urlscan.io logo urlscan.io
SecurityTrails logo

2020.icsptsa.org Open in urlscan Pro
192.185.232.183  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://s3.amazonaws.com/bjule59sandtez4ewf/swpass.html
Effective URL: https://2020.icsptsa.org/templates/protostar/css/chh/login.php
Submission: On February 20 via manual from ES — Scanned from ES
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 9 HTTP transactions. The main IP is 192.185.232.183, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is 2020.icsptsa.org.
TLS certificate: Issued by R3 on February 2nd 2024. Valid for: 3 months.
This is the only time 2020.icsptsa.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Schweizerische Bundesbahnen (Transportation)

Domain & IP information

IP Address AS Autonomous System
1 52.217.99.78 16509 (AMAZON-02)
1 9 192.185.232.183 46606 (UNIFIEDLA...)
9 2
Apex Domain
Subdomains		 Transfer
9 icsptsa.org
2020.icsptsa.org
380 KB
1 amazonaws.com
s3.amazonaws.com
748 B
9 2
Domain Requested by
9 2020.icsptsa.org 1 redirects s3.amazonaws.com
2020.icsptsa.org
1 s3.amazonaws.com
9 2

This site contains links to these domains. Also see Links.

Domain
www.swisspass.ch
login.swisspass.ch
Subject Issuer Validity Valid
s3.amazonaws.com
Amazon RSA 2048 M01		 2023-10-10 -
2024-07-10		 9 months crt.sh
2020.icsptsa.org
R3		 2024-02-02 -
2024-05-02		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://2020.icsptsa.org/templates/protostar/css/chh/login.php
Frame ID: B3FC37CF38F9A694F46F7CA0C0DF975B
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Swiss Pass

Page URL History Show full URLs

  1. https://s3.amazonaws.com/bjule59sandtez4ewf/swpass.html Page URL
  2. https://2020.icsptsa.org/templates/protostar/css/chh/go.php HTTP 302
    https://2020.icsptsa.org/templates/protostar/css/chh/login.php Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

380 kB
Transfer

460 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://s3.amazonaws.com/bjule59sandtez4ewf/swpass.html Page URL
  2. https://2020.icsptsa.org/templates/protostar/css/chh/go.php HTTP 302
    https://2020.icsptsa.org/templates/protostar/css/chh/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
swpass.html
s3.amazonaws.com/bjule59sandtez4ewf/ 		221 B
748 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s3.amazonaws.com/bjule59sandtez4ewf/swpass.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.217.99.78 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language
es-ES,es;q=0.9

Response headers

Accept-Ranges
bytes
Content-Length
221
Content-Type
text/html
Date
Tue, 20 Feb 2024 13:45:53 GMT
ETag
"2a5b2741f3f1a078a6f062f944c3f7ad"
Last-Modified
Tue, 20 Feb 2024 10:55:02 GMT
Server
AmazonS3
x-amz-id-2
bRxYQiICx7kC8bSlprsK2jnanTuwsN5SGj2XyVLLi8N6QXBlbz3MgiOg8t8Dy+z/13IRatIPSyM=
x-amz-meta-s3b-last-modified
20240220T102617Z
x-amz-meta-sha256
2e395ad5c9b08482a6091b298f2ec51b6dff894a2b3f597e96ddc6e295a17135
x-amz-request-id
TY6V60651HXYCBXF
x-amz-server-side-encryption
AES256
Primary Request login.php
2020.icsptsa.org/templates/protostar/css/chh/
Redirect Chain
  • https://2020.icsptsa.org/templates/protostar/css/chh/go.php
  • https://2020.icsptsa.org/templates/protostar/css/chh/login.php
17 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://2020.icsptsa.org/templates/protostar/css/chh/login.php
Requested by
Host: s3.amazonaws.com
URL: https://s3.amazonaws.com/bjule59sandtez4ewf/swpass.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.185.232.183 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
192-185-232-183.unifiedlayer.com
Software
Apache /
Resource Hash
ef81e4c69a7b30b9697a08da20453c10772bf95eec7fa46207f9d505498ff6e4

Request headers

Referer
https://s3.amazonaws.com/bjule59sandtez4ewf/swpass.html
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language
es-ES,es;q=0.9

Response headers

cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
content-length
4279
content-type
text/html; charset=UTF-8
date
Tue, 20 Feb 2024 13:45:53 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
server
Apache
vary
Accept-Encoding

Redirect headers

cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
content-length
111
content-type
text/html; charset=UTF-8
date
Tue, 20 Feb 2024 13:45:53 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
location
login.php
pragma
no-cache
server
Apache
vary
Accept-Encoding
sso.min-20200819.css
2020.icsptsa.org/templates/protostar/css/chh/filez/ 		81 KB
14 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://2020.icsptsa.org/templates/protostar/css/chh/filez/sso.min-20200819.css
Requested by
Host: 2020.icsptsa.org
URL: https://2020.icsptsa.org/templates/protostar/css/chh/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.185.232.183 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
192-185-232-183.unifiedlayer.com
Software
Apache /
Resource Hash
c0494f89be7292d192faee79f6ac5f93e95ded69207b73ff4660bb203017bcbc

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://2020.icsptsa.org/templates/protostar/css/chh/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date
Tue, 20 Feb 2024 13:45:53 GMT
content-encoding
gzip
last-modified
Wed, 09 Aug 2023 15:02:56 GMT
server
Apache
vary
Accept-Encoding
content-type
text/css
accept-ranges
bytes
content-length
13940
logo.png
2020.icsptsa.org/templates/protostar/css/chh/filez/ 		548 B
586 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://2020.icsptsa.org/templates/protostar/css/chh/filez/logo.png
Requested by
Host: 2020.icsptsa.org
URL: https://2020.icsptsa.org/templates/protostar/css/chh/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.185.232.183 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
192-185-232-183.unifiedlayer.com
Software
Apache /
Resource Hash
f2f0d94a5141a75ef227f2699b6a43588741ede3edd2fe2d075a65b3d413b2f8

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://2020.icsptsa.org/templates/protostar/css/chh/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date
Tue, 20 Feb 2024 13:45:53 GMT
last-modified
Wed, 09 Aug 2023 02:59:08 GMT
server
Apache
accept-ranges
bytes
content-length
548
content-type
image/png
logo_text_de-20200819.svg
2020.icsptsa.org/templates/protostar/css/chh/filez/ 		137 KB
137 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://2020.icsptsa.org/templates/protostar/css/chh/filez/logo_text_de-20200819.svg
Requested by
Host: 2020.icsptsa.org
URL: https://2020.icsptsa.org/templates/protostar/css/chh/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.185.232.183 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
192-185-232-183.unifiedlayer.com
Software
Apache /
Resource Hash
c337d42ed7979c6be0282900bd957dd9d112a430dc7761463d655eb8f0d9bc07

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://2020.icsptsa.org/templates/protostar/css/chh/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date
Tue, 20 Feb 2024 13:45:53 GMT
last-modified
Wed, 09 Aug 2023 02:59:08 GMT
server
Apache
accept-ranges
bytes
content-length
139971
content-type
image/svg+xml
logo-20200819.svg
2020.icsptsa.org/templates/protostar/css/chh/filez/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://2020.icsptsa.org/templates/protostar/css/chh/filez/logo-20200819.svg
Requested by
Host: 2020.icsptsa.org
URL: https://2020.icsptsa.org/templates/protostar/css/chh/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.185.232.183 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
192-185-232-183.unifiedlayer.com
Software
Apache /
Resource Hash
deeee170c3759a6ed35c0c05c5b935d0e7638f1c0c5677166918ecff6edb1909

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://2020.icsptsa.org/templates/protostar/css/chh/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date
Tue, 20 Feb 2024 13:45:53 GMT
last-modified
Wed, 09 Aug 2023 02:59:08 GMT
server
Apache
accept-ranges
bytes
content-length
7374
content-type
image/svg+xml
login_bg.jpg
2020.icsptsa.org/templates/protostar/css/chh/filez/ 		196 KB
196 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://2020.icsptsa.org/templates/protostar/css/chh/filez/login_bg.jpg
Requested by
Host: 2020.icsptsa.org
URL: https://2020.icsptsa.org/templates/protostar/css/chh/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.185.232.183 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
192-185-232-183.unifiedlayer.com
Software
Apache /
Resource Hash
58a037c0bde953b48561826f3df16031f7ddfce33c4018619d3f39c6af6eec1b

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://2020.icsptsa.org/templates/protostar/css/chh/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date
Tue, 20 Feb 2024 13:45:54 GMT
last-modified
Wed, 09 Aug 2023 02:59:08 GMT
server
Apache
accept-ranges
bytes
content-length
200933
content-type
image/jpeg
SBBWeb-Light.woff2
2020.icsptsa.org/templates/protostar/css/chh/filez/ 		14 KB
14 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://2020.icsptsa.org/templates/protostar/css/chh/filez/SBBWeb-Light.woff2
Requested by
Host: 2020.icsptsa.org
URL: https://2020.icsptsa.org/templates/protostar/css/chh/filez/sso.min-20200819.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.185.232.183 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
192-185-232-183.unifiedlayer.com
Software
Apache /
Resource Hash
5c7f0e173844556da7ca5eb8936fa3dab1c00206960920a49a1eea9cde2bfaaf

Request headers

Referer
https://2020.icsptsa.org/templates/protostar/css/chh/filez/sso.min-20200819.css
Origin
https://2020.icsptsa.org
accept-language
es-ES,es;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date
Tue, 20 Feb 2024 13:45:54 GMT
last-modified
Wed, 09 Aug 2023 02:59:08 GMT
server
Apache
accept-ranges
bytes
content-length
14212
content-type
font/woff2
icomoon.woff2
2020.icsptsa.org/templates/protostar/css/chh/filez/ 		7 KB
7 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://2020.icsptsa.org/templates/protostar/css/chh/filez/icomoon.woff2
Requested by
Host: 2020.icsptsa.org
URL: https://2020.icsptsa.org/templates/protostar/css/chh/filez/sso.min-20200819.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.185.232.183 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
192-185-232-183.unifiedlayer.com
Software
Apache /
Resource Hash
45b8f30ef99295a0d738416e4e5af9fa2dd41619499622c2c57416580fc7197b

Request headers

Referer
https://2020.icsptsa.org/templates/protostar/css/chh/filez/sso.min-20200819.css
Origin
https://2020.icsptsa.org
accept-language
es-ES,es;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date
Tue, 20 Feb 2024 13:45:54 GMT
last-modified
Wed, 09 Aug 2023 02:59:08 GMT
server
Apache
accept-ranges
bytes
content-length
6944
content-type
font/woff2

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Schweizerische Bundesbahnen (Transportation)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Domain/Path Name / Value
2020.icsptsa.org/ Name: PHPSESSID
Value: 28cf6cc966fbfdc3306bfde3e0827306