swisspasskontosicherheit.kinsta.cloud
Open in
urlscan Pro
2606:4700:7::a29f:872a
Malicious Activity!
Public Scan
Submission: On March 29 via manual from CH — Scanned from DE
Summary
This is the only time swisspasskontosicherheit.kinsta.cloud was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Schweizerische Bundesbahnen (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 19 | 2606:4700:7::... 2606:4700:7::a29f:872a | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 52.58.254.23 52.58.254.23 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 193.203.121.145 193.203.121.145 | 31004 (SBB-CFF-F...) (SBB-CFF-FFS Telecom SBB) | |
1 | 52.222.228.32 52.222.228.32 | 16509 (AMAZON-02) (AMAZON-02) | |
20 | 4 |
ASN13335 (CLOUDFLARENET, US)
swisspasskontosicherheit.kinsta.cloud |
ASN16509 (AMAZON-02, US)
PTR: ec2-52-58-254-23.eu-central-1.compute.amazonaws.com
cdn.app.sbb.ch |
ASN16509 (AMAZON-02, US)
PTR: server-52-222-228-32.fra56.r.cloudfront.net
logs1407.xiti.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
19 |
kinsta.cloud
2 redirects
swisspasskontosicherheit.kinsta.cloud |
1 MB |
1 |
xiti.com
logs1407.xiti.com — Cisco Umbrella Rank: 88712 |
307 B |
1 |
swisspass.ch
resources.swisspass.ch |
221 KB |
1 |
sbb.ch
cdn.app.sbb.ch — Cisco Umbrella Rank: 334503 |
14 KB |
20 | 4 |
Domain | Requested by | |
---|---|---|
19 | swisspasskontosicherheit.kinsta.cloud |
2 redirects
swisspasskontosicherheit.kinsta.cloud
|
1 | logs1407.xiti.com |
swisspasskontosicherheit.kinsta.cloud
|
1 | resources.swisspass.ch |
swisspasskontosicherheit.kinsta.cloud
|
1 | cdn.app.sbb.ch |
swisspasskontosicherheit.kinsta.cloud
|
20 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.swisspass.ch |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.app.sbb.ch Amazon RSA 2048 M01 |
2023-02-10 - 2023-10-14 |
8 months | crt.sh |
resources.swisspass.ch SwissSign RSA TLS OV ICA 2021 - 1 |
2022-05-04 - 2023-05-04 |
a year | crt.sh |
*.xiti.com Thawte RSA CA 2018 |
2022-04-29 - 2023-04-28 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
http://swisspasskontosicherheit.kinsta.cloud/api/id/pass/index.html
Frame ID: D6AE8991CDAB96C2602BAA86ABA50AF5
Requests: 20 HTTP requests in this frame
Screenshot
Page Title
(CH) | SwissPassDetected technologies
AT Internet XiTi (Analytics) ExpandDetected patterns
- xiti\.com/hit\.xiti
Modernizr (JavaScript Libraries) Expand
Detected patterns
- ([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js
OneTrust (Cookie compliance) Expand
Detected patterns
- otSDKStub\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Retour
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 12- http://swisspasskontosicherheit.kinsta.cloud/api/id/pass/index_files/otSDKStub.js/consent/e91f4b90-f9aa-4ace-891b-96dd07595d9f-test/e91f4b90-f9aa-4ace-891b-96dd07595d9f-test.json HTTP 301
- http://swisspasskontosicherheit.kinsta.cloud/api/id/pass/index_files/otSDKStub.js/consent/e91f4b90-f9aa-4ace-891b-96dd07595d9f-test/e91f4b90-f9aa-4ace-891b-96dd07595d9f-test.json/
- http://swisspasskontosicherheit.kinsta.cloud/idp/co-branding?resource=co-branding&lang=fr&provider=sbbkn HTTP 301
- http://swisspasskontosicherheit.kinsta.cloud/idp/co-branding/?resource=co-branding&lang=fr&provider=sbbkn
20 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
index.html
swisspasskontosicherheit.kinsta.cloud/api/id/pass/ |
50 KB 12 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sso.min-20200819.css
swisspasskontosicherheit.kinsta.cloud/api/id/pass/index_files/ |
180 KB 25 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
modernizr-20200819.js
swisspasskontosicherheit.kinsta.cloud/api/id/pass/index_files/ |
8 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
otSDKStub.js
swisspasskontosicherheit.kinsta.cloud/api/id/pass/index_files/ |
20 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
launch-6cc731e967aa.min.js
swisspasskontosicherheit.kinsta.cloud/api/id/pass/index_files/ |
139 KB 42 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
otBannerSdk.js
swisspasskontosicherheit.kinsta.cloud/api/id/pass/index_files/ |
324 KB 79 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.png
swisspasskontosicherheit.kinsta.cloud/api/id/pass/index_files/ |
752 KB 754 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logopass.png
swisspasskontosicherheit.kinsta.cloud/api/id/pass/index_files/ |
19 KB 20 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pss.png
swisspasskontosicherheit.kinsta.cloud/api/id/pass/index_files/ |
105 KB 106 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-20200819.js
swisspasskontosicherheit.kinsta.cloud/api/id/pass/index_files/ |
95 KB 35 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
vendor.min-20200819.js
swisspasskontosicherheit.kinsta.cloud/api/id/pass/index_files/ |
175 KB 54 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
swisspass.min-20200819.js
swisspasskontosicherheit.kinsta.cloud/api/id/pass/index_files/ |
97 KB 26 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
SBBWeb-Light.woff2
cdn.app.sbb.ch/fonts/v1_6_subset/ |
14 KB 14 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
swisspasskontosicherheit.kinsta.cloud/api/id/pass/index_files/otSDKStub.js/consent/e91f4b90-f9aa-4ace-891b-96dd07595d9f-test/e91f4b90-f9aa-4ace-891b-96dd07595d9f-test.json/ Redirect Chain
|
51 KB 11 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login_bg.jpg
resources.swisspass.ch/content/dam/swisspass/co-branding/sbbkn/ |
221 KB 221 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icomoon.woff2
swisspasskontosicherheit.kinsta.cloud/api/fonts/icomoon/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icomoon.ttf
swisspasskontosicherheit.kinsta.cloud/api/fonts/icomoon/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
swisspasskontosicherheit.kinsta.cloud/idp/co-branding/ Redirect Chain
|
51 KB 11 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
hit.xiti
logs1407.xiti.com/ |
35 B 307 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icomoon.woff
swisspasskontosicherheit.kinsta.cloud/api/fonts/icomoon/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Schweizerische Bundesbahnen (Transportation)32 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| digitalDataLayer object| html5 object| Modernizr object| OneTrustStub object| digitalData object| dataLayerEvent function| OptanonWrapper function| validateForm function| closeModal function| $ function| jQuery object| jQuery112003832173531237131 function| A11yDialog function| iFrameResize function| Cleave function| OevcResourceLoader object| dp object| oevc object| webtrends boolean| isMobile function| validate object| options object| attrs object| allowedProviders object| rememberMe boolean| providerAllowsRememberMe object| _satellite boolean| __satelliteLoaded object| ATInternet function| ATCustomEvent object| ATInternetTag0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.app.sbb.ch
logs1407.xiti.com
resources.swisspass.ch
swisspasskontosicherheit.kinsta.cloud
193.203.121.145
2606:4700:7::a29f:872a
52.222.228.32
52.58.254.23
17b7c94cb891331ef612c7b2b3648f007c1c4f6a2eb420199bb275d91450959b
204a3299ddc67db6fd1836653ece6696c46f1b2d7fb7abcb4fe9132abe2b6612
225e078f0432e7459d74e8d9245f1982570a3897d664ca2d219ccd09b244ab95
24f31a4afb4d98c85b6cff4c9a953654a77986d6c4c9e9cae52cf57e59095e01
4a3d4cf982535aaf485c6e3af9ad1498df5c065adf94eed056f0aa13c31e92ed
5c7f0e173844556da7ca5eb8936fa3dab1c00206960920a49a1eea9cde2bfaaf
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6dc2b32636e09159a8f25d527d944aae49e84e45936c5850bb96fafc85f86ade
7aaad78d13ba343554d09043d46b9f563fb3c06d4789f7faf5e45a7247458894
811e8df757d166dce4bda35c81d2f639eed22055abd034720214c7125b21b737
85f462d788bd2ed45b1acf2bb74939a403b9a0f2c7b98054739d89e678315677
91134963643090e67d09747d67c7b0cc111ba642b39c7b04031fd43b9707380e
be0223ae72bc8c610c7a5453d349964cbe78ff8646695a58bc13a4cf0a8d81d6
c299a55acdc9c551ab7e67912892c6db8ed164dbcebaca370aa75f0f1297c8d4
f3658338df6f21268d6907332ba6f3cf9e649462194476d5539b6a198efdd6b0
febe4734476adf5f79f8fe6165461f3eade551b2d4a6315d4c3f9ca519566f4e