-Light.woff2
cdn.app.sbb.ch/fonts/v1_6_subset/ 14 KB
14 KB 1019ms
477ms Font
application/font-woff2 52.28.109.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.app.sbb.ch/fonts/v1_6_subset/SBBWeb-Light.woff2
Requested by: Host: tobeings2.sakura.ne.jp
URL: https://tobeings2.sakura.ne.jp/mt/sbab/sbb.ch_de.bahnhof-services_waehrend-der-reise/SwissPass_files/sso.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.28.109.177 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-28-109-177.eu-central-1.compute.amazonaws.com
Software: nginx/1.15.12 /
Resource Hash: 5c7f0e173844556da7ca5eb8936fa3dab1c00206960920a49a1eea9cde2bfaaf

Request headers

Referer: https://tobeings2.sakura.ne.jp/
Origin: https://tobeings2.sakura.ne.jp
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 13 Jun 2022 13:45:52 GMT
content-encoding: br
last-modified: Fri, 17 Dec 2021 15:16:26 GMT
server: nginx/1.15.12
etag: W/"61bca9ca-3784"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: max-age=31536000, public, private
access-control-allow-credentials: true
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With
expires: Tue, 13 Jun 2023 13:45:52 GMT

GET
H/1.1 200
OK login_bg.jpg
resources.swisspass.ch/content/dam/swisspass/co-branding/sbbkn/ 221 KB
221 KB 1040ms
245ms Image
image/jpeg 193.203.121.145
SBB-CFF-FFS Telec...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://resources.swisspass.ch/content/dam/swisspass/co-branding/sbbkn/login_bg.jpg

Requested by

Host: tobeings2.sakura.ne.jp
URL: https://tobeings2.sakura.ne.jp/mt/sbab/sbb.ch_de.bahnhof-services_waehrend-der-reise/SwissPass.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

193.203.121.145 , Switzerland, ASN31004 (SBB-CFF-FFS Telecom SBB, CH),

Reverse DNS

Software

Apache /

Resource Hash

c299a55acdc9c551ab7e67912892c6db8ed164dbcebaca370aa75f0f1297c8d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://tobeings2.sakura.ne.jp/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Mon, 13 Jun 2022 13:45:52 GMT
X-Content-Type-Options: nosniff
X-Cache: HIT
x-url: /content/dam/swisspass/co-branding/sbbkn/login_bg.jpg
Connection: Keep-Alive
Content-Length: 226097
X-XSS-Protection: 1; mode=block
Referrer-Policy: same-origin
Last-Modified: Mon, 13 Jun 2022 01:08:35 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
ETag: "37331-5e149ed69fa18"
Strict-Transport-Security: max-age=16070400
X-Varnish: 375495569 370421944
X-Plattform: cprod
Cache-Control: max-age=21600
Accept-Ranges: bytes
Content-Type: image/jpeg
Keep-Alive: timeout=10, max=500
Expires: Mon, 13 Jun 2022 19:44:59 GMT

GET
H2 404 co-branding Show response
tobeings2.sakura.ne.jp/mt/sbab//idp/ 196 B
282 B 9ms
9ms XHR
text/html 219.94.162.149
SAKURA-C SAKURA I...

General

Check archive.org

Show headers Download Go to

Full URL: https://tobeings2.sakura.ne.jp/mt/sbab//idp/co-branding?resource=co-branding&lang=en&provider=sbbkn
Requested by: Host: tobeings2.sakura.ne.jp
URL: https://tobeings2.sakura.ne.jp/mt/sbab/sbb.ch_de.bahnhof-services_waehrend-der-reise/SwissPass_files/jquery-20200819.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 219.94.162.149 , Japan, ASN9371 (SAKURA-C SAKURA Internet Inc., JP),
Reverse DNS: www1309.sakura.ne.jp
Software: nginx /
Resource Hash: 80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880

Request headers

Accept: */*
Referer: https://tobeings2.sakura.ne.jp/mt/sbab/sbb.ch_de.bahnhof-services_waehrend-der-reise/SwissPass.html
X-Requested-With: XMLHttpRequest
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 13 Jun 2022 13:45:51 GMT
server: nginx
content-length: 196
content-type: text/html; charset=iso-8859-1

GET
H2 200 hit.xiti
logs1407.xiti.com/ 35 B
307 B 89ms
72ms Image
image/gif 13.32.49.135
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://logs1407.xiti.com/hit.xiti?s=611076&idclient=0f6d5254-f15c-429d-866d-3d317c05bae2-NO&ts=1655127951752&vtag=5.27.0&ptag=js&r=1600x1200x24x24&re=1600x1200&hl=13x45x51&lng=en-US&idp=1345511469647&jv=0&p=login::SBB%20%7C%20SwissPass&s2=1&vrn=1&x3=[tobeings2.sakura.ne.jp%2Fmt%2Fsbab%2Fsbb.ch_de.bahnhof-services_waehrend-der-reise%2FSwissPass.html]&x4=[%2Flogin]&x5=[]&x6=[]&x7=[en]&x8=[]&x11=[https%3A%2F%2Ftobeings2.sakura.ne.jp%2Fmt%2Fsbab%2Fsbb.ch_de.bahnhof-services_waehrend-der-reise%2FSwissPass.html]&x12=[0]&x13=[SwissPass]&tms_version=swisspass.ch%20(digitalDataLayer)%3A%3Aproduction%3A%3A2021-11-30T15%3A10%3A31Z&s:login_status=0&s:login_type=SwissPass&ref=

Requested by

Host: tobeings2.sakura.ne.jp
URL: https://tobeings2.sakura.ne.jp/mt/sbab/sbb.ch_de.bahnhof-services_waehrend-der-reise/SwissPass.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.49.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-49-135.nrt57.r.cloudfront.net

Software

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://tobeings2.sakura.ne.jp/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 13 Jun 2022 13:45:51 GMT
via: 1.1 387e8a9502b77ca6a0fb349ab84d9420.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C1
strict-transport-security: max-age=15768000
x-cache: Miss from cloudfront
content-type: image/gif
cache-control: no-store
content-length: 35
x-amz-cf-id: 507IhhZibY-BMAMJO7qIPDAEESBwCJRhuCjbCdGSg90fhzeV4lPXKQ==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Schweizerische Bundesbahnen (Transportation)

36 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://tobeings2.sakura.ne.jp/mt/sbab//idp/co-branding?resource=co-branding&lang=en&provider=sbbkn Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.app.sbb.ch
logs1407.xiti.com
resources.swisspass.ch
tobeings2.sakura.ne.jp
13.32.49.135
193.203.121.145
219.94.162.149
52.28.109.177
225e078f0432e7459d74e8d9245f1982570a3897d664ca2d219ccd09b244ab95
24f31a4afb4d98c85b6cff4c9a953654a77986d6c4c9e9cae52cf57e59095e01
2fe0bb38ef9fa7e409d5529d9bbbce8973479f73f4086daa9d6b023b098c4582
4a3d4cf982535aaf485c6e3af9ad1498df5c065adf94eed056f0aa13c31e92ed
5c7f0e173844556da7ca5eb8936fa3dab1c00206960920a49a1eea9cde2bfaaf
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
787fde73cc8d5d8f6fd971e4f283415ea57971b3f72e4f26e6dff196a78d4f94
80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880
be0223ae72bc8c610c7a5453d349964cbe78ff8646695a58bc13a4cf0a8d81d6
c299a55acdc9c551ab7e67912892c6db8ed164dbcebaca370aa75f0f1297c8d4
ceb27bfba35e08b536d59228ace4ff893bdc1d78d5c05ca437193192b60b53eb
d45fd2cc05090e4b504f361216b1032409ed3cdf9904f50ce56e8a6b0f3c006e
d9b1cd430af98eca769d5f2d74c3fa6f2a2ac985df9dbc94e73b220f576abc66
deeee170c3759a6ed35c0c05c5b935d0e7638f1c0c5677166918ecff6edb1909
f766c7457c6ec463eaa85778aa47261344f1772e0b7cf1987ad212f889f472f5

tobeings2.sakura.ne.jp Open in urlscan Pro 219.94.162.149 Malicious Activity! Private Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

15 Requests

100 %HTTPS

0 %IPv6

4 Domains

4 Subdomains

4 IPs

4 Countries

1130 kBTransfer

1126 kBSize

0 Cookies

4 Outgoing links

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

36 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

tobeings2.sakura.ne.jp Open in urlscan Pro
219.94.162.149 Malicious Activity! Private Scan

Screenshot
Live screenshot

Full Image

15
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

4
Countries

1130 kB
Transfer

1126 kB
Size

0
Cookies

15 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!