www.cembrainfo.sviluppo.host

Summary

This website contacted 5 IPs in 4 countries across 5 domains to perform 6 HTTP transactions. The main IP is 149.62.185.18, located in Italy and belongs to COLTENGINE COLTENGINE Network, IT. The main domain is www.cembrainfo.sviluppo.host.
TLS certificate: Issued by E6 on July 8th 2024. Valid for: 3 months.

This is the only time www.cembrainfo.sviluppo.host was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Cembra (Banking)

Domain & IP information

	IP Address	AS Autonomous System
2	149.62.185.18 149.62.185.18	47242 (COLTENGIN...) (COLTENGINE COLTENGINE Network)
1	80.74.155.60 80.74.155.60	21069 (ASN-METAN...) (ASN-METANET Routingpeering issues: noc@metanet.ch)
1	193.222.93.232 193.222.93.232	3303 (SWISSCOM ...) (SWISSCOM Swisscom Switzerland Ltd)
1	172.67.147.51 172.67.147.51	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	162.19.88.68 162.19.88.68	16276 (OVH) (OVH)
6	5

2 149.62.185.18 (Italy)

ASN47242 (COLTENGINE COLTENGINE Network, IT)
PTR: w3003.shared.host.it

www.cembrainfo.sviluppo.host	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 80.74.155.60 (Switzerland)

ASN21069 (ASN-METANET Routingpeering issues: noc@metanet.ch, CH)
PTR: torn.sui-inter.net

www.200acw.ch	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 193.222.93.232 (Switzerland)

ASN3303 (SWISSCOM Swisscom Switzerland Ltd, CH)

eservice.cembra.ch	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.147.51 (United States)

ASN13335 (CLOUDFLARENET, US)

dabuttonfactory.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.19.88.68 (France)

ASN16276 (OVH, FR)
PTR: ns3221377.ip-162-19-88.eu

i.postimg.cc	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	sviluppo.host www.cembrainfo.sviluppo.host	3 KB
1	postimg.cc i.postimg.cc — Cisco Umbrella Rank: 18784	49 KB
1	dabuttonfactory.com dabuttonfactory.com	5 KB
1	cembra.ch eservice.cembra.ch	35 KB
1	200acw.ch www.200acw.ch	59 KB
6	5

	Domain	Requested by
2	www.cembrainfo.sviluppo.host
1	i.postimg.cc	www.cembrainfo.sviluppo.host
1	dabuttonfactory.com	www.cembrainfo.sviluppo.host
1	eservice.cembra.ch	www.cembrainfo.sviluppo.host
1	www.200acw.ch	www.cembrainfo.sviluppo.host
6	5

This site contains no links.

Subject Issuer	Validity	Valid
cembrainfo.sviluppo.host E6	`2024-07-08` - `2024-10-06`	3 months	crt.sh
ac-w.ch R3	`2024-05-15` - `2024-08-13`	3 months	crt.sh
eservice.cembra.ch SwissSign RSA TLS EV ICA 2022 - 1	`2023-10-24` - `2024-10-24`	a year	crt.sh
dabuttonfactory.com WE1	`2024-06-27` - `2024-09-25`	3 months	crt.sh
postimg.cc R11	`2024-06-21` - `2024-09-19`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.cembrainfo.sviluppo.host/
Frame ID: ED30786572BA70F6F39290D1283F4A10
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

(CH) | SBB

Page Statistics

6
Requests

100 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

5
IPs

4
Countries

150 kB
Transfer

149 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.cembrainfo.sviluppo.host/ 2 KB
1 KB 105ms
35ms Document
text/html 149.62.185.18
COLTENGINE COLTEN...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cembrainfo.sviluppo.host/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 149.62.185.18 , Italy, ASN47242 (COLTENGINE COLTENGINE Network, IT),
Reverse DNS: w3003.shared.host.it
Software: nginx /
Resource Hash: 01fb602fbfc35a561447e1cf086ea7b5a87483223bb1b5e50060762f890ea0c2

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding: br
content-length: 830
content-type: text/html
date: Mon, 08 Jul 2024 17:56:02 GMT
etag: "76d-6616a53f-24162c4dd135c6a5;br"
last-modified: Wed, 10 Apr 2024 14:42:07 GMT
server: nginx
vary: Accept-Encoding,User-Agent

GET
H2 200 cembra.png
www.200acw.ch/uploads/images/Gallery/partner-extended/ 59 KB
59 KB 135ms
42ms Image
image/png 80.74.155.60
ASN-METANET Routi...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.200acw.ch/uploads/images/Gallery/partner-extended/cembra.png
Requested by: Host: www.cembrainfo.sviluppo.host
URL: https://www.cembrainfo.sviluppo.host/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 80.74.155.60 , Switzerland, ASN21069 (ASN-METANET Routingpeering issues: noc@metanet.ch, CH),
Reverse DNS: torn.sui-inter.net
Software: nginx /
Resource Hash: 2972fbb44dee4ea787130eed225c7fba1ff52cb81f06f98df08a27f9ee6bd431

Request headers

Referer: https://www.cembrainfo.sviluppo.host/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Mon, 08 Jul 2024 17:56:02 GMT
last-modified: Fri, 29 Nov 2019 17:16:33 GMT
server: nginx
etag: "5de15271-ecd6"
content-type: image/png
cache-control: public
accept-ranges: bytes
content-length: 60630
expires: Tue, 08 Jul 2025 17:56:02 GMT

GET
H/1.1 200
OK eservice-login-background.jpg
eservice.cembra.ch/login/resources/nevislogrend/applications/EService/webdata/images/ 34 KB
35 KB 132ms
26ms Image
image/jpeg 193.222.93.232
SWISSCOM Swisscom...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://eservice.cembra.ch/login/resources/nevislogrend/applications/EService/webdata/images/eservice-login-background.jpg

Requested by

Host: www.cembrainfo.sviluppo.host
URL: https://www.cembrainfo.sviluppo.host/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

193.222.93.232 , Switzerland, ASN3303 (SWISSCOM Swisscom Switzerland Ltd, CH),

Reverse DNS

Software

Apache /

Resource Hash

ed5c4f940fbb29ad6ea580e52d696b5badd28efa17ef068f0dda1f5c4026ca45

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.cembrainfo.sviluppo.host/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date: Mon, 08 Jul 2024 17:56:02 GMT
Strict-Transport-Security: max-age=31536000
Server: Apache
Content-Type: image/jpeg
Cache-Control: must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=5, max=10
Content-Length: 35045
Expires: Mon, 08 Jul 2024 18:00:56 GMT

GET
H3 200 button.png
dabuttonfactory.com/ 4 KB
5 KB 110ms
42ms Image
image/png 172.67.147.51
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dabuttonfactory.com/button.png?t=Zugriff+auf+mein+Konto&f=Open+Sans-Bold&ts=26&tc=fff&hp=45&vp=20&c=0&bgt=unicolored&bgc=9fc127
Requested by: Host: www.cembrainfo.sviluppo.host
URL: https://www.cembrainfo.sviluppo.host/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.147.51 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5ab8183b7ea804649ac47f845374d77704b95bae5ff7409caeca06cd648991a5

Request headers

Referer: https://www.cembrainfo.sviluppo.host/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Mon, 08 Jul 2024 17:56:02 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 24929
etag: W/"2"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8vAf93lUhV9n3qDL82JfhhUPRLn2dyz8xUmqGys%2Feshk2wVMzLt87EQz1T5ia2oSHiSYXI3WICCtcz6iuNCA3XXAH9MeN4SVpk%2F58UNYam%2BXrqzHE8gcKrIf50NqJ8x21qmSR5t9"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=31536000
content-disposition: attachment
accept-ranges: bytes
cf-ray: 8a01f2d9eb6a83a9-MXP
alt-svc: h3=":443"; ma=86400
content-length: 4471

GET
H2 200 Pngtree-mouse-hand-click-5453102.png
i.postimg.cc/6qD5z4bH/ 48 KB
49 KB 885ms
125ms Image
image/png 162.19.88.68
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.postimg.cc/6qD5z4bH/Pngtree-mouse-hand-click-5453102.png
Requested by: Host: www.cembrainfo.sviluppo.host
URL: https://www.cembrainfo.sviluppo.host/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.19.88.68 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3221377.ip-162-19-88.eu
Software: nginx /
Resource Hash: b96d2d6ec74aa5a505a713c3c542bdb14609e0b4fe86d15337d08a67429e0507

Request headers

Referer: https://www.cembrainfo.sviluppo.host/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Mon, 08 Jul 2024 17:56:02 GMT
last-modified: Thu, 17 Nov 2022 17:00:42 GMT
server: nginx
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 49428
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 404 favicon.ico
www.cembrainfo.sviluppo.host/ 1 KB
2 KB 30ms
29ms Other
text/html 149.62.185.18
COLTENGINE COLTEN...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cembrainfo.sviluppo.host/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 149.62.185.18 , Italy, ASN47242 (COLTENGINE COLTENGINE Network, IT),
Reverse DNS: w3003.shared.host.it
Software: nginx /
Resource Hash: 4c13d452dd5d49671bd93ca32f2b4f85c78e39b6ab0ad1f38d98ed267f8fd896

Request headers

Referer: https://www.cembrainfo.sviluppo.host/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 08 Jul 2024 17:56:03 GMT
server: nginx
vary: User-Agent
content-type: text/html
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 1251

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Cembra (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://www.cembrainfo.sviluppo.host/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

dabuttonfactory.com
eservice.cembra.ch
i.postimg.cc
www.200acw.ch
www.cembrainfo.sviluppo.host
149.62.185.18
162.19.88.68
172.67.147.51
193.222.93.232
80.74.155.60
01fb602fbfc35a561447e1cf086ea7b5a87483223bb1b5e50060762f890ea0c2
2972fbb44dee4ea787130eed225c7fba1ff52cb81f06f98df08a27f9ee6bd431
4c13d452dd5d49671bd93ca32f2b4f85c78e39b6ab0ad1f38d98ed267f8fd896
5ab8183b7ea804649ac47f845374d77704b95bae5ff7409caeca06cd648991a5
b96d2d6ec74aa5a505a713c3c542bdb14609e0b4fe86d15337d08a67429e0507
ed5c4f940fbb29ad6ea580e52d696b5badd28efa17ef068f0dda1f5c4026ca45

www.cembrainfo.sviluppo.host Open in urlscan Pro 149.62.185.18 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

6 Requests

100 %HTTPS

0 %IPv6

5 Domains

5 Subdomains

5 IPs

4 Countries

150 kBTransfer

149 kBSize

0 Cookies

0 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

www.cembrainfo.sviluppo.host Open in urlscan Pro
149.62.185.18 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

5
IPs

4
Countries

150 kB
Transfer

149 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!