23468-5680.s2.webspace.re Open in urlscan Pro
91.218.65.223  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

20 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response 23468-5680.s2.webspace.re/portal/id/pass/	50 KB 11 KB	71ms 13ms	Document text/html	91.218.65.223 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://23468-5680.s2.webspace.re/portal/id/pass/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 91.218.65.223 Frankfurt am Main, Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS plesk2.living-bots.net Software nginx / PleskLin Resource Hash 85f462d788bd2ed45b1acf2bb74939a403b9a0f2c7b98054739d89e678315677 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers content-encoding br content-type text/html date Sun, 14 May 2023 07:29:52 GMT etag W/"645fc3f9-c890" last-modified Sat, 13 May 2023 17:08:09 GMT server nginx x-powered-by PleskLin
GET H2	200	sso.min-20200819.css 23468-5680.s2.webspace.re/portal/id/pass/index_files/	180 KB 21 KB	12ms 11ms	Stylesheet text/css	91.218.65.223 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://23468-5680.s2.webspace.re/portal/id/pass/index_files/sso.min-20200819.css Requested by Host: 23468-5680.s2.webspace.re URL: https://23468-5680.s2.webspace.re/portal/id/pass/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 91.218.65.223 Frankfurt am Main, Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS plesk2.living-bots.net Software nginx / PleskLin Resource Hash 17b7c94cb891331ef612c7b2b3648f007c1c4f6a2eb420199bb275d91450959b Request headers accept-language de-DE,de;q=0.9 Referer https://23468-5680.s2.webspace.re/portal/id/pass/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36 Response headers date Sun, 14 May 2023 07:29:52 GMT content-encoding br last-modified Sat, 13 May 2023 17:08:09 GMT server nginx etag W/"645fc3f9-2cf00" x-powered-by PleskLin content-type text/css
GET H2	200	modernizr-20200819.js Show response 23468-5680.s2.webspace.re/portal/id/pass/index_files/	8 KB 3 KB	14ms 13ms	Script application/javascript	91.218.65.223 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://23468-5680.s2.webspace.re/portal/id/pass/index_files/modernizr-20200819.js Requested by Host: 23468-5680.s2.webspace.re URL: https://23468-5680.s2.webspace.re/portal/id/pass/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 91.218.65.223 Frankfurt am Main, Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS plesk2.living-bots.net Software nginx / PleskLin Resource Hash 4a3d4cf982535aaf485c6e3af9ad1498df5c065adf94eed056f0aa13c31e92ed Request headers accept-language de-DE,de;q=0.9 Referer https://23468-5680.s2.webspace.re/portal/id/pass/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36 Response headers date Sun, 14 May 2023 07:29:52 GMT content-encoding br last-modified Sat, 13 May 2023 17:08:09 GMT server nginx etag W/"645fc3f9-1e59" x-powered-by PleskLin content-type application/javascript
GET H2	200	otSDKStub.js Show response 23468-5680.s2.webspace.re/portal/id/pass/index_files/	20 KB 7 KB	18ms 18ms	Script application/javascript	91.218.65.223 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://23468-5680.s2.webspace.re/portal/id/pass/index_files/otSDKStub.js Requested by Host: 23468-5680.s2.webspace.re URL: https://23468-5680.s2.webspace.re/portal/id/pass/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 91.218.65.223 Frankfurt am Main, Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS plesk2.living-bots.net Software nginx / PleskLin Resource Hash 7aaad78d13ba343554d09043d46b9f563fb3c06d4789f7faf5e45a7247458894 Request headers accept-language de-DE,de;q=0.9 Referer https://23468-5680.s2.webspace.re/portal/id/pass/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36 Response headers date Sun, 14 May 2023 07:29:52 GMT content-encoding br last-modified Sat, 13 May 2023 17:08:09 GMT server nginx etag W/"645fc3f9-519f" x-powered-by PleskLin content-type application/javascript
GET H2	200	launch-6cc731e967aa.min.js Show response 23468-5680.s2.webspace.re/portal/id/pass/index_files/	139 KB 38 KB	17ms 16ms	Script application/javascript	91.218.65.223 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://23468-5680.s2.webspace.re/portal/id/pass/index_files/launch-6cc731e967aa.min.js Requested by Host: 23468-5680.s2.webspace.re URL: https://23468-5680.s2.webspace.re/portal/id/pass/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 91.218.65.223 Frankfurt am Main, Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS plesk2.living-bots.net Software nginx / PleskLin Resource Hash 811e8df757d166dce4bda35c81d2f639eed22055abd034720214c7125b21b737 Request headers accept-language de-DE,de;q=0.9 Referer https://23468-5680.s2.webspace.re/portal/id/pass/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36 Response headers date Sun, 14 May 2023 07:29:52 GMT content-encoding br last-modified Sat, 13 May 2023 17:08:09 GMT server nginx etag W/"645fc3f9-22aa8" x-powered-by PleskLin content-type application/javascript
GET H2	200	otBannerSdk.js Show response 23468-5680.s2.webspace.re/portal/id/pass/index_files/	324 KB 68 KB	26ms 25ms	Script application/javascript	91.218.65.223 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://23468-5680.s2.webspace.re/portal/id/pass/index_files/otBannerSdk.js Requested by Host: 23468-5680.s2.webspace.re URL: https://23468-5680.s2.webspace.re/portal/id/pass/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 91.218.65.223 Frankfurt am Main, Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS plesk2.living-bots.net Software nginx / PleskLin Resource Hash 204a3299ddc67db6fd1836653ece6696c46f1b2d7fb7abcb4fe9132abe2b6612 Request headers accept-language de-DE,de;q=0.9 Referer https://23468-5680.s2.webspace.re/portal/id/pass/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36 Response headers date Sun, 14 May 2023 07:29:52 GMT content-encoding br last-modified Sat, 13 May 2023 17:08:09 GMT server nginx etag W/"645fc3f9-50f06" x-powered-by PleskLin content-type application/javascript
GET H2	200	logo.png 23468-5680.s2.webspace.re/portal/id/pass/index_files/	752 KB 753 KB	19ms 17ms	Image image/png	91.218.65.223 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Show image Full URL https://23468-5680.s2.webspace.re/portal/id/pass/index_files/logo.png Requested by Host: 23468-5680.s2.webspace.re URL: https://23468-5680.s2.webspace.re/portal/id/pass/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 91.218.65.223 Frankfurt am Main, Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS plesk2.living-bots.net Software nginx / PleskLin Resource Hash f3658338df6f21268d6907332ba6f3cf9e649462194476d5539b6a198efdd6b0 Request headers accept-language de-DE,de;q=0.9 Referer https://23468-5680.s2.webspace.re/portal/id/pass/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36 Response headers date Sun, 14 May 2023 07:29:52 GMT last-modified Sat, 13 May 2023 17:08:09 GMT server nginx etag "645fc3f9-bc16a" x-powered-by PleskLin content-type image/png accept-ranges bytes content-length 770410
GET H2	200	logopass.png 23468-5680.s2.webspace.re/portal/id/pass/index_files/	19 KB 19 KB	18ms 17ms	Image image/png	91.218.65.223 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Show image Full URL https://23468-5680.s2.webspace.re/portal/id/pass/index_files/logopass.png Requested by Host: 23468-5680.s2.webspace.re URL: https://23468-5680.s2.webspace.re/portal/id/pass/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 91.218.65.223 Frankfurt am Main, Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS plesk2.living-bots.net Software nginx / PleskLin Resource Hash 6dc2b32636e09159a8f25d527d944aae49e84e45936c5850bb96fafc85f86ade Request headers accept-language de-DE,de;q=0.9 Referer https://23468-5680.s2.webspace.re/portal/id/pass/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36 Response headers date Sun, 14 May 2023 07:29:52 GMT last-modified Sat, 13 May 2023 17:08:09 GMT server nginx etag "645fc3f9-4ab8" x-powered-by PleskLin content-type image/png accept-ranges bytes content-length 19128
GET H2	200	pss.png 23468-5680.s2.webspace.re/portal/id/pass/index_files/	105 KB 105 KB	27ms 26ms	Image image/png	91.218.65.223 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Show image Full URL https://23468-5680.s2.webspace.re/portal/id/pass/index_files/pss.png Requested by Host: 23468-5680.s2.webspace.re URL: https://23468-5680.s2.webspace.re/portal/id/pass/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 91.218.65.223 Frankfurt am Main, Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS plesk2.living-bots.net Software nginx / PleskLin Resource Hash 91134963643090e67d09747d67c7b0cc111ba642b39c7b04031fd43b9707380e Request headers accept-language de-DE,de;q=0.9 Referer https://23468-5680.s2.webspace.re/portal/id/pass/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36 Response headers date Sun, 14 May 2023 07:29:52 GMT last-modified Sat, 13 May 2023 17:08:09 GMT server nginx etag "645fc3f9-1a397" x-powered-by PleskLin content-type image/png accept-ranges bytes content-length 107415
GET H2	200	jquery-20200819.js Show response 23468-5680.s2.webspace.re/portal/id/pass/index_files/	95 KB 32 KB	12ms 12ms	Script application/javascript	91.218.65.223 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://23468-5680.s2.webspace.re/portal/id/pass/index_files/jquery-20200819.js Requested by Host: 23468-5680.s2.webspace.re URL: https://23468-5680.s2.webspace.re/portal/id/pass/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 91.218.65.223 Frankfurt am Main, Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS plesk2.living-bots.net Software nginx / PleskLin Resource Hash 24f31a4afb4d98c85b6cff4c9a953654a77986d6c4c9e9cae52cf57e59095e01 Request headers accept-language de-DE,de;q=0.9 Referer https://23468-5680.s2.webspace.re/portal/id/pass/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36 Response headers date Sun, 14 May 2023 07:29:52 GMT content-encoding br last-modified Sat, 13 May 2023 17:08:09 GMT server nginx etag W/"645fc3f9-17c54" x-powered-by PleskLin content-type application/javascript
GET H2	200	vendor.min-20200819.js Show response 23468-5680.s2.webspace.re/portal/id/pass/index_files/	175 KB 50 KB	14ms 14ms	Script application/javascript	91.218.65.223 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://23468-5680.s2.webspace.re/portal/id/pass/index_files/vendor.min-20200819.js Requested by Host: 23468-5680.s2.webspace.re URL: https://23468-5680.s2.webspace.re/portal/id/pass/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 91.218.65.223 Frankfurt am Main, Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS plesk2.living-bots.net Software nginx / PleskLin Resource Hash be0223ae72bc8c610c7a5453d349964cbe78ff8646695a58bc13a4cf0a8d81d6 Request headers accept-language de-DE,de;q=0.9 Referer https://23468-5680.s2.webspace.re/portal/id/pass/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36 Response headers date Sun, 14 May 2023 07:29:52 GMT content-encoding br last-modified Sat, 13 May 2023 17:08:09 GMT server nginx etag W/"645fc3f9-2bc0a" x-powered-by PleskLin content-type application/javascript
GET H2	200	swisspass.min-20200819.js Show response 23468-5680.s2.webspace.re/portal/id/pass/index_files/	97 KB 24 KB	13ms 11ms	Script application/javascript	91.218.65.223 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://23468-5680.s2.webspace.re/portal/id/pass/index_files/swisspass.min-20200819.js Requested by Host: 23468-5680.s2.webspace.re URL: https://23468-5680.s2.webspace.re/portal/id/pass/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 91.218.65.223 Frankfurt am Main, Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS plesk2.living-bots.net Software nginx / PleskLin Resource Hash 225e078f0432e7459d74e8d9245f1982570a3897d664ca2d219ccd09b244ab95 Request headers accept-language de-DE,de;q=0.9 Referer https://23468-5680.s2.webspace.re/portal/id/pass/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36 Response headers date Sun, 14 May 2023 07:29:52 GMT content-encoding br last-modified Sat, 13 May 2023 17:08:09 GMT server nginx etag W/"645fc3f9-183fc" x-powered-by PleskLin content-type application/javascript
GET H2	200	SBBWeb-Light.woff2 cdn.app.sbb.ch/fonts/v1_6_subset/	14 KB 14 KB	35ms 10ms	Font application/font-woff2	52.28.127.176 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.app.sbb.ch/fonts/v1_6_subset/SBBWeb-Light.woff2 Requested by Host: 23468-5680.s2.webspace.re URL: https://23468-5680.s2.webspace.re/portal/id/pass/index_files/sso.min-20200819.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.28.127.176 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-28-127-176.eu-central-1.compute.amazonaws.com Software nginx/1.23.2 / Resource Hash 5c7f0e173844556da7ca5eb8936fa3dab1c00206960920a49a1eea9cde2bfaaf Request headers Referer https://23468-5680.s2.webspace.re/ Origin https://23468-5680.s2.webspace.re accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36 Response headers date Sun, 14 May 2023 07:29:52 GMT content-encoding br last-modified Fri, 17 Dec 2021 15:16:26 GMT server nginx/1.23.2 etag W/"61bca9ca-3784" vary Accept-Encoding access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS content-type application/font-woff2 access-control-allow-origin * cache-control max-age=31536000, public, private access-control-allow-credentials true access-control-allow-headers Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With expires Mon, 13 May 2024 07:29:52 GMT
GET H2	404	e91f4b90-f9aa-4ace-891b-96dd07595d9f-test.json Show response 23468-5680.s2.webspace.re/portal/id/pass/index_files/otSDKStub.js/consent/e91f4b90-f9aa-4ace-891b-96dd07595d9f-test/	808 B 501 B	8ms 8ms	XHR text/html	91.218.65.223 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://23468-5680.s2.webspace.re/portal/id/pass/index_files/otSDKStub.js/consent/e91f4b90-f9aa-4ace-891b-96dd07595d9f-test/e91f4b90-f9aa-4ace-891b-96dd07595d9f-test.json Requested by Host: 23468-5680.s2.webspace.re URL: https://23468-5680.s2.webspace.re/portal/id/pass/index_files/otSDKStub.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 91.218.65.223 Frankfurt am Main, Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS plesk2.living-bots.net Software nginx / Resource Hash b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187 Request headers accept-language de-DE,de;q=0.9 Referer https://23468-5680.s2.webspace.re/portal/id/pass/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36 Response headers date Sun, 14 May 2023 07:29:52 GMT content-encoding br last-modified Fri, 12 May 2023 10:12:00 GMT server nginx etag W/"328-5fb7c55f28841" content-type text/html
GET H/1.1	200 OK	login_bg.jpg resources.swisspass.ch/content/dam/swisspass/co-branding/sbbkn/	221 KB 221 KB	87ms 23ms	Image image/jpeg	193.203.121.145 SBB-CFF-FFS Telec...
General Check archive.org Show headers Download Go to Show image Full URL https://resources.swisspass.ch/content/dam/swisspass/co-branding/sbbkn/login_bg.jpg Requested by Host: 23468-5680.s2.webspace.re URL: https://23468-5680.s2.webspace.re/portal/id/pass/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 193.203.121.145 , Switzerland, ASN31004 (SBB-CFF-FFS Telecom SBB, CH), Reverse DNS Software Apache / Resource Hash c299a55acdc9c551ab7e67912892c6db8ed164dbcebaca370aa75f0f1297c8d4 Security Headers Name Value Strict-Transport-Security max-age=16070400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://23468-5680.s2.webspace.re/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36 Response headers Date Sun, 14 May 2023 07:29:52 GMT Strict-Transport-Security max-age=16070400 X-Content-Type-Options nosniff X-Cache HIT x-url /content/dam/swisspass/co-branding/sbbkn/login_bg.jpg Connection Keep-Alive Content-Length 226097 X-XSS-Protection 1; mode=block Referrer-Policy same-origin Last-Modified Sun, 14 May 2023 01:03:12 GMT Server Apache ETag "37331-5fb9ce6fffc71" Vary User-Agent,X-Requested-With X-Frame-Options SAMEORIGIN X-Varnish 564546157 565531043 Content-Type image/jpeg X-Plattform cprod Cache-Control max-age=21600 Accept-Ranges bytes Keep-Alive timeout=10, max=500 Expires Sun, 14 May 2023 13:29:16 GMT
GET H2	404	icomoon.woff2 23468-5680.s2.webspace.re/portal/fonts/icomoon/	0 0	18ms 18ms	Font text/html	91.218.65.223 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://23468-5680.s2.webspace.re/portal/fonts/icomoon/icomoon.woff2?7m5yri Requested by Host: 23468-5680.s2.webspace.re URL: https://23468-5680.s2.webspace.re/portal/id/pass/index_files/sso.min-20200819.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 91.218.65.223 Frankfurt am Main, Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS plesk2.living-bots.net Software nginx / Resource Hash Request headers Referer https://23468-5680.s2.webspace.re/portal/id/pass/index_files/sso.min-20200819.css Origin https://23468-5680.s2.webspace.re accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36 Response headers date Sun, 14 May 2023 07:29:52 GMT content-encoding br last-modified Fri, 12 May 2023 10:12:00 GMT server nginx etag W/"328-5fb7c55f28841" content-type text/html
GET H2	404	icomoon.ttf 23468-5680.s2.webspace.re/portal/fonts/icomoon/	0 0	9ms 9ms	Font text/html	91.218.65.223 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://23468-5680.s2.webspace.re/portal/fonts/icomoon/icomoon.ttf?7m5yri Requested by Host: 23468-5680.s2.webspace.re URL: https://23468-5680.s2.webspace.re/portal/id/pass/index_files/sso.min-20200819.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 91.218.65.223 Frankfurt am Main, Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS plesk2.living-bots.net Software nginx / Resource Hash Request headers Referer https://23468-5680.s2.webspace.re/portal/id/pass/index_files/sso.min-20200819.css Origin https://23468-5680.s2.webspace.re accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36 Response headers date Sun, 14 May 2023 07:29:52 GMT content-encoding br last-modified Fri, 12 May 2023 10:12:00 GMT server nginx etag W/"328-5fb7c55f28841" content-type text/html
GET H2	404	co-branding Show response 23468-5680.s2.webspace.re/idp/	808 B 501 B	8ms 8ms	XHR text/html	91.218.65.223 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://23468-5680.s2.webspace.re/idp/co-branding?resource=co-branding&lang=fr&provider=sbbkn Requested by Host: 23468-5680.s2.webspace.re URL: https://23468-5680.s2.webspace.re/portal/id/pass/index_files/jquery-20200819.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 91.218.65.223 Frankfurt am Main, Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS plesk2.living-bots.net Software nginx / Resource Hash b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187 Request headers Accept */* Referer https://23468-5680.s2.webspace.re/portal/id/pass/ X-Requested-With XMLHttpRequest accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36 Response headers date Sun, 14 May 2023 07:29:52 GMT content-encoding br last-modified Fri, 12 May 2023 10:12:00 GMT server nginx etag W/"328-5fb7c55f28841" content-type text/html
GET H2	404	icomoon.woff 23468-5680.s2.webspace.re/portal/fonts/icomoon/	0 0	8ms 8ms	Font text/html	91.218.65.223 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://23468-5680.s2.webspace.re/portal/fonts/icomoon/icomoon.woff?7m5yri Requested by Host: 23468-5680.s2.webspace.re URL: https://23468-5680.s2.webspace.re/portal/id/pass/index_files/sso.min-20200819.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 91.218.65.223 Frankfurt am Main, Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS plesk2.living-bots.net Software nginx / Resource Hash Request headers Referer https://23468-5680.s2.webspace.re/portal/id/pass/index_files/sso.min-20200819.css Origin https://23468-5680.s2.webspace.re accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36 Response headers date Sun, 14 May 2023 07:29:52 GMT content-encoding br last-modified Fri, 12 May 2023 10:12:00 GMT server nginx etag W/"328-5fb7c55f28841" content-type text/html
GET H2	200	hit.xiti logs1407.xiti.com/	35 B 308 B	33ms 9ms	Image image/gif	108.138.20.57 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://logs1407.xiti.com/hit.xiti?s=611076&idclient=642829bc-2c8e-4d61-be29-7fe2fcecf6ca&ts=1684049392522&vtag=5.29.4&ptag=js&r=1600x1200x24x24&re=1600x1200&hl=7x29x52&lng=en-US&idp=0729521433966&jv=0&p=login::(CH)%20%7C%20SwissPass&s2=1&x3=[23468-5680.s2.webspace.re%2Fportal%2Fid%2Fpass%2F]&x4=[%2Flogin]&x5=[]&x6=[]&x7=[fr]&x8=[]&x11=[https%3A%2F%2F23468-5680.s2.webspace.re%2Fportal%2Fid%2Fpass%2F]&x12=[0]&x13=[SwissPass]&s:tms_version=swisspass.ch%20(digitalDataLayer)%3A%3Aproduction%3A%3A2022-07-11T13%3A22%3A43Z&s:login_status=0&s:login_type=SwissPass&ref= Requested by Host: 23468-5680.s2.webspace.re URL: https://23468-5680.s2.webspace.re/portal/id/pass/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 108.138.20.57 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-108-138-20-57.fra56.r.cloudfront.net Software / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=15768000 Request headers accept-language de-DE,de;q=0.9 Referer https://23468-5680.s2.webspace.re/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36 Response headers date Sun, 14 May 2023 07:29:52 GMT via 1.1 8dc3ccc34d68ee81173fff2a80f72bde.cloudfront.net (CloudFront) strict-transport-security max-age=15768000 x-amz-cf-pop FRA56-P7 x-cache Miss from cloudfront content-type image/gif cache-control no-store content-length 35 x-amz-cf-id EddnLKxUrtItHWdsHq3T7Ep6ZCJaaJBErZ-KPjKUfYkNzqobECnpTA==

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Schweizerische Bundesbahnen (Transportation)

32 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| digitalDataLayer object| html5 object| Modernizr object| OneTrustStub object| digitalData object| dataLayerEvent function| OptanonWrapper function| validateForm function| closeModal function| $ function| jQuery object| jQuery11200976279727675575 function| A11yDialog function| iFrameResize function| Cleave function| OevcResourceLoader object| dp object| oevc object| webtrends boolean| isMobile function| validate object| options object| attrs object| allowedProviders object| rememberMe boolean| providerAllowsRememberMe object| _satellite boolean| __satelliteLoaded object| ATInternet function| ATCustomEvent object| ATInternetTag

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.webspace.re/	1970-01-20 21:19:10	Name: atuserid Value: %7B%22name%22%3A%22atuserid%22%2C%22val%22%3A%22642829bc-2c8e-4d61-be29-7fe2fcecf6ca%22%2C%22options%22%3A%7B%22end%22%3A%222024-06-14T07%3A29%3A52.517Z%22%2C%22path%22%3A%22%2F%22%7D%7D

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://23468-5680.s2.webspace.re/portal/id/pass/index_files/otSDKStub.js/consent/e91f4b90-f9aa-4ace-891b-96dd07595d9f-test/e91f4b90-f9aa-4ace-891b-96dd07595d9f-test.json Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://23468-5680.s2.webspace.re/portal/fonts/icomoon/icomoon.woff2?7m5yri Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://23468-5680.s2.webspace.re/portal/fonts/icomoon/icomoon.ttf?7m5yri Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://23468-5680.s2.webspace.re/idp/co-branding?resource=co-branding&lang=fr&provider=sbbkn Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://23468-5680.s2.webspace.re/portal/fonts/icomoon/icomoon.woff?7m5yri Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

23468-5680.s2.webspace.re
cdn.app.sbb.ch
logs1407.xiti.com
resources.swisspass.ch
108.138.20.57
193.203.121.145
52.28.127.176
91.218.65.223
17b7c94cb891331ef612c7b2b3648f007c1c4f6a2eb420199bb275d91450959b
204a3299ddc67db6fd1836653ece6696c46f1b2d7fb7abcb4fe9132abe2b6612
225e078f0432e7459d74e8d9245f1982570a3897d664ca2d219ccd09b244ab95
24f31a4afb4d98c85b6cff4c9a953654a77986d6c4c9e9cae52cf57e59095e01
4a3d4cf982535aaf485c6e3af9ad1498df5c065adf94eed056f0aa13c31e92ed
5c7f0e173844556da7ca5eb8936fa3dab1c00206960920a49a1eea9cde2bfaaf
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6dc2b32636e09159a8f25d527d944aae49e84e45936c5850bb96fafc85f86ade
7aaad78d13ba343554d09043d46b9f563fb3c06d4789f7faf5e45a7247458894
811e8df757d166dce4bda35c81d2f639eed22055abd034720214c7125b21b737
85f462d788bd2ed45b1acf2bb74939a403b9a0f2c7b98054739d89e678315677
91134963643090e67d09747d67c7b0cc111ba642b39c7b04031fd43b9707380e
b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187
be0223ae72bc8c610c7a5453d349964cbe78ff8646695a58bc13a4cf0a8d81d6
c299a55acdc9c551ab7e67912892c6db8ed164dbcebaca370aa75f0f1297c8d4
f3658338df6f21268d6907332ba6f3cf9e649462194476d5539b6a198efdd6b0