www.login.evonenergies.ch Open in urlscan Pro
217.26.60.234 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.login.evonenergies.ch/
Submission: On April 03 via automatic, source openphish (April 3rd 2024, 1:15:56 am UTC) — Scanned from CH

Summary HTTP 10 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 10 HTTP transactions. The main IP is 217.26.60.234, located in Switzerland and belongs to HOSTPOINT-AS, CH. The main domain is www.login.evonenergies.ch.
TLS certificate: Issued by R3 on April 2nd 2024. Valid for: 3 months.

This is the only time www.login.evonenergies.ch was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
9	217.26.60.234 217.26.60.234	29097 (HOSTPOINT-AS) (HOSTPOINT-AS)
1	142.250.186.42 142.250.186.42	15169 (GOOGLE) (GOOGLE)
10	2

9 217.26.60.234 (Switzerland)

ASN29097 (HOSTPOINT-AS, CH)
PTR: sl2188.web.hostpoint.ch

www.login.evonenergies.ch	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
login.evonenergies.ch	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.42 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f10.1e100.net

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	evonenergies.ch www.login.evonenergies.ch login.evonenergies.ch	25 KB
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 357	30 KB
10	2

	Domain	Requested by
8	www.login.evonenergies.ch	www.login.evonenergies.ch
1	login.evonenergies.ch	www.login.evonenergies.ch
1	ajax.googleapis.com	www.login.evonenergies.ch
10	3

This site contains links to these domains. Also see Links.

Domain
www.microsoft.com
privacy.microsoft.com

Subject Issuer	Validity	Valid
www.login.evonenergies.ch R3	`2024-04-02` - `2024-07-01`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2024-03-04` - `2024-05-27`	3 months	crt.sh
login.evonenergies.ch R3	`2024-04-02` - `2024-07-01`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.login.evonenergies.ch/
Frame ID: 2EE1EED364177C6B4B525CB34C424F3E
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign in to your Microsoft account

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

10
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

2
IPs

2
Countries

55 kB
Transfer

120 kB
Size

0
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://www.microsoft.com/en-us/legal/terms-of-use
Title: Terms of use

Search URL Search Domain Scan URL

URL: https://privacy.microsoft.com/en-us/privacystatement#:~:text=Most%20Microsoft%20sites%20use%20cookies,ads%2C%20and%20analyze%20site%20operations.
Title: Privacy & cookies

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.login.evonenergies.ch/ 4 KB
1 KB 517ms
52ms Document
text/html 217.26.60.234
HOSTPOINT-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.login.evonenergies.ch/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.26.60.234 , Switzerland, ASN29097 (HOSTPOINT-AS, CH),
Reverse DNS: sl2188.web.hostpoint.ch
Software: Apache /
Resource Hash: bb6e856a0196ed9dd8ca3734fde5a02d6493b26f200c286873059eef854c9d97

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: de-CH,de;q=0.9
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 1261
content-type: text/html
date: Wed, 03 Apr 2024 01:15:50 GMT
etag: "1061-61519f6b020b0-gzip"
last-modified: Tue, 02 Apr 2024 09:45:17 GMT
server: Apache
vary: Accept-Encoding

GET
H2 200 app.css
www.login.evonenergies.ch/assets/ 6 KB
2 KB 74ms
66ms Stylesheet
text/css 217.26.60.234
HOSTPOINT-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.login.evonenergies.ch/assets/app.css
Requested by: Host: www.login.evonenergies.ch
URL: https://www.login.evonenergies.ch/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.26.60.234 , Switzerland, ASN29097 (HOSTPOINT-AS, CH),
Reverse DNS: sl2188.web.hostpoint.ch
Software: Apache /
Resource Hash: 066625a815bb748e37b8f69ae7f1a90a34c05aee0b353e83db1171b7a07bd262

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.login.evonenergies.ch/
accept-language: de-CH,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Apr 2024 01:15:50 GMT
content-encoding: gzip
last-modified: Tue, 02 Apr 2024 09:50:23 GMT
server: Apache
etag: "1632-6151a08eb93b3-gzip"
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 1693

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.7.1/ 85 KB
30 KB 907ms
55ms Script
text/javascript 142.250.186.42
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.7.1/jquery.min.js

Requested by

Host: www.login.evonenergies.ch
URL: https://www.login.evonenergies.ch/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.42 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f10.1e100.net

Software

sffe /

Resource Hash

fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.login.evonenergies.ch/
accept-language: de-CH,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 22:16:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 97160
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30462
x-xss-protection: 0
last-modified: Tue, 12 Sep 2023 02:38:22 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 01 Apr 2025 22:16:31 GMT

GET
H2 200 logo.png
www.login.evonenergies.ch/assets/ 1 KB
1 KB 72ms
65ms Image
image/png 217.26.60.234
HOSTPOINT-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.login.evonenergies.ch/assets/logo.png
Requested by: Host: www.login.evonenergies.ch
URL: https://www.login.evonenergies.ch/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.26.60.234 , Switzerland, ASN29097 (HOSTPOINT-AS, CH),
Reverse DNS: sl2188.web.hostpoint.ch
Software: Apache /
Resource Hash: 8702292cbc365e9f0488143e2b309b85efe09c61fd2e0a2e21c53735a309313c

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.login.evonenergies.ch/
accept-language: de-CH,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Apr 2024 01:15:50 GMT
last-modified: Tue, 02 Apr 2024 09:45:17 GMT
server: Apache
accept-ranges: bytes
etag: "578-61519f6b680fd"
content-length: 1400
content-type: image/png

GET
H2 200 question.png
www.login.evonenergies.ch/assets/ 412 B
467 B 71ms
64ms Image
image/png 217.26.60.234
HOSTPOINT-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.login.evonenergies.ch/assets/question.png
Requested by: Host: www.login.evonenergies.ch
URL: https://www.login.evonenergies.ch/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.26.60.234 , Switzerland, ASN29097 (HOSTPOINT-AS, CH),
Reverse DNS: sl2188.web.hostpoint.ch
Software: Apache /
Resource Hash: e8d06c0a072a671e5843de9a12f4cd826ca5e17bbeb4c57ee9c410ee878998e8

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.login.evonenergies.ch/
accept-language: de-CH,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Apr 2024 01:15:50 GMT
last-modified: Tue, 02 Apr 2024 09:45:17 GMT
server: Apache
accept-ranges: bytes
etag: "19c-61519f6b96edd"
content-length: 412
content-type: image/png

GET
H2 200 key.png
www.login.evonenergies.ch/assets/ 727 B
775 B 84ms
84ms Image
image/png 217.26.60.234
HOSTPOINT-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.login.evonenergies.ch/assets/key.png
Requested by: Host: www.login.evonenergies.ch
URL: https://www.login.evonenergies.ch/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.26.60.234 , Switzerland, ASN29097 (HOSTPOINT-AS, CH),
Reverse DNS: sl2188.web.hostpoint.ch
Software: Apache /
Resource Hash: 40ecb8832f6a9a8aaa0cc6e1287e867a4fca38433d091d86c6cab1f28fbab652

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.login.evonenergies.ch/
accept-language: de-CH,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Apr 2024 01:15:50 GMT
last-modified: Tue, 02 Apr 2024 09:45:17 GMT
server: Apache
accept-ranges: bytes
etag: "2d7-61519f6b5c594"
content-length: 727
content-type: image/png

GET
H2 200 back.png
www.login.evonenergies.ch/assets/ 231 B
277 B 85ms
84ms Image
image/png 217.26.60.234
HOSTPOINT-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.login.evonenergies.ch/assets/back.png
Requested by: Host: www.login.evonenergies.ch
URL: https://www.login.evonenergies.ch/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.26.60.234 , Switzerland, ASN29097 (HOSTPOINT-AS, CH),
Reverse DNS: sl2188.web.hostpoint.ch
Software: Apache /
Resource Hash: 70e32b2db3f079bb0295a85a0db15ed9e5926294dd947938d6cfa595f5ab18b4

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.login.evonenergies.ch/
accept-language: de-CH,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Apr 2024 01:15:50 GMT
last-modified: Tue, 02 Apr 2024 09:45:17 GMT
server: Apache
accept-ranges: bytes
etag: "e7-61519f6b41c08"
content-length: 231
content-type: image/png

GET
H2 200 app.js Show response
www.login.evonenergies.ch/assets/ 4 KB
1 KB 52ms
51ms Script
text/javascript 217.26.60.234
HOSTPOINT-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.login.evonenergies.ch/assets/app.js
Requested by: Host: www.login.evonenergies.ch
URL: https://www.login.evonenergies.ch/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.26.60.234 , Switzerland, ASN29097 (HOSTPOINT-AS, CH),
Reverse DNS: sl2188.web.hostpoint.ch
Software: Apache /
Resource Hash: 1387964b9d4fdc94c56943a95fcfe9c4f862d3e2ef4d24df74daba77cdd770a6

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.login.evonenergies.ch/
accept-language: de-CH,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Apr 2024 01:15:50 GMT
content-encoding: gzip
last-modified: Tue, 02 Apr 2024 09:51:00 GMT
server: Apache
etag: "ff8-6151a0b295aa6-gzip"
vary: Accept-Encoding
content-type: text/javascript
accept-ranges: bytes
content-length: 953

GET
H2 200 Microsoft_login_screen.svg
login.evonenergies.ch/assets/ 2 KB
815 B 522ms
61ms Image
image/svg+xml 217.26.60.234
HOSTPOINT-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://login.evonenergies.ch/assets/Microsoft_login_screen.svg
Requested by: Host: www.login.evonenergies.ch
URL: https://www.login.evonenergies.ch/assets/app.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.26.60.234 , Switzerland, ASN29097 (HOSTPOINT-AS, CH),
Reverse DNS: sl2188.web.hostpoint.ch
Software: Apache /
Resource Hash: 0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.login.evonenergies.ch/
accept-language: de-CH,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Apr 2024 01:15:52 GMT
content-encoding: gzip
last-modified: Tue, 02 Apr 2024 09:45:17 GMT
server: Apache
etag: "748-61519f6b75bc0-gzip"
vary: Accept-Encoding
content-type: image/svg+xml
accept-ranges: bytes
content-length: 673

GET
H2 200 favicon.ico
www.login.evonenergies.ch/assets/ 17 KB
17 KB 60ms
59ms Other
image/x-icon 217.26.60.234
HOSTPOINT-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.login.evonenergies.ch/assets/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.26.60.234 , Switzerland, ASN29097 (HOSTPOINT-AS, CH),
Reverse DNS: sl2188.web.hostpoint.ch
Software: Apache /
Resource Hash: 90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.login.evonenergies.ch/
accept-language: de-CH,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Apr 2024 01:15:52 GMT
last-modified: Tue, 02 Apr 2024 09:45:17 GMT
server: Apache
accept-ranges: bytes
etag: "4316-61519f6b511fa"
content-length: 17174
content-type: image/x-icon

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onpagereveal function| $ function| jQuery boolean| pwdVal

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://www.login.evonenergies.ch/ Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
login.evonenergies.ch
www.login.evonenergies.ch
142.250.186.42
217.26.60.234
066625a815bb748e37b8f69ae7f1a90a34c05aee0b353e83db1171b7a07bd262
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
1387964b9d4fdc94c56943a95fcfe9c4f862d3e2ef4d24df74daba77cdd770a6
40ecb8832f6a9a8aaa0cc6e1287e867a4fca38433d091d86c6cab1f28fbab652
70e32b2db3f079bb0295a85a0db15ed9e5926294dd947938d6cfa595f5ab18b4
8702292cbc365e9f0488143e2b309b85efe09c61fd2e0a2e21c53735a309313c
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21
bb6e856a0196ed9dd8ca3734fde5a02d6493b26f200c286873059eef854c9d97
e8d06c0a072a671e5843de9a12f4cd826ca5e17bbeb4c57ee9c410ee878998e8
fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a

www.login.evonenergies.ch Open in urlscan Pro 217.26.60.234 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

10 Requests

100 %HTTPS

0 %IPv6

2 Domains

3 Subdomains

2 IPs

2 Countries

55 kBTransfer

120 kBSize

0 Cookies

2 Outgoing links

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

www.login.evonenergies.ch Open in urlscan Pro
217.26.60.234 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

2
IPs

2
Countries

55 kB
Transfer

120 kB
Size

0
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!