sbbschweizcff95491.site Open in urlscan Pro
51.161.195.75 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://sbbschweizcff95491.site/
Effective URL:
https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/3106537259390369587392596505873172...
Submission: On June 19 via api (June 19th 2023, 6:56:00 am UTC) from US — Scanned from AU

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 11 HTTP transactions. The main IP is 51.161.195.75, located in Sydney, Australia and belongs to OVH, FR. The main domain is sbbschweizcff95491.site.
TLS certificate: Issued by cPanel, Inc. Certification Authority on June 17th 2023. Valid for: 3 months.

This is the only time sbbschweizcff95491.site was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Schweizerische Bundesbahnen (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
4 14	51.161.195.75 51.161.195.75	16276 (OVH) (OVH)
1	18.185.155.127 18.185.155.127	16509 (AMAZON-02) (AMAZON-02)
11	2

14 51.161.195.75 (Sydney, Australia) 4 redirects

ASN16276 (OVH, FR)
PTR: ip75.ip-51-161-195.net

sbbschweizcff95491.site	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.185.155.127 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-185-155-127.eu-central-1.compute.amazonaws.com

cdn.app.sbb.ch	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	sbbschweizcff95491.site 4 redirects sbbschweizcff95491.site	668 KB
1	sbb.ch cdn.app.sbb.ch — Cisco Umbrella Rank: 335307	14 KB
11	2

	Domain	Requested by
14	sbbschweizcff95491.site	4 redirects sbbschweizcff95491.site
1	cdn.app.sbb.ch	sbbschweizcff95491.site
11	2

This site contains no links.

Subject Issuer	Validity	Valid
sbbschweizcff95491.site cPanel, Inc. Certification Authority	`2023-06-17` - `2023-09-15`	3 months	crt.sh
*.app.sbb.ch Amazon RSA 2048 M01	`2023-02-10` - `2023-10-14`	8 months	crt.sh

This page contains 1 frames:

Primary Page: https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/3106537259390369587392596505873172430317896856/4840690888839962659940535633901911474397153379.html?ID-connect?q=df&ehome&j-oin-us.x=9aecf085bf8a8644fe2ffcc2b333cd9e9aecf085bf8a8644fe2ffcc2b333cd9e
Frame ID: 698FC8FD9129E6924530D738FCFFF84B
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Login | SwissPass

Page URL History Show full URLs

https://sbbschweizcff95491.site/ HTTP 302
https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647 HTTP 301
https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/ HTTP 302
https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/31065372593903... HTTP 301
https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/31065372593903... Page URL
https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/31065372593903... Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

11
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

681 kB
Transfer

678 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://sbbschweizcff95491.site/ HTTP 302
https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647 HTTP 301
https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/ HTTP 302
https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/3106537259390369587392596505873172430317896856 HTTP 301
https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/3106537259390369587392596505873172430317896856/ Page URL
https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/3106537259390369587392596505873172430317896856/4840690888839962659940535633901911474397153379.html?ID-connect?q=df&ehome&j-oin-us.x=9aecf085bf8a8644fe2ffcc2b333cd9e9aecf085bf8a8644fe2ffcc2b333cd9e Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://sbbschweizcff95491.site/ HTTP 302
https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647 HTTP 301
https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/ HTTP 302
https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/3106537259390369587392596505873172430317896856 HTTP 301
https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/3106537259390369587392596505873172430317896856/

11 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ Show response sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/3106537259390369587392596505873172430317896856/ Redirect Chain https://sbbschweizcff95491.site/ https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647 https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/ https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/3106537259390369587392596505873172430317896856 https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/3106537259390369587392596505873172430317896856/	194 B 426 B	109ms 108ms	Document text/html	51.161.195.75 OVH
General Check archive.org Show headers Download Go to Full URL https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/3106537259390369587392596505873172430317896856/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 51.161.195.75 Sydney, Australia, ASN16276 (OVH, FR), Reverse DNS ip75.ip-51-161-195.net Software Apache / PHP/7.4.33 Resource Hash `074b4a971662a5dd8b994ce9eaaff35a3c09d57479af13bd8e1ed4e528b1af53` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 accept-language en-AU,en;q=0.9 Response headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Mon, 19 Jun 2023 06:55:55 GMT Keep-Alive timeout=5, max=98 Server Apache Transfer-Encoding chunked X-Powered-By PHP/7.4.33 Redirect headers Connection Keep-Alive Content-Length 349 Content-Type text/html; charset=iso-8859-1 Date Mon, 19 Jun 2023 06:55:55 GMT Keep-Alive timeout=5, max=99 Location https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/3106537259390369587392596505873172430317896856/ Server Apache
GET H/1.1	200 OK	Primary Request 4840690888839962659940535633901911474397153379.html Show response sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/3106537259390369587392596505873172430317896856/	60 KB 60 KB	95ms 94ms	Document text/html	51.161.195.75 OVH
General Check archive.org Show headers Download Go to Full URL https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/3106537259390369587392596505873172430317896856/4840690888839962659940535633901911474397153379.html?ID-connect?q=df&ehome&j-oin-us.x=9aecf085bf8a8644fe2ffcc2b333cd9e9aecf085bf8a8644fe2ffcc2b333cd9e Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 51.161.195.75 Sydney, Australia, ASN16276 (OVH, FR), Reverse DNS ip75.ip-51-161-195.net Software Apache / Resource Hash `24bf4739e8260a99a57530510fe6cd7d756783abc73d3c599b32300460b2aa07` Request headers Referer https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/3106537259390369587392596505873172430317896856/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 accept-language en-AU,en;q=0.9 Response headers Accept-Ranges bytes Connection Keep-Alive Content-Length 61296 Content-Type text/html Date Mon, 19 Jun 2023 06:55:55 GMT Keep-Alive timeout=5, max=97 Last-Modified Mon, 19 Jun 2023 06:55:54 GMT Server Apache
GET H/1.1	200 OK	sso.min-20200819.css sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/3106537259390369587392596505873172430317896856/css/	216 KB 216 KB	95ms 94ms	Stylesheet text/css	51.161.195.75 OVH
General Check archive.org Show headers Download Go to Full URL https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/3106537259390369587392596505873172430317896856/css/sso.min-20200819.css Requested by Host: sbbschweizcff95491.site URL: https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/3106537259390369587392596505873172430317896856/4840690888839962659940535633901911474397153379.html?ID-connect?q=df&ehome&j-oin-us.x=9aecf085bf8a8644fe2ffcc2b333cd9e9aecf085bf8a8644fe2ffcc2b333cd9e Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 51.161.195.75 Sydney, Australia, ASN16276 (OVH, FR), Reverse DNS ip75.ip-51-161-195.net Software Apache / Resource Hash `a2db652494b35d78ba0eaafbec382d055662e735380b03e5d8e78db7c751df64` Request headers accept-language en-AU,en;q=0.9 Referer https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/3106537259390369587392596505873172430317896856/4840690888839962659940535633901911474397153379.html?ID-connect?q=df&ehome&j-oin-us.x=9aecf085bf8a8644fe2ffcc2b333cd9e9aecf085bf8a8644fe2ffcc2b333cd9e User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 Response headers Date Mon, 19 Jun 2023 06:55:55 GMT Last-Modified Mon, 19 Jun 2023 06:55:54 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=96 Content-Length 221192
GET H/1.1	200 OK	jquery-20200819.js Show response sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/3106537259390369587392596505873172430317896856/js/	95 KB 95 KB	94ms 94ms	Script application/javascript	51.161.195.75 OVH
General Check archive.org Show headers Download Go to Full URL https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/3106537259390369587392596505873172430317896856/js/jquery-20200819.js Requested by Host: sbbschweizcff95491.site URL: https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/3106537259390369587392596505873172430317896856/4840690888839962659940535633901911474397153379.html?ID-connect?q=df&ehome&j-oin-us.x=9aecf085bf8a8644fe2ffcc2b333cd9e9aecf085bf8a8644fe2ffcc2b333cd9e Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 51.161.195.75 Sydney, Australia, ASN16276 (OVH, FR), Reverse DNS ip75.ip-51-161-195.net Software Apache / Resource Hash `24f31a4afb4d98c85b6cff4c9a953654a77986d6c4c9e9cae52cf57e59095e01` Request headers accept-language en-AU,en;q=0.9 Referer https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/3106537259390369587392596505873172430317896856/4840690888839962659940535633901911474397153379.html?ID-connect?q=df&ehome&j-oin-us.x=9aecf085bf8a8644fe2ffcc2b333cd9e9aecf085bf8a8644fe2ffcc2b333cd9e User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 Response headers Date Mon, 19 Jun 2023 06:55:55 GMT Last-Modified Mon, 19 Jun 2023 06:55:54 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 97364
GET H/1.1	200 OK	logo_text_de-20200819.png sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/3106537259390369587392596505873172430317896856/img/	11 KB 12 KB	283ms 94ms	Image image/png	51.161.195.75 OVH
General Check archive.org Show headers Download Go to Show image Full URL https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/3106537259390369587392596505873172430317896856/img/logo_text_de-20200819.png Requested by Host: sbbschweizcff95491.site URL: https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/3106537259390369587392596505873172430317896856/4840690888839962659940535633901911474397153379.html?ID-connect?q=df&ehome&j-oin-us.x=9aecf085bf8a8644fe2ffcc2b333cd9e9aecf085bf8a8644fe2ffcc2b333cd9e Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 51.161.195.75 Sydney, Australia, ASN16276 (OVH, FR), Reverse DNS ip75.ip-51-161-195.net Software Apache / Resource Hash `e0f4424a0cfc4143868873503307ca73dd8011e931f21e2d90e018cecf2b8e20` Request headers accept-language en-AU,en;q=0.9 Referer https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/3106537259390369587392596505873172430317896856/4840690888839962659940535633901911474397153379.html?ID-connect?q=df&ehome&j-oin-us.x=9aecf085bf8a8644fe2ffcc2b333cd9e9aecf085bf8a8644fe2ffcc2b333cd9e User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 Response headers Date Mon, 19 Jun 2023 06:55:55 GMT Last-Modified Mon, 19 Jun 2023 06:55:54 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 11662
GET H/1.1	200 OK	logo-20200819.png sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/3106537259390369587392596505873172430317896856/img/	3 KB 3 KB	284ms 94ms	Image image/png	51.161.195.75 OVH
General Check archive.org Show headers Download Go to Show image Full URL https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/3106537259390369587392596505873172430317896856/img/logo-20200819.png Requested by Host: sbbschweizcff95491.site URL: https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/3106537259390369587392596505873172430317896856/4840690888839962659940535633901911474397153379.html?ID-connect?q=df&ehome&j-oin-us.x=9aecf085bf8a8644fe2ffcc2b333cd9e9aecf085bf8a8644fe2ffcc2b333cd9e Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 51.161.195.75 Sydney, Australia, ASN16276 (OVH, FR), Reverse DNS ip75.ip-51-161-195.net Software Apache / Resource Hash `3397660196a35ebb826091bedd3ec322aa58c0e9c4e439eb17d0db3f0259cb9c` Request headers accept-language en-AU,en;q=0.9 Referer https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/3106537259390369587392596505873172430317896856/4840690888839962659940535633901911474397153379.html?ID-connect?q=df&ehome&j-oin-us.x=9aecf085bf8a8644fe2ffcc2b333cd9e9aecf085bf8a8644fe2ffcc2b333cd9e User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 Response headers Date Mon, 19 Jun 2023 06:55:55 GMT Last-Modified Mon, 19 Jun 2023 06:55:54 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 2694
GET H/1.1	404 Not Found	loader-20200819.png sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/3106537259390369587392596505873172430317896856/	315 B 315 B	376ms 95ms	Image text/html	51.161.195.75 OVH
General Check archive.org Show headers Download Go to Show image Full URL https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/3106537259390369587392596505873172430317896856/loader-20200819.png Requested by Host: sbbschweizcff95491.site URL: https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/3106537259390369587392596505873172430317896856/4840690888839962659940535633901911474397153379.html?ID-connect?q=df&ehome&j-oin-us.x=9aecf085bf8a8644fe2ffcc2b333cd9e9aecf085bf8a8644fe2ffcc2b333cd9e Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 51.161.195.75 Sydney, Australia, ASN16276 (OVH, FR), Reverse DNS ip75.ip-51-161-195.net Software Apache / Resource Hash `d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3` Request headers accept-language en-AU,en;q=0.9 Referer https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/3106537259390369587392596505873172430317896856/4840690888839962659940535633901911474397153379.html?ID-connect?q=df&ehome&j-oin-us.x=9aecf085bf8a8644fe2ffcc2b333cd9e9aecf085bf8a8644fe2ffcc2b333cd9e User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 Response headers Date Mon, 19 Jun 2023 06:55:55 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=95 Content-Length 315 Content-Type text/html; charset=iso-8859-1
GET H/1.1	200 OK	vendor.min-20200819.js Show response sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/3106537259390369587392596505873172430317896856/js/	175 KB 175 KB	281ms 94ms	Script application/javascript	51.161.195.75 OVH
General Check archive.org Show headers Download Go to Full URL https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/3106537259390369587392596505873172430317896856/js/vendor.min-20200819.js Requested by Host: sbbschweizcff95491.site URL: https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/3106537259390369587392596505873172430317896856/4840690888839962659940535633901911474397153379.html?ID-connect?q=df&ehome&j-oin-us.x=9aecf085bf8a8644fe2ffcc2b333cd9e9aecf085bf8a8644fe2ffcc2b333cd9e Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 51.161.195.75 Sydney, Australia, ASN16276 (OVH, FR), Reverse DNS ip75.ip-51-161-195.net Software Apache / Resource Hash `6a05eed749c5f3d8ef53a0acdb775d5a7ca3009961b154278193c933eb290adb` Request headers accept-language en-AU,en;q=0.9 Referer https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/3106537259390369587392596505873172430317896856/4840690888839962659940535633901911474397153379.html?ID-connect?q=df&ehome&j-oin-us.x=9aecf085bf8a8644fe2ffcc2b333cd9e9aecf085bf8a8644fe2ffcc2b333cd9e User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 Response headers Date Mon, 19 Jun 2023 06:55:55 GMT Last-Modified Mon, 19 Jun 2023 06:55:54 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 179210
GET H/1.1	200 OK	swisspass.min-20200819.js Show response sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/3106537259390369587392596505873172430317896856/js/	97 KB 97 KB	282ms 95ms	Script application/javascript	51.161.195.75 OVH
General Check archive.org Show headers Download Go to Full URL https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/3106537259390369587392596505873172430317896856/js/swisspass.min-20200819.js Requested by Host: sbbschweizcff95491.site URL: https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/3106537259390369587392596505873172430317896856/4840690888839962659940535633901911474397153379.html?ID-connect?q=df&ehome&j-oin-us.x=9aecf085bf8a8644fe2ffcc2b333cd9e9aecf085bf8a8644fe2ffcc2b333cd9e Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 51.161.195.75 Sydney, Australia, ASN16276 (OVH, FR), Reverse DNS ip75.ip-51-161-195.net Software Apache / Resource Hash `dc05ae0c2d9559cbded759dc8963648ca25c0f8ab7549c0530662bba1d73c389` Request headers accept-language en-AU,en;q=0.9 Referer https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/3106537259390369587392596505873172430317896856/4840690888839962659940535633901911474397153379.html?ID-connect?q=df&ehome&j-oin-us.x=9aecf085bf8a8644fe2ffcc2b333cd9e9aecf085bf8a8644fe2ffcc2b333cd9e User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 Response headers Date Mon, 19 Jun 2023 06:55:55 GMT Last-Modified Mon, 19 Jun 2023 06:55:54 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 99324
GET H2	200	SBBWeb-Light.woff2 cdn.app.sbb.ch/fonts/v1_6_subset/	14 KB 14 KB	1025ms 338ms	Font application/font-woff2	18.185.155.127 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.app.sbb.ch/fonts/v1_6_subset/SBBWeb-Light.woff2 Requested by Host: sbbschweizcff95491.site URL: https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/3106537259390369587392596505873172430317896856/css/sso.min-20200819.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.185.155.127 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-185-155-127.eu-central-1.compute.amazonaws.com Software nginx/1.23.2 / Resource Hash `5c7f0e173844556da7ca5eb8936fa3dab1c00206960920a49a1eea9cde2bfaaf` Request headers Referer https://sbbschweizcff95491.site/ Origin https://sbbschweizcff95491.site accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 Response headers date Mon, 19 Jun 2023 06:55:56 GMT content-encoding br last-modified Fri, 17 Dec 2021 15:16:26 GMT server nginx/1.23.2 etag W/"61bca9ca-3784" vary Accept-Encoding access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS content-type application/font-woff2 access-control-allow-origin * cache-control max-age=31536000, public, private access-control-allow-credentials true access-control-allow-headers Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With expires Tue, 18 Jun 2024 06:55:56 GMT
GET H/1.1	200 OK	icomoon.woff2 sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/3106537259390369587392596505873172430317896856/css/fonts/	7 KB 7 KB	94ms 94ms	Font font/woff2	51.161.195.75 OVH
General Check archive.org Show headers Download Go to Full URL https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/3106537259390369587392596505873172430317896856/css/fonts/icomoon.woff2?7m5yri Requested by Host: sbbschweizcff95491.site URL: https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/3106537259390369587392596505873172430317896856/css/sso.min-20200819.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 51.161.195.75 Sydney, Australia, ASN16276 (OVH, FR), Reverse DNS ip75.ip-51-161-195.net Software Apache / Resource Hash `45b8f30ef99295a0d738416e4e5af9fa2dd41619499622c2c57416580fc7197b` Request headers Referer https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/3106537259390369587392596505873172430317896856/css/sso.min-20200819.css Origin https://sbbschweizcff95491.site accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 Response headers Date Mon, 19 Jun 2023 06:55:55 GMT Last-Modified Mon, 19 Jun 2023 06:55:54 GMT Server Apache Content-Type font/woff2 Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 6944

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Schweizerische Bundesbahnen (Transportation)

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			sbbschweizcff95491.site/	1969-12-31 23:59:59	Name: PHPSESSID Value: bfc988775336c89443866a13597247bb

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://sbbschweizcff95491.site/2382594646452107368226740404896144218193785778/SBB-CFF-E16647/3106537259390369587392596505873172430317896856/loader-20200819.png Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.app.sbb.ch
sbbschweizcff95491.site
18.185.155.127
51.161.195.75
074b4a971662a5dd8b994ce9eaaff35a3c09d57479af13bd8e1ed4e528b1af53
24bf4739e8260a99a57530510fe6cd7d756783abc73d3c599b32300460b2aa07
24f31a4afb4d98c85b6cff4c9a953654a77986d6c4c9e9cae52cf57e59095e01
3397660196a35ebb826091bedd3ec322aa58c0e9c4e439eb17d0db3f0259cb9c
45b8f30ef99295a0d738416e4e5af9fa2dd41619499622c2c57416580fc7197b
5c7f0e173844556da7ca5eb8936fa3dab1c00206960920a49a1eea9cde2bfaaf
6a05eed749c5f3d8ef53a0acdb775d5a7ca3009961b154278193c933eb290adb
a2db652494b35d78ba0eaafbec382d055662e735380b03e5d8e78db7c751df64
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
dc05ae0c2d9559cbded759dc8963648ca25c0f8ab7549c0530662bba1d73c389
e0f4424a0cfc4143868873503307ca73dd8011e931f21e2d90e018cecf2b8e20

sbbschweizcff95491.site Open in urlscan Pro 51.161.195.75 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

11 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

681 kBTransfer

678 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

17 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

sbbschweizcff95491.site Open in urlscan Pro
51.161.195.75 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

681 kB
Transfer

678 kB
Size

1
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!