pget.com.pk
Open in
urlscan Pro
5.134.12.31
Malicious Activity!
Public Scan
Submitted URL: https://pget.com.pk/wp-content/sqq/sbb/
Effective URL: https://pget.com.pk/wp-content/sqq/sbb/1.html?ID-connect?q=df&ehome&j-oin-us.x=7a7039d2f926687d597cbc3ee2dbf18b7a703...
Submission: On March 02 via automatic, source openphish — Scanned from GB
Effective URL: https://pget.com.pk/wp-content/sqq/sbb/1.html?ID-connect?q=df&ehome&j-oin-us.x=7a7039d2f926687d597cbc3ee2dbf18b7a703...
Submission: On March 02 via automatic, source openphish — Scanned from GB
Summary
This website contacted 2 IPs
in 2 countries
across 2 domains to perform 11 HTTP transactions.
The main IP is 5.134.12.31, located in
United Kingdom and
belongs to UKNOC-AS, GB.
The main domain is pget.com.pk.
TLS certificate: Issued by R3 on February 29th 2024. Valid for: 3 months.
This is the only time pget.com.pk was scanned on urlscan.io!
TLS certificate: Issued by R3 on February 29th 2024. Valid for: 3 months.
This is the only time pget.com.pk was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Schweizerische Bundesbahnen (Transportation)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 10 | 5.134.12.31 5.134.12.31 | 34282 (UKNOC-AS) (UKNOC-AS) | |
| 1 | 18.184.30.76 18.184.30.76 | 16509 (AMAZON-02) (AMAZON-02) | |
| 11 | 2 |
1
18.184.30.76
(Frankfurt am Main, Germany)
ASN16509 (AMAZON-02, US)
PTR: ec2-18-184-30-76.eu-central-1.compute.amazonaws.com
ASN16509 (AMAZON-02, US)
PTR: ec2-18-184-30-76.eu-central-1.compute.amazonaws.com
| cdn.app.sbb.ch |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 10 |
pget.com.pk
pget.com.pk |
167 KB |
| 1 |
sbb.ch
cdn.app.sbb.ch — Cisco Umbrella Rank: 375661 |
14 KB |
| 11 | 2 |
| Domain | Requested by | |
|---|---|---|
| 10 | pget.com.pk |
pget.com.pk
|
| 1 | cdn.app.sbb.ch |
pget.com.pk
|
| 11 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| cpcontacts.pget.com.pk R3 |
2024-02-29 - 2024-05-29 |
3 months | crt.sh |
| *.app.sbb.ch Amazon RSA 2048 M02 |
2023-08-16 - 2024-09-13 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://pget.com.pk/wp-content/sqq/sbb/1.html?ID-connect?q=df&ehome&j-oin-us.x=7a7039d2f926687d597cbc3ee2dbf18b7a7039d2f926687d597cbc3ee2dbf18b
Frame ID: 0F737593552DCBD621FADC4500A2F5F7
Requests: 11 HTTP requests in this frame
Screenshot
Page Title
Login | SwissPassPage URL History Show full URLs
- https://pget.com.pk/wp-content/sqq/sbb/ Page URL
- https://pget.com.pk/wp-content/sqq/sbb/1.html?ID-connect?q=df&ehome&j-oin-us.x=7a7039d2f926687d5... Page URL
Detected technologies
WordPress
(CMS)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- /wp-(?:content|includes)/
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://pget.com.pk/wp-content/sqq/sbb/ Page URL
- https://pget.com.pk/wp-content/sqq/sbb/1.html?ID-connect?q=df&ehome&j-oin-us.x=7a7039d2f926687d597cbc3ee2dbf18b7a7039d2f926687d597cbc3ee2dbf18b Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
/
pget.com.pk/wp-content/sqq/sbb/ |
149 B 463 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
Primary Request
1.html
pget.com.pk/wp-content/sqq/sbb/ |
20 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
sso.min-20200819.css
pget.com.pk/wp-content/sqq/sbb/css/ |
216 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
logo_text_de-20200819.png
pget.com.pk/wp-content/sqq/sbb/img/ |
11 KB 11 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
logo-20200819.png
pget.com.pk/wp-content/sqq/sbb/img/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
loader-20200819.png
pget.com.pk/wp-content/sqq/sbb/ |
10 KB 10 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery-20200819.js
pget.com.pk/wp-content/sqq/sbb/js/ |
95 KB 32 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
vendor.min-20200819.js
pget.com.pk/wp-content/sqq/sbb/js/ |
175 KB 51 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
swisspass.min-20200819.js
pget.com.pk/wp-content/sqq/sbb/js/ |
97 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
SBBWeb-Light.woff2
cdn.app.sbb.ch/fonts/v1_6_subset/ |
14 KB 14 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
icomoon.woff2
pget.com.pk/wp-content/sqq/sbb/css/fonts/ |
7 KB 7 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Schweizerische Bundesbahnen (Transportation)14 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| validateForm function| closeModal function| $ function| jQuery object| jQuery112009880595487931128 function| A11yDialog function| iFrameResize function| Cleave function| OevcResourceLoader object| dp object| oevc object| webtrends boolean| isMobile function| validate1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| pget.com.pk/ | Name: PHPSESSID Value: 5b621f253d66d902722a425efe4d5816 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.app.sbb.ch
pget.com.pk
18.184.30.76
5.134.12.31
225e078f0432e7459d74e8d9245f1982570a3897d664ca2d219ccd09b244ab95
24f31a4afb4d98c85b6cff4c9a953654a77986d6c4c9e9cae52cf57e59095e01
260a930d1488388b9907c22237d0334807ba83b4b23f4ec50f7743cbcdf284f9
3397660196a35ebb826091bedd3ec322aa58c0e9c4e439eb17d0db3f0259cb9c
3bdf1bd45265078bde3d6f5d0e7a87ec5a4d93c0386b264ed28227532f3a6a08
45b8f30ef99295a0d738416e4e5af9fa2dd41619499622c2c57416580fc7197b
460be19efe04e75453a8ee08c909342118c98071a20a4c7ef5a1f7914d975675
5c7f0e173844556da7ca5eb8936fa3dab1c00206960920a49a1eea9cde2bfaaf
a2db652494b35d78ba0eaafbec382d055662e735380b03e5d8e78db7c751df64
be0223ae72bc8c610c7a5453d349964cbe78ff8646695a58bc13a4cf0a8d81d6
e0f4424a0cfc4143868873503307ca73dd8011e931f21e2d90e018cecf2b8e20