national.dediweb.ch
Open in
urlscan Pro
195.154.225.245
Malicious Activity!
Public Scan
URL:
https://national.dediweb.ch/ch/
Submission: On August 30 via automatic, source openphish — Scanned from CH
Submission: On August 30 via automatic, source openphish — Scanned from CH
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 13 HTTP transactions.
The main IP is 195.154.225.245, located in
France and
belongs to Online SAS, FR.
The main domain is national.dediweb.ch.
TLS certificate: Issued by R3 on August 20th 2023. Valid for: 3 months.
This is the only time national.dediweb.ch was scanned on urlscan.io!
TLS certificate: Issued by R3 on August 20th 2023. Valid for: 3 months.
This is the only time national.dediweb.ch was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Fedex (Transportation)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 13 | 195.154.225.245 195.154.225.245 | 12876 (Online SAS) (Online SAS) | |
| 13 | 1 |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 13 |
dediweb.ch
national.dediweb.ch |
191 KB |
| 13 | 1 |
| Domain | Requested by | |
|---|---|---|
| 13 | national.dediweb.ch |
national.dediweb.ch
|
| 13 | 1 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| *.national.dediweb.ch R3 |
2023-08-20 - 2023-11-18 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://national.dediweb.ch/ch/
Frame ID: 731CB926A7289072B95ACD8D1E152FF7
Requests: 13 HTTP requests in this frame
Screenshot
Page Title
FedEx CHDetected technologies
Bootstrap
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
13 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
national.dediweb.ch/ch/ |
9 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
plantilla_es.js.t%C3%A9l%C3%A9chargement
national.dediweb.ch/ch/files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
direccionPIBEE_es.js.t%C3%A9l%C3%A9chargement
national.dediweb.ch/ch/files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
keyBoard_es.js.t%C3%A9l%C3%A9chargement
national.dediweb.ch/ch/files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
desmigrados_es.js.t%C3%A9l%C3%A9chargement
national.dediweb.ch/ch/files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
cookie.js.t%C3%A9l%C3%A9chargement
national.dediweb.ch/ch/files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bootstrap.css
national.dediweb.ch/ch/files/ |
152 KB 152 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bootstrap-bbva.css
national.dediweb.ch/ch/files/ |
10 KB 10 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logo.png
national.dediweb.ch/ch/files/ |
18 KB 18 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
tracking.png
national.dediweb.ch/ch/files/ |
746 B 987 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
log.PNG
national.dediweb.ch/ch/files/ |
856 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery-1.11.3.min.js.t%C3%A9l%C3%A9chargement
national.dediweb.ch/ch/files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bootstrap.min.js.t%C3%A9l%C3%A9chargement
national.dediweb.ch/ch/files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Fedex (Transportation)1 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
7 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
national.dediweb.ch
195.154.225.245
5a364b620a79bd9695e3590f37fc8f8ac667920df940f9e30295479f1bcd0edd
763e188f1e83bd13e4090a379372ef1337ea18590a99cc1185049132c0ee5f21
83705b9f2f9d5cc862897ac5a07a897d6202599ae1f8b73f46bf2aed41f4bc52
a522687d8b152efdd12ccec781f54d91fa60de20408684f1ef41c1e672619c56
b6b3239a2c9d897d7f8349d89ccaa997b1104e3c5b9ba84cab64e38dca2d694a
e62da9ae104cdfd8d109a7e18fded7b4ae0c2946d32027d11bcc8cd5d232f36f