swisspasskontoservice.kinsta.cloud
Open in
urlscan Pro
2606:4700:7::a29f:872a
Malicious Activity!
Public Scan
Submission Tags: https://phish.report @phish_report Search All
Submission: On March 30 via api from FI — Scanned from FI
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on December 12th 2022. Valid for: a year.
This is the only time swisspasskontoservice.kinsta.cloud was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Schweizerische Bundesbahnen (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 19 | 2606:4700:7::... 2606:4700:7::a29f:872a | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 52.58.254.23 52.58.254.23 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 193.203.121.145 193.203.121.145 | 31004 (SBB-CFF-F...) (SBB-CFF-FFS Telecom SBB) | |
1 | 52.222.228.32 52.222.228.32 | 16509 (AMAZON-02) (AMAZON-02) | |
20 | 4 |
ASN13335 (CLOUDFLARENET, US)
swisspasskontoservice.kinsta.cloud |
ASN16509 (AMAZON-02, US)
PTR: ec2-52-58-254-23.eu-central-1.compute.amazonaws.com
cdn.app.sbb.ch |
ASN16509 (AMAZON-02, US)
PTR: server-52-222-228-32.fra56.r.cloudfront.net
logs1407.xiti.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
19 |
kinsta.cloud
2 redirects
swisspasskontoservice.kinsta.cloud |
1 MB |
1 |
xiti.com
logs1407.xiti.com — Cisco Umbrella Rank: 88712 |
307 B |
1 |
swisspass.ch
resources.swisspass.ch |
221 KB |
1 |
sbb.ch
cdn.app.sbb.ch — Cisco Umbrella Rank: 334503 |
14 KB |
20 | 4 |
Domain | Requested by | |
---|---|---|
19 | swisspasskontoservice.kinsta.cloud |
2 redirects
swisspasskontoservice.kinsta.cloud
|
1 | logs1407.xiti.com |
swisspasskontoservice.kinsta.cloud
|
1 | resources.swisspass.ch |
swisspasskontoservice.kinsta.cloud
|
1 | cdn.app.sbb.ch |
swisspasskontoservice.kinsta.cloud
|
20 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.swisspass.ch |
Subject Issuer | Validity | Valid | |
---|---|---|---|
kinsta.cloud Cloudflare Inc ECC CA-3 |
2022-12-12 - 2023-12-12 |
a year | crt.sh |
*.app.sbb.ch Amazon RSA 2048 M01 |
2023-02-10 - 2023-10-14 |
8 months | crt.sh |
resources.swisspass.ch SwissSign RSA TLS OV ICA 2021 - 1 |
2022-05-04 - 2023-05-04 |
a year | crt.sh |
*.xiti.com Thawte RSA CA 2018 |
2022-04-29 - 2023-04-28 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://swisspasskontoservice.kinsta.cloud/api/id/pass/index.html
Frame ID: AF93B63B90C05EBAB567213495319AA5
Requests: 20 HTTP requests in this frame
Screenshot
Page Title
(CH) | SwissPassDetected technologies
AT Internet XiTi (Analytics) ExpandDetected patterns
- xiti\.com/hit\.xiti
Modernizr (JavaScript Libraries) Expand
Detected patterns
- ([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js
OneTrust (Cookie compliance) Expand
Detected patterns
- otSDKStub\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Retour
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 12- https://swisspasskontoservice.kinsta.cloud/api/id/pass/index_files/otSDKStub.js/consent/e91f4b90-f9aa-4ace-891b-96dd07595d9f-test/e91f4b90-f9aa-4ace-891b-96dd07595d9f-test.json HTTP 301
- https://swisspasskontoservice.kinsta.cloud/api/id/pass/index_files/otSDKStub.js/consent/e91f4b90-f9aa-4ace-891b-96dd07595d9f-test/e91f4b90-f9aa-4ace-891b-96dd07595d9f-test.json/
- https://swisspasskontoservice.kinsta.cloud/idp/co-branding?resource=co-branding&lang=fr&provider=sbbkn HTTP 301
- https://swisspasskontoservice.kinsta.cloud/idp/co-branding/?resource=co-branding&lang=fr&provider=sbbkn
20 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
index.html
swisspasskontoservice.kinsta.cloud/api/id/pass/ |
50 KB 12 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sso.min-20200819.css
swisspasskontoservice.kinsta.cloud/api/id/pass/index_files/ |
180 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
modernizr-20200819.js
swisspasskontoservice.kinsta.cloud/api/id/pass/index_files/ |
8 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
otSDKStub.js
swisspasskontoservice.kinsta.cloud/api/id/pass/index_files/ |
20 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
launch-6cc731e967aa.min.js
swisspasskontoservice.kinsta.cloud/api/id/pass/index_files/ |
139 KB 42 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
otBannerSdk.js
swisspasskontoservice.kinsta.cloud/api/id/pass/index_files/ |
324 KB 75 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logo.png
swisspasskontoservice.kinsta.cloud/api/id/pass/index_files/ |
752 KB 753 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logopass.png
swisspasskontoservice.kinsta.cloud/api/id/pass/index_files/ |
19 KB 19 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
pss.png
swisspasskontoservice.kinsta.cloud/api/id/pass/index_files/ |
105 KB 106 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery-20200819.js
swisspasskontoservice.kinsta.cloud/api/id/pass/index_files/ |
95 KB 35 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
vendor.min-20200819.js
swisspasskontoservice.kinsta.cloud/api/id/pass/index_files/ |
175 KB 55 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
swisspass.min-20200819.js
swisspasskontoservice.kinsta.cloud/api/id/pass/index_files/ |
97 KB 26 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
SBBWeb-Light.woff2
cdn.app.sbb.ch/fonts/v1_6_subset/ |
14 KB 14 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
/
swisspasskontoservice.kinsta.cloud/api/id/pass/index_files/otSDKStub.js/consent/e91f4b90-f9aa-4ace-891b-96dd07595d9f-test/e91f4b90-f9aa-4ace-891b-96dd07595d9f-test.json/ Redirect Chain
|
59 KB 12 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login_bg.jpg
resources.swisspass.ch/content/dam/swisspass/co-branding/sbbkn/ |
221 KB 221 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
icomoon.woff2
swisspasskontoservice.kinsta.cloud/api/fonts/icomoon/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
icomoon.ttf
swisspasskontoservice.kinsta.cloud/api/fonts/icomoon/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
/
swisspasskontoservice.kinsta.cloud/idp/co-branding/ Redirect Chain
|
52 KB 11 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
hit.xiti
logs1407.xiti.com/ |
35 B 307 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
icomoon.woff
swisspasskontoservice.kinsta.cloud/api/fonts/icomoon/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Schweizerische Bundesbahnen (Transportation)32 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| digitalDataLayer object| html5 object| Modernizr object| OneTrustStub object| digitalData object| dataLayerEvent function| OptanonWrapper function| validateForm function| closeModal function| $ function| jQuery object| jQuery1120036511366218196994 function| A11yDialog function| iFrameResize function| Cleave object| _satellite boolean| __satelliteLoaded function| OevcResourceLoader object| dp object| oevc object| webtrends boolean| isMobile function| validate object| options object| attrs object| allowedProviders object| rememberMe boolean| providerAllowsRememberMe object| ATInternet function| ATCustomEvent object| ATInternetTag1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.kinsta.cloud/ | Name: atuserid Value: %7B%22name%22%3A%22atuserid%22%2C%22val%22%3A%22c093e2cf-14b3-4437-8989-469219f5a138%22%2C%22options%22%3A%7B%22end%22%3A%222024-04-30T12%3A09%3A33.310Z%22%2C%22path%22%3A%22%2F%22%7D%7D |
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.app.sbb.ch
logs1407.xiti.com
resources.swisspass.ch
swisspasskontoservice.kinsta.cloud
193.203.121.145
2606:4700:7::a29f:872a
52.222.228.32
52.58.254.23
17b7c94cb891331ef612c7b2b3648f007c1c4f6a2eb420199bb275d91450959b
204a3299ddc67db6fd1836653ece6696c46f1b2d7fb7abcb4fe9132abe2b6612
21214777c51c77d812ea9c8e00e2fde2b964b765f88c8f0c0d130c2fc8ff6a71
225e078f0432e7459d74e8d9245f1982570a3897d664ca2d219ccd09b244ab95
24f31a4afb4d98c85b6cff4c9a953654a77986d6c4c9e9cae52cf57e59095e01
4a3d4cf982535aaf485c6e3af9ad1498df5c065adf94eed056f0aa13c31e92ed
5c7f0e173844556da7ca5eb8936fa3dab1c00206960920a49a1eea9cde2bfaaf
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6dc2b32636e09159a8f25d527d944aae49e84e45936c5850bb96fafc85f86ade
7aaad78d13ba343554d09043d46b9f563fb3c06d4789f7faf5e45a7247458894
811e8df757d166dce4bda35c81d2f639eed22055abd034720214c7125b21b737
85f462d788bd2ed45b1acf2bb74939a403b9a0f2c7b98054739d89e678315677
91134963643090e67d09747d67c7b0cc111ba642b39c7b04031fd43b9707380e
9480b9fb7fb2d775c07126a3a877aca743bcb77cc28a57644210ff5980f43425
be0223ae72bc8c610c7a5453d349964cbe78ff8646695a58bc13a4cf0a8d81d6
c299a55acdc9c551ab7e67912892c6db8ed164dbcebaca370aa75f0f1297c8d4
f3658338df6f21268d6907332ba6f3cf9e649462194476d5539b6a198efdd6b0