jt-service.de
Open in
urlscan Pro
91.34.70.120
Malicious Activity!
Public Scan
Effective URL: https://jt-service.de/wordpress/bss/
Submission: On March 01 via api from EE — Scanned from CH
Summary
TLS certificate: Issued by R3 on January 16th 2024. Valid for: 3 months.
This is the only time jt-service.de was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Schweizerische Bundesbahnen (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 81.201.60.150 81.201.60.150 | 8251 (NFX_ZSPO) (NFX_ZSPO) | |
1 19 | 91.34.70.120 91.34.70.120 | 3320 (DTAG Inte...) (DTAG Internet service provider operations) | |
1 2 | 18.245.39.50 18.245.39.50 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 188.114.96.3 188.114.96.3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
21 | 4 |
ASN8251 (NFX_ZSPO, CZ)
PTR: hosting.pilsfree.net
beta3.evatuzarova.com |
ASN3320 (DTAG Internet service provider operations, DE)
PTR: p5b224678.dip0.t-ipconnect.de
jt-service.de |
ASN16509 (AMAZON-02, US)
PTR: server-18-245-39-50.fra56.r.cloudfront.net
logs1407.xiti.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
19 |
jt-service.de
1 redirects
jt-service.de |
376 KB |
2 |
xiti.com
1 redirects
logs1407.xiti.com — Cisco Umbrella Rank: 95685 |
1 KB |
1 |
userstatics.com
userstatics.com — Cisco Umbrella Rank: 73111 |
717 B |
1 |
evatuzarova.com
beta3.evatuzarova.com |
275 B |
21 | 4 |
Domain | Requested by | |
---|---|---|
19 | jt-service.de |
1 redirects
jt-service.de
|
2 | logs1407.xiti.com | 1 redirects |
1 | userstatics.com |
jt-service.de
|
1 | beta3.evatuzarova.com | |
21 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
beta3.evatuzarova.com R3 |
2024-01-25 - 2024-04-24 |
3 months | crt.sh |
jt-service.de R3 |
2024-01-16 - 2024-04-15 |
3 months | crt.sh |
userstatics.com E1 |
2024-01-29 - 2024-04-28 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://jt-service.de/wordpress/bss/
Frame ID: 15DA176AB62BD3C5B3C14A09A739056B
Requests: 21 HTTP requests in this frame
Screenshot
Page Title
Anmeldung | SwissPassPage URL History Show full URLs
- https://beta3.evatuzarova.com/images/ Page URL
-
https://jt-service.de/wordpress/bss
HTTP 301
https://jt-service.de/wordpress/bss/ Page URL
Detected technologies
Modernizr (JavaScript Libraries) ExpandDetected patterns
- ([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js
OneTrust (Cookie compliance) Expand
Detected patterns
- otSDKStub\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://beta3.evatuzarova.com/images/ Page URL
-
https://jt-service.de/wordpress/bss
HTTP 301
https://jt-service.de/wordpress/bss/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 18- https://logs1407.xiti.com/event?s=611076 HTTP 307
- https://logs1407.xiti.com/event?s=611076&Rdt=On
21 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
beta3.evatuzarova.com/images/ |
82 B 275 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
jt-service.de/wordpress/bss/ Redirect Chain
|
25 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sso.min-20200819.css
jt-service.de/wordpress/bss/css/ |
180 KB 29 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
modernizr-20200819.js
jt-service.de/wordpress/bss/js/ |
8 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
otSDKStub.js
jt-service.de/wordpress/bss/js/ |
21 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
launch-6cc731e967aa.min.js
jt-service.de/wordpress/bss/js/ |
124 KB 43 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo_text_de-20200819.svg
jt-service.de/wordpress/bss/images/ |
137 KB 137 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo-20200819.svg
jt-service.de/wordpress/bss/images/ |
7 KB 7 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
loader-20200819.png
jt-service.de/wordpress/bss/images/ |
272 B 408 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-20200819.js
jt-service.de/wordpress/bss/js/ |
95 KB 37 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vendor.min-20200819.js
jt-service.de/wordpress/bss/js/ |
176 KB 59 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
swisspass.min-20200819.js
jt-service.de/wordpress/bss/js/ |
97 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
SBBWeb-Light.woff2
jt-service.de/wordpress/bss/fonts/ |
14 KB 14 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
e91f4b90-f9aa-4ace-891b-96dd07595d9f-test.json
jt-service.de/wordpress/bss/js/otSDKStub.js/consent/e91f4b90-f9aa-4ace-891b-96dd07595d9f-test/ |
196 B 276 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login_bg.jpg
jt-service.de/wordpress/bss/resources/img/ |
196 B 196 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icomoon.woff2
jt-service.de/fonts/icomoon/ |
0 0 |
Font
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icomoon.ttf
jt-service.de/fonts/icomoon/ |
0 0 |
Font
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icomoon.woff
jt-service.de/fonts/icomoon/ |
0 0 |
Font
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
co-branding
jt-service.de/idp/ |
797 B 943 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
event
logs1407.xiti.com/ Redirect Chain
|
0 325 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
script.js
userstatics.com/get/ |
133 B 717 B |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Schweizerische Bundesbahnen (Transportation)32 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| digitalDataLayer object| html5 object| Modernizr object| OneTrustStub object| digitalData object| dataLayerEvent function| OptanonWrapper function| validateForm function| closeModal function| $ function| jQuery object| jQuery112006019440495413475 function| A11yDialog function| iFrameResize function| Cleave function| OevcResourceLoader object| dp object| oevc object| webtrends boolean| isMobile function| validate object| options object| attrs object| allowedProviders object| rememberMe boolean| providerAllowsRememberMe object| _satellite boolean| __satelliteLoaded object| _pac object| pdl object| _paqueue object| pa4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
jt-service.de/wordpress/bss | Name: PHPREFS Value: full |
|
.jt-service.de/ | Name: pa_privacy Value: %22optin%22 |
|
.jt-service.de/ | Name: _pctx Value: %7Bu%7DN4IgrgzgpgThIC4B2YA2qA05owMoBcBDfSREQpAeyRCwgEt8oBJAE0RXSwH18yBbABwB3SgDN6UAGwAfVPkEAjJFLBSQAXyA |
|
.xiti.com/ | Name: atid Value: 1395CC2E-D272-4AD7-8530-B6C0C45C3657 |
8 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
beta3.evatuzarova.com
jt-service.de
logs1407.xiti.com
userstatics.com
18.245.39.50
188.114.96.3
81.201.60.150
91.34.70.120
1f6e67bc886cbf171ee9cb58e9985ddbf7e636315cec4f2034625a758d1f5b45
233ddeda2a0fbeee053d13f25669fe187bdef4fe708aacfadddd560905d209f1
2b2485b0669a2f73c4846e82eb5a37421358591a8ac8ba21d8149bfb88adcbfb
3b6f9638a7224ff5a1fec517309f2be2ac82a681962a65a6e310ca3008eb8966
5c7f0e173844556da7ca5eb8936fa3dab1c00206960920a49a1eea9cde2bfaaf
6d72fa0f78c80b1874d3ee4aadf43d973edc442a65fef83d37e684ac559893b7
7a9fa521a58ee93001981f3a7db498c589233d8cc616e8d09af0119388a865bc
80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880
9c50211b34ab0377f3b35c243c98e402315127bfa5b51e147cb22c702174ca60
c337d42ed7979c6be0282900bd957dd9d112a430dc7761463d655eb8f0d9bc07
c365cf63e0edecc072b99e919e45604dfbca32ec0a19dac39275c9c67d334caf
d90d849c3cf50d06b1ac617866eb25668c37a418e079a9a5d7fe054c8431f0c1
deeee170c3759a6ed35c0c05c5b935d0e7638f1c0c5677166918ecff6edb1909
df9690fea031319de38a437cb6d393026c4aae70642ed394c4254ed64f035b26
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f053f049a78c3afbce0d34f57d0bea4a24f7964d0e1e45197a35c06124b5e357
f766c7457c6ec463eaa85778aa47261344f1772e0b7cf1987ad212f889f472f5