loginswisspass.wpengine.com
Open in
urlscan Pro
130.211.93.101
Malicious Activity!
Public Scan
Submission: On May 01 via api from IN — Scanned from DE
Summary
TLS certificate: Issued by RapidSSL Global TLS RSA4096 SHA256 20... on August 1st 2022. Valid for: a year.
This is the only time loginswisspass.wpengine.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Schweizerische Bundesbahnen (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 18 | 130.211.93.101 130.211.93.101 | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM) | |
1 | 35.156.42.131 35.156.42.131 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 193.203.121.145 193.203.121.145 | 31004 (SBB-CFF-F...) (SBB-CFF-FFS Telecom SBB) | |
1 | 52.222.228.32 52.222.228.32 | () () | |
20 | 4 |
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 101.93.211.130.bc.googleusercontent.com
loginswisspass.wpengine.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-35-156-42-131.eu-central-1.compute.amazonaws.com
cdn.app.sbb.ch |
ASN- ()
PTR: server-52-222-228-32.fra56.r.cloudfront.net
logs1407.xiti.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
18 |
wpengine.com
1 redirects
loginswisspass.wpengine.com |
1 MB |
1 |
xiti.com
logs1407.xiti.com — Cisco Umbrella Rank: 75961 |
306 B |
1 |
swisspass.ch
resources.swisspass.ch |
221 KB |
1 |
sbb.ch
cdn.app.sbb.ch — Cisco Umbrella Rank: 533686 |
14 KB |
20 | 4 |
Domain | Requested by | |
---|---|---|
18 | loginswisspass.wpengine.com |
1 redirects
loginswisspass.wpengine.com
|
1 | logs1407.xiti.com |
loginswisspass.wpengine.com
|
1 | resources.swisspass.ch |
loginswisspass.wpengine.com
|
1 | cdn.app.sbb.ch |
loginswisspass.wpengine.com
|
20 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.swisspass.ch |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.wpengine.com RapidSSL Global TLS RSA4096 SHA256 2022 CA1 |
2022-08-01 - 2023-09-01 |
a year | crt.sh |
*.app.sbb.ch Amazon RSA 2048 M01 |
2023-02-10 - 2023-10-14 |
8 months | crt.sh |
resources.swisspass.ch SwissSign RSA TLS OV ICA 2021 - 1 |
2022-05-04 - 2023-05-04 |
a year | crt.sh |
*.xiti.com Thawte RSA CA 2018 |
2023-04-14 - 2024-05-14 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://loginswisspass.wpengine.com/id/pass/
Frame ID: 2152D274FF70B7FE48A047F78F8C32A8
Requests: 20 HTTP requests in this frame
Screenshot
Page Title
(CH) | SwissPassDetected technologies
AT Internet XiTi (Analytics) ExpandDetected patterns
- xiti\.com/hit\.xiti
Modernizr (JavaScript Libraries) Expand
Detected patterns
- ([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js
OneTrust (Cookie compliance) Expand
Detected patterns
- otSDKStub\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Retour
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 15- https://loginswisspass.wpengine.com/idp/co-branding?resource=co-branding&lang=fr&provider=sbbkn HTTP 301
- https://loginswisspass.wpengine.com/idp/co-branding/?resource=co-branding&lang=fr&provider=sbbkn
20 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
loginswisspass.wpengine.com/id/pass/ |
50 KB 11 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sso.min-20200819.css
loginswisspass.wpengine.com/id/pass/index_files/ |
180 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
modernizr-20200819.js
loginswisspass.wpengine.com/id/pass/index_files/ |
8 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
otSDKStub.js
loginswisspass.wpengine.com/id/pass/index_files/ |
20 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
launch-6cc731e967aa.min.js
loginswisspass.wpengine.com/id/pass/index_files/ |
139 KB 41 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
otBannerSdk.js
loginswisspass.wpengine.com/id/pass/index_files/ |
324 KB 74 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
loginswisspass.wpengine.com/id/pass/index_files/ |
752 KB 753 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logopass.png
loginswisspass.wpengine.com/id/pass/index_files/ |
19 KB 19 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pss.png
loginswisspass.wpengine.com/id/pass/index_files/ |
105 KB 105 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-20200819.js
loginswisspass.wpengine.com/id/pass/index_files/ |
95 KB 34 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vendor.min-20200819.js
loginswisspass.wpengine.com/id/pass/index_files/ |
175 KB 54 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
swisspass.min-20200819.js
loginswisspass.wpengine.com/id/pass/index_files/ |
97 KB 26 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
SBBWeb-Light.woff2
cdn.app.sbb.ch/fonts/v1_6_subset/ |
14 KB 14 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
e91f4b90-f9aa-4ace-891b-96dd07595d9f-test.json
loginswisspass.wpengine.com/id/pass/index_files/otSDKStub.js/consent/e91f4b90-f9aa-4ace-891b-96dd07595d9f-test/ |
196 B 336 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login_bg.jpg
resources.swisspass.ch/content/dam/swisspass/co-branding/sbbkn/ |
221 KB 221 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icomoon.woff2
loginswisspass.wpengine.com/fonts/icomoon/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
loginswisspass.wpengine.com/idp/co-branding/ Redirect Chain
|
22 KB 6 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icomoon.ttf
loginswisspass.wpengine.com/fonts/icomoon/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
hit.xiti
logs1407.xiti.com/ |
35 B 306 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icomoon.woff
loginswisspass.wpengine.com/fonts/icomoon/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Schweizerische Bundesbahnen (Transportation)32 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| digitalDataLayer object| html5 object| Modernizr object| OneTrustStub object| digitalData object| dataLayerEvent function| OptanonWrapper function| validateForm function| closeModal function| $ function| jQuery object| jQuery112009830372131156893 function| A11yDialog function| iFrameResize function| Cleave function| OevcResourceLoader object| dp object| oevc object| webtrends boolean| isMobile function| validate object| options object| attrs object| allowedProviders object| rememberMe boolean| providerAllowsRememberMe object| _satellite boolean| __satelliteLoaded object| ATInternet function| ATCustomEvent object| ATInternetTag1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.wpengine.com/ | Name: atuserid Value: %7B%22name%22%3A%22atuserid%22%2C%22val%22%3A%225662a53e-dd7a-4b26-85de-c4f1d13978a4%22%2C%22options%22%3A%7B%22end%22%3A%222024-06-01T08%3A04%3A51.954Z%22%2C%22path%22%3A%22%2F%22%7D%7D |
4 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.app.sbb.ch
loginswisspass.wpengine.com
logs1407.xiti.com
resources.swisspass.ch
130.211.93.101
193.203.121.145
35.156.42.131
52.222.228.32
17b7c94cb891331ef612c7b2b3648f007c1c4f6a2eb420199bb275d91450959b
204a3299ddc67db6fd1836653ece6696c46f1b2d7fb7abcb4fe9132abe2b6612
225e078f0432e7459d74e8d9245f1982570a3897d664ca2d219ccd09b244ab95
24f31a4afb4d98c85b6cff4c9a953654a77986d6c4c9e9cae52cf57e59095e01
4a3d4cf982535aaf485c6e3af9ad1498df5c065adf94eed056f0aa13c31e92ed
5c7f0e173844556da7ca5eb8936fa3dab1c00206960920a49a1eea9cde2bfaaf
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6dc2b32636e09159a8f25d527d944aae49e84e45936c5850bb96fafc85f86ade
7aaad78d13ba343554d09043d46b9f563fb3c06d4789f7faf5e45a7247458894
80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880
811e8df757d166dce4bda35c81d2f639eed22055abd034720214c7125b21b737
85f462d788bd2ed45b1acf2bb74939a403b9a0f2c7b98054739d89e678315677
91134963643090e67d09747d67c7b0cc111ba642b39c7b04031fd43b9707380e
be0223ae72bc8c610c7a5453d349964cbe78ff8646695a58bc13a4cf0a8d81d6
c299a55acdc9c551ab7e67912892c6db8ed164dbcebaca370aa75f0f1297c8d4
d904df60972997e8a71ba95cf3e7f8a4fef815989838ea2eea82e65291d09c17
f3658338df6f21268d6907332ba6f3cf9e649462194476d5539b6a198efdd6b0