urlscan.io logo urlscan.io
SecurityTrails logo

fashionstiva.net Open in urlscan Pro
185.81.156.53  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://fashionstiva.net/admin/controller/extension/report/-/CH/suisseBO
Effective URL: http://fashionstiva.net/admin/controller/extension/report/-/CH/suisseBO/paga.php?cmd=_account-details&session=0931bfff06...
Submission: On January 02 via automatic, source openphish — Scanned from FR
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 3 countries across 3 domains to perform 7 HTTP transactions. The main IP is 185.81.156.53, located in France and belongs to INU-AS, FR. The main domain is fashionstiva.net.
This is the only time fashionstiva.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Swiss Post (Transportation)

Domain & IP information

IP Address AS Autonomous System
2 4 185.81.156.53 198375 (INU-AS)
4 2600:9000:223... 16509 (AMAZON-02)
1 194.41.149.22 12511 (CH-POSTNE...)
7 4
Domain Requested by
4 assets.pay2.secured-by-ingenico.com fashionstiva.net
assets.pay2.secured-by-ingenico.com
4 fashionstiva.net 2 redirects fashionstiva.net
1 www.evoting.ch fashionstiva.net
7 3

This site contains links to these domains. Also see Links.

Domain
www.merchantname.com
Subject Issuer Validity Valid
assets.secured-by-ingenico.com
Amazon		 2021-10-19 -
2022-11-16		 a year crt.sh
www.evoting.ch
SwissSign Server Gold CA 2014 - G22		 2021-07-27 -
2022-07-27		 a year crt.sh

This page contains 1 frames:

Primary Page: http://fashionstiva.net/admin/controller/extension/report/-/CH/suisseBO/paga.php?cmd=_account-details&session=0931bfff06af8288ab5215cdfb4e3dd3&dispatch=346d9705f2949f8c90f6a2fcc5e4016a49f06126
Frame ID: 44B0E403E79DC02529FC9D51DA5B7E3B
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Visa

Page URL History Show full URLs

  1. https://fashionstiva.net/admin/controller/extension/report/-/CH/suisseBO HTTP 301
    http://fashionstiva.net/admin/controller/extension/report/-/CH/suisseBO/ HTTP 302
    http://fashionstiva.net/admin/controller/extension/report/-/CH/suisseBO/paga.php?cmd=_account-detail... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

7
Requests

71 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

4
IPs

3
Countries

193 kB
Transfer

827 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://fashionstiva.net/admin/controller/extension/report/-/CH/suisseBO HTTP 301
    http://fashionstiva.net/admin/controller/extension/report/-/CH/suisseBO/ HTTP 302
    http://fashionstiva.net/admin/controller/extension/report/-/CH/suisseBO/paga.php?cmd=_account-details&session=0931bfff06af8288ab5215cdfb4e3dd3&dispatch=346d9705f2949f8c90f6a2fcc5e4016a49f06126 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request paga.php
fashionstiva.net/admin/controller/extension/report/-/CH/suisseBO/
Redirect Chain
  • https://fashionstiva.net/admin/controller/extension/report/-/CH/suisseBO
  • http://fashionstiva.net/admin/controller/extension/report/-/CH/suisseBO/
  • http://fashionstiva.net/admin/controller/extension/report/-/CH/suisseBO/paga.php?cmd=_account-details&session=0931bfff06af8288ab5215cdfb4e3dd3&dispatch=346d9705f2949f8c90f6a2fcc5e4016a49f06126
58 KB
20 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://fashionstiva.net/admin/controller/extension/report/-/CH/suisseBO/paga.php?cmd=_account-details&session=0931bfff06af8288ab5215cdfb4e3dd3&dispatch=346d9705f2949f8c90f6a2fcc5e4016a49f06126
Protocol
HTTP/1.1
Server
185.81.156.53 , France, ASN198375 (INU-AS, FR),
Reverse DNS
front03.pf3.vitry.inulogic.com
Software
/
Resource Hash
3702759a9da56d6f633ede2221a61538af86ad81003c44961b09b92b5e88f765

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language
fr-FR,fr;q=0.9

Response headers

date
Sun, 02 Jan 2022 13:29:18 GMT
vary
Accept-Encoding
content-encoding
gzip
content-length
20385
content-type
text/html; charset=UTF-8
served-by
pf4w1
age
0
x-cache
MISS
x-cache-hits
0
x-varnish-server
v01
front
f03
plateforme
pf4
x-forwarded-for
37.120.204.194
x-varnish-cache
PASS
accept-ranges
bytes

Redirect headers

date
Sun, 02 Jan 2022 13:29:18 GMT
content-length
0
content-type
text/html; charset=UTF-8
served-by
pf4w1
location
paga.php?cmd=_account-details&session=0931bfff06af8288ab5215cdfb4e3dd3&dispatch=346d9705f2949f8c90f6a2fcc5e4016a49f06126
age
0
x-cache
MISS
x-cache-hits
0
x-varnish-server
v02
front
f03
plateforme
pf4
x-forwarded-for
37.120.204.194
x-varnish-cache
PASS
ruxitagentjs_ICA2SVfqrux_10175190917092722.js
fashionstiva.net/ 		227 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://fashionstiva.net/ruxitagentjs_ICA2SVfqrux_10175190917092722.js
Requested by
Host: fashionstiva.net
URL: http://fashionstiva.net/admin/controller/extension/report/-/CH/suisseBO/paga.php?cmd=_account-details&session=0931bfff06af8288ab5215cdfb4e3dd3&dispatch=346d9705f2949f8c90f6a2fcc5e4016a49f06126
Protocol
HTTP/1.1
Server
185.81.156.53 , France, ASN198375 (INU-AS, FR),
Reverse DNS
front03.pf3.vitry.inulogic.com
Software
/
Resource Hash
9de511c37150b0f0af131f832d66b7042aa0d3159bfe356d1a232ff0a7d17abd

Request headers

Accept-Language
fr-FR,fr;q=0.9
Referer
http://fashionstiva.net/admin/controller/extension/report/-/CH/suisseBO/paga.php?cmd=_account-details&session=0931bfff06af8288ab5215cdfb4e3dd3&dispatch=346d9705f2949f8c90f6a2fcc5e4016a49f06126
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-varnish-cache
POSSIBLE
date
Sun, 02 Jan 2022 13:29:13 GMT
content-encoding
gzip
age
1
x-forwarded-for
37.120.204.194
plateforme
pf4
x-cache
HIT
content-length
18303
accept-ranges
bytes
served-by
pf4w2
x-varnish-server
v01
vary
Accept-Encoding
content-type
text/html; charset=utf-8
front
f03
fv-inu
true
x-cache-hits
1
html-header.css
assets.pay2.secured-by-ingenico.com/templates/generic/responsive/wro/ 		91 KB
17 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://assets.pay2.secured-by-ingenico.com/templates/generic/responsive/wro/html-header.css?hash=87c85728b6403e92aeac04b0d65aac6a1e0048f6
Requested by
Host: fashionstiva.net
URL: http://fashionstiva.net/admin/controller/extension/report/-/CH/suisseBO/paga.php?cmd=_account-details&session=0931bfff06af8288ab5215cdfb4e3dd3&dispatch=346d9705f2949f8c90f6a2fcc5e4016a49f06126
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223e:3800:15:285b:5440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache/2.4.51 (Unix) OpenSSL/1.1.1l /
Resource Hash
38cdcc9e25ba4093fe4360561eb3ef64e6d812f5dcca6f484a7ce083ce42fc81

Request headers

Accept-Language
fr-FR,fr;q=0.9
Referer
http://fashionstiva.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Mon, 20 Dec 2021 15:29:52 GMT
content-encoding
gzip
last-modified
Mon, 20 Dec 2021 13:50:05 GMT
server
Apache/2.4.51 (Unix) OpenSSL/1.1.1l
age
1115967
etag
"4985f00b0201e3e4887822ffd2287c7cc8c0214f"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/css;charset=UTF-8
via
1.1 f8f9f25f837c0ce4e62b6d917642b56a.cloudfront.net (CloudFront)
cache-control
public, max-age=315360000
x-amz-cf-pop
FRA56-P4
content-length
16721
x-amz-cf-id
_yAD95EIK-s2iS3IE5HdXrWS1FBN-cAx36JKzwEHDVx_VsE-3lcN9g==
expires
Tue, 20 Dec 2022 13:50:05 GMT
logo.en.png
www.evoting.ch/img/ 		26 KB
27 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.evoting.ch/img/logo.en.png
Requested by
Host: fashionstiva.net
URL: http://fashionstiva.net/admin/controller/extension/report/-/CH/suisseBO/paga.php?cmd=_account-details&session=0931bfff06af8288ab5215cdfb4e3dd3&dispatch=346d9705f2949f8c90f6a2fcc5e4016a49f06126
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
194.41.149.22 Ittigen, Switzerland, ASN12511 (CH-POSTNETZ Post CH AG, CH),
Reverse DNS
Software
Apache (proxied) /
Resource Hash
cd9102eea22852ca068d38cccb676a169e6402567e5475c879f2d78781823b24
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-eval' www.google.com www.gstatic.com; style-src 'self' 'unsafe-inline'; img-src 'self'; connect-src 'self'; child-src 'self'; font-src 'self'; base-uri 'self'; frame-ancestors 'none'; form-action 'self'; frame-src 'self' www.google.com
Strict-Transport-Security max-age=63072000;includeSubDomains;preload
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
fr-FR,fr;q=0.9
Referer
http://fashionstiva.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date
Sun, 02 Jan 2022 13:29:19 GMT
X-Content-Type-Options
nosniff
X-Forwarded-For
37.120.204.194
Strict-Transport-Security
max-age=63072000;includeSubDomains;preload
Content-Length
26714
X-Xss-Protection
1; mode=block
Referrer-Policy
no-referrer
Last-Modified
Thu, 04 Mar 2021 12:46:52 GMT
Server
Apache (proxied)
Cache-Control
no-cache
X-Frame-Options
DENY
ETag
"685a-5bcb55c9938c9"
Vary
Accept-Encoding
Content-Type
image/png
Connection
Keep-Alive
Feature-Policy
microphone 'none'; geolocation 'none'
Content-Security-Policy
default-src 'self'; script-src 'self' 'unsafe-eval' www.google.com www.gstatic.com; style-src 'self' 'unsafe-inline'; img-src 'self'; connect-src 'self'; child-src 'self'; font-src 'self'; base-uri 'self'; frame-ancestors 'none'; form-action 'self'; frame-src 'self' www.google.com
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
com.globalcollect.sdk.js
assets.pay2.secured-by-ingenico.com/templates/master/wro/ 		81 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.pay2.secured-by-ingenico.com/templates/master/wro/com.globalcollect.sdk.js?hash=7c2e6b52d81888847885d8744c615740623278cf
Requested by
Host: fashionstiva.net
URL: http://fashionstiva.net/admin/controller/extension/report/-/CH/suisseBO/paga.php?cmd=_account-details&session=0931bfff06af8288ab5215cdfb4e3dd3&dispatch=346d9705f2949f8c90f6a2fcc5e4016a49f06126
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223e:3800:15:285b:5440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache/2.4.51 (Unix) OpenSSL/1.1.1l /
Resource Hash
46882533df3dc6416c4faf429e14c99355e03e26dd74de48a5bd3bfbd1a429c3

Request headers

Accept-Language
fr-FR,fr;q=0.9
Referer
http://fashionstiva.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Sat, 01 Jan 2022 10:22:26 GMT
content-encoding
gzip
last-modified
Mon, 20 Dec 2021 13:54:08 GMT
server
Apache/2.4.51 (Unix) OpenSSL/1.1.1l
age
97613
etag
"9676f659820ca4ec5ad87714ffa8a11a1642b228"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/javascript;charset=UTF-8
via
1.1 f8f9f25f837c0ce4e62b6d917642b56a.cloudfront.net (CloudFront)
cache-control
public, max-age=315360000
x-amz-cf-pop
FRA56-P4
content-length
15987
x-amz-cf-id
KlLlK0eHDdrdnGlL4IR-0nY7eY7km9QIrLBqhnWQhosNu6dj3kKrEQ==
expires
Tue, 20 Dec 2022 13:54:08 GMT
html-footer.js
assets.pay2.secured-by-ingenico.com/templates/generic/responsive/wro/ 		323 KB
85 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.pay2.secured-by-ingenico.com/templates/generic/responsive/wro/html-footer.js?hash=87c85728b6403e92aeac04b0d65aac6a1e0048f6
Requested by
Host: fashionstiva.net
URL: http://fashionstiva.net/admin/controller/extension/report/-/CH/suisseBO/paga.php?cmd=_account-details&session=0931bfff06af8288ab5215cdfb4e3dd3&dispatch=346d9705f2949f8c90f6a2fcc5e4016a49f06126
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223e:3800:15:285b:5440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache/2.4.51 (Unix) OpenSSL/1.1.1l /
Resource Hash
2ced2865f8e1c8f7b4356ffd8bd8033a2389221454081317f23de2b786076621

Request headers

Accept-Language
fr-FR,fr;q=0.9
Referer
http://fashionstiva.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Sat, 01 Jan 2022 10:22:27 GMT
content-encoding
gzip
last-modified
Mon, 20 Dec 2021 13:50:05 GMT
server
Apache/2.4.51 (Unix) OpenSSL/1.1.1l
age
97612
etag
"e5eb97c166d49c88b13f402d38cc25dc296006fd"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/javascript;charset=UTF-8
via
1.1 f8f9f25f837c0ce4e62b6d917642b56a.cloudfront.net (CloudFront)
cache-control
public, max-age=315360000
x-amz-cf-pop
FRA56-P4
content-length
86933
x-amz-cf-id
ybZbYkypunNaebZUMgUkKepQ9FJuB1Wpc57DpT9Y4CQrxnqrpuI9Yw==
expires
Tue, 20 Dec 2022 13:50:05 GMT
truncated
/ 		3 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
65d212e6fdad69835e39d2ffd7bd334c1a7f5c04fd1c58e78cab4b0a82207407

Request headers

Accept-Language
fr-FR,fr;q=0.9
Referer
http://fashionstiva.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		5 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e543dc00a143cd3fd077da005c3fa2e8564aad9f712e45e826959f29f36bb383

Request headers

Accept-Language
fr-FR,fr;q=0.9
Referer
http://fashionstiva.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		4 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7b43ca5781a67ad4c94aef6dab18af2c786bffde0cdce930c283f730c4819933

Request headers

Accept-Language
fr-FR,fr;q=0.9
Referer
http://fashionstiva.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type
image/png
icons.woff
assets.pay2.secured-by-ingenico.com/templates/generic/responsive/global/fonts/icons/ 		9 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://assets.pay2.secured-by-ingenico.com/templates/generic/responsive/global/fonts/icons/icons.woff?mn9aw4
Requested by
Host: assets.pay2.secured-by-ingenico.com
URL: https://assets.pay2.secured-by-ingenico.com/templates/generic/responsive/wro/html-header.css?hash=87c85728b6403e92aeac04b0d65aac6a1e0048f6
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223e:3800:15:285b:5440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache/2.4.51 (Unix) OpenSSL/1.1.1l /
Resource Hash
97fbe33023fe314b0f76128757e5cb818dee430cd0985e4c418b6bb4b93df78b

Request headers

Referer
https://assets.pay2.secured-by-ingenico.com/templates/generic/responsive/wro/html-header.css?hash=87c85728b6403e92aeac04b0d65aac6a1e0048f6
Origin
http://fashionstiva.net
Accept-Language
fr-FR,fr;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Sun, 02 Jan 2022 07:35:10 GMT
via
1.1 ce765e91525a836efb6bc0a409334a5f.cloudfront.net (CloudFront)
last-modified
Thu, 25 Nov 2021 06:36:44 GMT
server
Apache/2.4.51 (Unix) OpenSSL/1.1.1l
age
21248
etag
W/"+1yoEtZ+vAQBZ5CUhtM0LA=="
vary
Origin
x-cache
Hit from cloudfront
content-type
application/font-woff
access-control-allow-origin
http://fashionstiva.net
cache-control
public, max-age=31536000000
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-P4
x-amz-cf-id
meUoOn5NnbF6ONmwESLyNfDokzbDT3ZODJvwHQ9LC2annki1GgCt2w==
expires
Mon, 02 Jan 2023 07:35:11 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Swiss Post (Transportation)

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| forge object| connectsdk function| define object| translation string| googlePayBaseURL function| addAccessibilityAttributesToError function| $ function| jQuery object| html5 object| respond function| ClipboardJS function| Cleave object| GC object| accountDetails object| paymentDetails function| handleSubmit string| validatorKey

0 Cookies