zqa.vji.mybluehost.me
Open in
urlscan Pro
50.6.152.236
Malicious Activity!
Public Scan
Submitted URL: https://zqa.vji.mybluehost.me/on/oneex/ANO11/dossier/
Effective URL: https://zqa.vji.mybluehost.me/on/oneex/ANO11/dossier/page-1.html
Submission: On September 15 via automatic, source phishtank — Scanned from DE
Effective URL: https://zqa.vji.mybluehost.me/on/oneex/ANO11/dossier/page-1.html
Submission: On September 15 via automatic, source phishtank — Scanned from DE
Summary
This website contacted 2 IPs
in 2 countries
across 2 domains to perform 14 HTTP transactions.
The main IP is 50.6.152.236, located in
United States and
belongs to NETWORK-SOLUTIONS-HOSTING, US.
The main domain is zqa.vji.mybluehost.me.
TLS certificate: Issued by R11 on September 9th 2024. Valid for: 3 months.
This is the only time zqa.vji.mybluehost.me was scanned on urlscan.io!
TLS certificate: Issued by R11 on September 9th 2024. Valid for: 3 months.
This is the only time zqa.vji.mybluehost.me was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Viseca (Financial)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 6 | 50.6.152.236 50.6.152.236 | 19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING) | |
| 9 | 217.111.139.8 217.111.139.8 | 208305 (AS_VISECA) (AS_VISECA) | |
| 14 | 2 |
6
50.6.152.236
(United States)
ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: 50-6-152-236.unifiedlayer.com
ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: 50-6-152-236.unifiedlayer.com
| zqa.vji.mybluehost.me |
9
217.111.139.8
(Basel, Switzerland)
ASN208305 (AS_VISECA, CH)
PTR: www.one-digitalservice.ch
ASN208305 (AS_VISECA, CH)
PTR: www.one-digitalservice.ch
| one.viseca.ch |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 9 |
viseca.ch
one.viseca.ch |
619 KB |
| 6 |
mybluehost.me
1 redirects
zqa.vji.mybluehost.me |
52 KB |
| 14 | 2 |
| Domain | Requested by | |
|---|---|---|
| 9 | one.viseca.ch |
zqa.vji.mybluehost.me
|
| 6 | zqa.vji.mybluehost.me |
1 redirects
zqa.vji.mybluehost.me
|
| 14 | 2 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| one.viseca.ch |
| www.viseca.ch |
| itunes.apple.com |
| play.google.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| cpcontacts.zqa.vji.mybluehost.me R11 |
2024-09-09 - 2024-12-08 |
3 months | crt.sh |
| one.viseca.ch DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2024-08-09 - 2025-08-19 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://zqa.vji.mybluehost.me/on/oneex/ANO11/dossier/page-1.html
Frame ID: E3C429D0A35CC44157B9F29060DDCF13
Requests: 14 HTTP requests in this frame
Screenshot
Page Title
Login | one Digital ServicePage URL History Show full URLs
-
https://zqa.vji.mybluehost.me/on/oneex/ANO11/dossier/
HTTP 302
https://zqa.vji.mybluehost.me/on/oneex/ANO11/dossier/page-1.html Page URL
Detected technologies
Bootstrap
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Modernizr
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- ([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
16 Outgoing links
These are links going to different origins than the main page.
URL: https://one.viseca.ch/login/check-login
Search URL Search Domain Scan URL
URL: https://one.viseca.ch/public/de/one
Title: Über one
Title: Über one
Search URL Search Domain Scan URL
URL: https://one.viseca.ch/public/de/support
Title: FAQ
Title: FAQ
Search URL Search Domain Scan URL
URL: https://one.viseca.ch/register/register?lang=de
Title: Registrieren
Title: Registrieren
Search URL Search Domain Scan URL
URL: https://one.viseca.ch/login/check-login?lang=de
Title: Login
Title: Login
Search URL Search Domain Scan URL
URL: https://one.viseca.ch/reset-password/enter-code?lang=de
Title: zurücksetzen
Title: zurücksetzen
Search URL Search Domain Scan URL
URL: https://www.viseca.ch/technische-voraussetzungen-visecaone
Title: Anleitung fürs Aktivieren von Cookies
Title: Anleitung fürs Aktivieren von Cookies
Search URL Search Domain Scan URL
URL: https://one.viseca.ch/login/login?lang=de
Title: DE
Title: DE
Search URL Search Domain Scan URL
URL: https://one.viseca.ch/login/login?lang=fr
Title: FR
Title: FR
Search URL Search Domain Scan URL
URL: https://one.viseca.ch/login/login?lang=it
Title: IT
Title: IT
Search URL Search Domain Scan URL
URL: https://one.viseca.ch/login/login?lang=en
Title: EN
Title: EN
Search URL Search Domain Scan URL
URL: https://itunes.apple.com/us/app/visecaone/id970439160?ls=1&mt=8
Title: App Store (iOS)
Title: App Store (iOS)
Search URL Search Domain Scan URL
URL: https://play.google.com/store/apps/details?id=ch.viseca.visecaone
Title: Play Store (Android)
Title: Play Store (Android)
Search URL Search Domain Scan URL
URL: https://one.viseca.ch/public/de/Support
Title: FAQ
Title: FAQ
Search URL Search Domain Scan URL
URL: https://one.viseca.ch/public/de/bestimmungen
Title: Rechtliche Bestimmungen
Title: Rechtliche Bestimmungen
Search URL Search Domain Scan URL
URL: https://one.viseca.ch/public/de/impressum
Title: Impressum
Title: Impressum
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://zqa.vji.mybluehost.me/on/oneex/ANO11/dossier/
HTTP 302
https://zqa.vji.mybluehost.me/on/oneex/ANO11/dossier/page-1.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
page-1.html
zqa.vji.mybluehost.me/on/oneex/ANO11/dossier/ Redirect Chain
|
16 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
style.css
zqa.vji.mybluehost.me/on/oneex/ANO11/dossier/assets/ |
51 KB 13 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ispin.css
one.viseca.ch/login/css/ |
446 B 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
one.svg
one.viseca.ch/request-registration-code/images/ |
1 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
one-small.svg
zqa.vji.mybluehost.me/on/oneex/ANO11/dossier/assets/ |
1 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
modernizr-custom.js
one.viseca.ch/login/js/ |
3 KB 4 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery-1.11.2.min.js
one.viseca.ch/login/js/ |
94 KB 94 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bootstrap.min.js
one.viseca.ch/login/js/ |
36 KB 37 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
content.js
one.viseca.ch/login/js/ |
196 B 783 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.main.js
one.viseca.ch/login/js/ |
427 KB 428 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ispin.js
one.viseca.ch/login/js/ |
995 B 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
fpdata.js
one.viseca.ch/login/js/ |
50 KB 51 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
FrutigerLTStd-Light.woff
zqa.vji.mybluehost.me/on/oneex/ANO11/dossier/assets/ |
17 KB 17 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
FrutigerLTStd-Bold.woff
zqa.vji.mybluehost.me/on/oneex/ANO11/dossier/assets/ |
17 KB 17 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Viseca (Financial)64 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| Modernizr function| $ function| jQuery object| jQuery111205440790197154213 function| initInputValueCheck function| initCheckboxStateCheck function| initTouchNav function| initMultiLevelNav function| initHidePopoverOnClickOutside function| initKartenForm function| initAjaxSelect function| initAjaxCheckboxes function| initDateTextFields function| initBootstrapDatePickerRange function| initCardFieldValidation function| initAjaxTabsTB function| initCarousel function| initAutoShowAlerts function| initAddItems function| initInputMask function| initProgressAnimation function| initDisableScroll function| initCustomTabs function| stopVideosOnModalClose function| initAjaxModal function| initYoutubeOverlay function| playPauseIframeYoutube function| initBootstrapDatePicker function| initNavDrop function| initRegistrationCodeForm function| formSendAjax function| formOnAjaxSuccess function| initSimpleForm function| initSmsForm function| initFormValidation function| initCustomForms function| initTBResizeFix function| initMobileTable function| initFixedTable function| initPopover function| initCloseCollapse function| initRetinaCover function| initSlickCarousel function| initCustomHover function| initOpenClose function| TouchNav object| lib function| MultiLevelNav function| AjaxSelectContent function| AddCloneItem object| CssAnimationHelper object| ResponsiveHelper function| DisablePageScroll function| FixedTable object| jcf object| picturefillCFG function| picturefill function| Inputmask function| Hammer function| closePhishingAlert function| checkPhishingMessageVisibility function| doPost function| Fingerprint2 number| $h0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
one.viseca.ch
zqa.vji.mybluehost.me
217.111.139.8
50.6.152.236
2ca82bd802a9aec430fbf7517776e2afdf100a8636e4c15f821a5fccda3e9873
2ecd295d295bec062cedebe177e54b9d6b19fc0a841dc5c178c654c9ccff09c0
446fd5a13c600d556b2ae10aef22193d8978b8eee37bfa73795f7394ce4f326b
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
8b1ac825153c2c2e7321901e800fdaf9ca16e65aaf28d362698400ac3642b18b
91a08ef7a4c076bb3a4c313a0ef9808687a3cfb7ff6313bf459e9b5a1379f991
936fc24432cf7afee924f9319f392504d1ce085d34936e18005c042f4a0f94ad
b0a09d0d09227b1e112d8b9ddca9c4343f5e1decd830a2c68d0bf9bd26d51c77
c486e27c1068d0df133271e24dc54496b115ae9c3b075c9230fb9d43d0f06f79
ca23b78fd83dca9de30029f7391667c348331c838c7968bfeb5abfc50d49300a
d32d23c9f80e6ade071feb6a63e79b7de26b6133fd3a359396a7ae2ca4877139
e3ab7388ec497d04e16d13941563cc5c5df6e63c6083157d0975ff210c3af295
fb6362a763530522388194bbaed02ecd8e806e41b2e9ae672fda8df5d9d9426b