lwk.lil.mybluehost.me Open in urlscan Pro
5.100.156.161  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request sign.php Show response lwk.lil.mybluehost.me/wp-content/CH/SuissePass/api/aa/d/	23 KB 5 KB	509ms 434ms	Document text/html	5.100.156.161 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://lwk.lil.mybluehost.me/wp-content/CH/SuissePass/api/aa/d/sign.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 5.100.156.161 London, United Kingdom, ASN2635 (AUTOMATTIC, US), Reverse DNS 5.100.156-161.publicdomainregistry.com Software nginx / Resource Hash d60754f2dac4d8ef4f36c93ac2a6c1b4960efef684b28d621acab06e6b1c1775 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=86400 content-encoding br content-type text/html; charset=utf-8 date Sat, 31 Aug 2024 05:16:34 GMT server nginx strict-transport-security max-age=31536000 vary Accept-Encoding x-ac 3.lhr _atomic_ams MISS
GET H2	200	sso.min-20200819.css lwk.lil.mybluehost.me/wp-content/CH/SuissePass/api/aa/d/Login%20_%20SwissPass_files/	180 KB 24 KB	34ms 33ms	Stylesheet text/css	5.100.156.161 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://lwk.lil.mybluehost.me/wp-content/CH/SuissePass/api/aa/d/Login%20_%20SwissPass_files/sso.min-20200819.css Requested by Host: lwk.lil.mybluehost.me URL: https://lwk.lil.mybluehost.me/wp-content/CH/SuissePass/api/aa/d/sign.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 5.100.156.161 London, United Kingdom, ASN2635 (AUTOMATTIC, US), Reverse DNS 5.100.156-161.publicdomainregistry.com Software nginx / Resource Hash da86a8f910323e36049f6fee7c877d53f9f5020f2031efdfabaec371476e1b5a Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://lwk.lil.mybluehost.me/wp-content/CH/SuissePass/api/aa/d/sign.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Sat, 31 Aug 2024 05:16:34 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Sun, 12 May 2024 20:15:46 GMT server nginx x-ac 3.lhr _atomic_ams HIT etag W/"66412372-2ce5a" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type text/css access-control-allow-origin * cache-control max-age=31536000 alt-svc h3=":443"; ma=86400 expires Sat, 30 Aug 2025 14:49:14 GMT
GET H2	200	jq.js Show response lwk.lil.mybluehost.me/wp-content/CH/SuissePass/api/aa/d/assets/js/	361 KB 34 KB	34ms 34ms	Script application/javascript	5.100.156.161 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://lwk.lil.mybluehost.me/wp-content/CH/SuissePass/api/aa/d/assets/js/jq.js Requested by Host: lwk.lil.mybluehost.me URL: https://lwk.lil.mybluehost.me/wp-content/CH/SuissePass/api/aa/d/sign.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 5.100.156.161 London, United Kingdom, ASN2635 (AUTOMATTIC, US), Reverse DNS 5.100.156-161.publicdomainregistry.com Software nginx / Resource Hash d9b25f5ed5a4e51c2cb6f07f77e130a24632ecbedffa430888fff41cda8ad009 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://lwk.lil.mybluehost.me/wp-content/CH/SuissePass/api/aa/d/sign.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Sat, 31 Aug 2024 05:16:34 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Sun, 12 May 2024 20:15:46 GMT server nginx x-ac 3.lhr _atomic_ams HIT etag W/"66412372-5a2d8" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type application/javascript access-control-allow-origin * cache-control max-age=31536000 alt-svc h3=":443"; ma=86400 expires Sat, 30 Aug 2025 14:49:14 GMT
GET H2	200	logo_text_de-20200819.svg lwk.lil.mybluehost.me/wp-content/CH/SuissePass/api/aa/d/	137 KB 16 KB	65ms 65ms	Image image/svg+xml	5.100.156.161 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://lwk.lil.mybluehost.me/wp-content/CH/SuissePass/api/aa/d/logo_text_de-20200819.svg Requested by Host: lwk.lil.mybluehost.me URL: https://lwk.lil.mybluehost.me/wp-content/CH/SuissePass/api/aa/d/sign.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 5.100.156.161 London, United Kingdom, ASN2635 (AUTOMATTIC, US), Reverse DNS 5.100.156-161.publicdomainregistry.com Software nginx / Resource Hash c337d42ed7979c6be0282900bd957dd9d112a430dc7761463d655eb8f0d9bc07 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://lwk.lil.mybluehost.me/wp-content/CH/SuissePass/api/aa/d/sign.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Sat, 31 Aug 2024 05:16:34 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Sun, 12 May 2024 20:15:46 GMT server nginx x-ac 3.lhr _atomic_ams HIT etag W/"66412372-222c3" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type image/svg+xml access-control-allow-origin * cache-control max-age=31536000 alt-svc h3=":443"; ma=86400 expires Sat, 30 Aug 2025 14:49:14 GMT
GET H2	200	logo-20200819.svg lwk.lil.mybluehost.me/wp-content/CH/SuissePass/api/aa/d/	7 KB 3 KB	68ms 67ms	Image image/svg+xml	5.100.156.161 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://lwk.lil.mybluehost.me/wp-content/CH/SuissePass/api/aa/d/logo-20200819.svg Requested by Host: lwk.lil.mybluehost.me URL: https://lwk.lil.mybluehost.me/wp-content/CH/SuissePass/api/aa/d/sign.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 5.100.156.161 London, United Kingdom, ASN2635 (AUTOMATTIC, US), Reverse DNS 5.100.156-161.publicdomainregistry.com Software nginx / Resource Hash deeee170c3759a6ed35c0c05c5b935d0e7638f1c0c5677166918ecff6edb1909 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://lwk.lil.mybluehost.me/wp-content/CH/SuissePass/api/aa/d/sign.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Sat, 31 Aug 2024 05:16:34 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Sun, 12 May 2024 20:15:46 GMT server nginx x-ac 3.lhr _atomic_ams HIT etag W/"66412372-1cce" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type image/svg+xml access-control-allow-origin * cache-control max-age=31536000 alt-svc h3=":443"; ma=86400 expires Sat, 30 Aug 2025 14:49:14 GMT
GET H2	200	loader-20200819.png lwk.lil.mybluehost.me/wp-content/CH/SuissePass/api/aa/d/Login%20_%20SwissPass_files/	272 B 588 B	63ms 63ms	Image image/png	5.100.156.161 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://lwk.lil.mybluehost.me/wp-content/CH/SuissePass/api/aa/d/Login%20_%20SwissPass_files/loader-20200819.png Requested by Host: lwk.lil.mybluehost.me URL: https://lwk.lil.mybluehost.me/wp-content/CH/SuissePass/api/aa/d/sign.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 5.100.156.161 London, United Kingdom, ASN2635 (AUTOMATTIC, US), Reverse DNS 5.100.156-161.publicdomainregistry.com Software nginx / Resource Hash f766c7457c6ec463eaa85778aa47261344f1772e0b7cf1987ad212f889f472f5 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://lwk.lil.mybluehost.me/wp-content/CH/SuissePass/api/aa/d/sign.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Sat, 31 Aug 2024 05:16:34 GMT strict-transport-security max-age=31536000 x-ac 3.lhr _atomic_ams HIT last-modified Sun, 12 May 2024 20:15:46 GMT server nginx etag "66412372-110" access-control-allow-methods GET, HEAD content-type image/png access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes alt-svc h3=":443"; ma=86400 content-length 272 expires Sat, 30 Aug 2025 14:49:14 GMT
GET H2	200	SBBWeb-Light.woff2 cdn.app.sbb.ch/fonts/v1_6_subset/	14 KB 14 KB	184ms 85ms	Font application/font-woff2	18.158.120.87 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.app.sbb.ch/fonts/v1_6_subset/SBBWeb-Light.woff2 Requested by Host: lwk.lil.mybluehost.me URL: https://lwk.lil.mybluehost.me/wp-content/CH/SuissePass/api/aa/d/Login%20_%20SwissPass_files/sso.min-20200819.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.158.120.87 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-158-120-87.eu-central-1.compute.amazonaws.com Software nginx/1.27.1 / Resource Hash 5c7f0e173844556da7ca5eb8936fa3dab1c00206960920a49a1eea9cde2bfaaf Request headers Referer https://lwk.lil.mybluehost.me/ Origin https://lwk.lil.mybluehost.me User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Sat, 31 Aug 2024 05:16:35 GMT content-encoding br last-modified Wed, 31 Jan 2024 10:14:44 GMT server nginx/1.27.1 etag W/"65ba1d94-3784" vary Accept-Encoding access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS content-type application/font-woff2 access-control-allow-origin * cache-control max-age=31536000, public, private access-control-allow-credentials true access-control-allow-headers Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With expires Sun, 31 Aug 2025 05:16:35 GMT
POST		receive_token telegrambotcheck.duckdns.org/	0 0
GET H2	200	login_bg.jpg resources.swisspass.ch/content/dam/swisspass/co-branding/swiss_ch/	196 KB 197 KB	194ms 51ms	Image image/jpeg	2a06:98c1:3200::90:83 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://resources.swisspass.ch/content/dam/swisspass/co-branding/swiss_ch/login_bg.jpg Requested by Host: lwk.lil.mybluehost.me URL: https://lwk.lil.mybluehost.me/wp-content/CH/SuissePass/api/aa/d/sign.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3200::90:83 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 58a037c0bde953b48561826f3df16031f7ddfce33c4018619d3f39c6af6eec1b Security Headers Name Value Strict-Transport-Security max-age=16070400; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://lwk.lil.mybluehost.me/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Sat, 31 Aug 2024 05:16:35 GMT strict-transport-security max-age=16070400; includeSubDomains x-content-type-options nosniff cf-cache-status HIT age 2588 x-cache MISS x-url /content/dam/swisspass/co-branding/swiss_ch/login_bg.jpg content-length 200933 x-xss-protection 1; mode=block referrer-policy same-origin cf-bgj h2pri last-modified Sat, 31 Aug 2024 01:21:37 GMT server cloudflare etag "310e5-620f0877bebb6" x-frame-options SAMEORIGIN vary Accept-Encoding content-type image/jpeg x-varnish 484705134 x-plattform cprod cache-control public, max-age=21600 accept-ranges bytes cf-ray 8bba8c9fbcf199ba-CDG expires Sat, 31 Aug 2024 11:16:35 GMT
GET H3	200	icomoon.woff2 lwk.lil.mybluehost.me/wp-content/CH/SuissePass/api/aa/d/	7 KB 7 KB	81ms 80ms	Font application/font-woff2	5.100.156.161 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://lwk.lil.mybluehost.me/wp-content/CH/SuissePass/api/aa/d/icomoon.woff2 Requested by Host: lwk.lil.mybluehost.me URL: https://lwk.lil.mybluehost.me/wp-content/CH/SuissePass/api/aa/d/sign.php Protocol H3 Security QUIC, , AES_128_GCM Server 5.100.156.161 London, United Kingdom, ASN2635 (AUTOMATTIC, US), Reverse DNS 5.100.156-161.publicdomainregistry.com Software nginx / Resource Hash 78a4a776506b173ae79fd021d0e9003c7d653ca204ea1d69bea4d553f92f787d Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://lwk.lil.mybluehost.me/wp-content/CH/SuissePass/api/aa/d/sign.php Origin https://lwk.lil.mybluehost.me User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Sat, 31 Aug 2024 05:16:35 GMT strict-transport-security max-age=31536000 x-ac 3.lhr _atomic_ams HIT last-modified Sun, 12 May 2024 20:15:46 GMT server nginx etag "66412372-1a14" access-control-allow-methods GET, HEAD content-type application/font-woff2 access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes alt-svc h3=":443"; ma=86400 content-length 6676 expires Sat, 30 Aug 2025 17:17:00 GMT
GET H3	200	favicon.ico lwk.lil.mybluehost.me/wp-content/CH/SuissePass/api/aa/d/Login%20_%20SwissPass_files/	1 KB 378 B	44ms 43ms	Other image/x-icon	5.100.156.161 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://lwk.lil.mybluehost.me/wp-content/CH/SuissePass/api/aa/d/Login%20_%20SwissPass_files/favicon.ico?v=20140709-1126 Protocol H3 Security QUIC, , AES_128_GCM Server 5.100.156.161 London, United Kingdom, ASN2635 (AUTOMATTIC, US), Reverse DNS 5.100.156-161.publicdomainregistry.com Software nginx / Resource Hash 7c1925da382279a72f94990d0a1456f78918619f35780ea0905e4ae0db684677 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://lwk.lil.mybluehost.me/wp-content/CH/SuissePass/api/aa/d/sign.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Sat, 31 Aug 2024 05:16:35 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Sun, 12 May 2024 20:15:46 GMT server nginx x-ac 3.lhr _atomic_ams MISS etag W/"66412372-47e" vary Accept-Encoding content-type image/x-icon alt-svc h3=":443"; ma=86400

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

telegrambotcheck.duckdns.org

URL

https://telegrambotcheck.duckdns.org:1001/receive_token?referrer=sarfita

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Schweizerische Bundesbahnen (Transportation)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

string| token string| tokens string| protocol string| url object| data function| validateForm

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.swisspass.ch/	1970-01-20 23:11:23	Name: __cf_bm Value: QecYR98J3NYhhJZIJ1prTv5P_KvZu4CHlvkRXOEFD.8-1725081395-1.0.1.1-IwgNEG3v1fw9gnoi_FM5jcFt9iVQZX4RhUHEIlh0N8uxLNuGt8n0nyKZ4Xk6AbMBpAbqxjIHIZDngXqlqWhQVA

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	warning	URL: https://lwk.lil.mybluehost.me/wp-content/CH/SuissePass/api/aa/d/sign.php Message: [DOM] Found 2 elements with non-unique id #login_button: (More info: https://goo.gl/9p2vKq) %o %o
recommendation	verbose	URL: https://lwk.lil.mybluehost.me/wp-content/CH/SuissePass/api/aa/d/sign.php Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
javascript	error	URL: https://lwk.lil.mybluehost.me/wp-content/CH/SuissePass/api/aa/d/sign.php Message: Access to fetch at 'https://telegrambotcheck.duckdns.org:1001/receive_token?referrer=sarfita' from origin 'https://lwk.lil.mybluehost.me' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.
network	error	URL: https://telegrambotcheck.duckdns.org:1001/receive_token?referrer=sarfita Message: Failed to load resource: net::ERR_FAILED

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.app.sbb.ch
lwk.lil.mybluehost.me
resources.swisspass.ch
telegrambotcheck.duckdns.org
telegrambotcheck.duckdns.org
18.158.120.87
2a06:98c1:3200::90:83
5.100.156.161
58a037c0bde953b48561826f3df16031f7ddfce33c4018619d3f39c6af6eec1b
5c7f0e173844556da7ca5eb8936fa3dab1c00206960920a49a1eea9cde2bfaaf
78a4a776506b173ae79fd021d0e9003c7d653ca204ea1d69bea4d553f92f787d
7c1925da382279a72f94990d0a1456f78918619f35780ea0905e4ae0db684677
c337d42ed7979c6be0282900bd957dd9d112a430dc7761463d655eb8f0d9bc07
d60754f2dac4d8ef4f36c93ac2a6c1b4960efef684b28d621acab06e6b1c1775
d9b25f5ed5a4e51c2cb6f07f77e130a24632ecbedffa430888fff41cda8ad009
da86a8f910323e36049f6fee7c877d53f9f5020f2031efdfabaec371476e1b5a
deeee170c3759a6ed35c0c05c5b935d0e7638f1c0c5677166918ecff6edb1909
f766c7457c6ec463eaa85778aa47261344f1772e0b7cf1987ad212f889f472f5