www.gomezcotta.com Open in urlscan Pro
2001:41d0:1:1b00:87:98:231:3 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.gomezcotta.com/index/swicom/
Effective URL:
https://www.gomezcotta.com/index/swicom/
Submission: On September 11 via automatic, source openphish (September 11th 2024, 2:16:03 pm UTC) — Scanned from ES

Summary HTTP 21 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 3 domains to perform 21 HTTP transactions. The main IP is 2001:41d0:1:1b00:87:98:231:3, located in France and belongs to OVH, FR. The main domain is www.gomezcotta.com.
TLS certificate: Issued by R11 on August 3rd 2024. Valid for: 3 months.

This is the only time www.gomezcotta.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Swisscom (Telecommunication)

Domain & IP information

	IP Address	AS Autonomous System
8	2001:41d0:1:1... 2001:41d0:1:1b00:87:98:231:3	16276 (OVH) (OVH)
3 6	104.21.233.197 104.21.233.197	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a02:a90:c400... 2a02:a90:c400:4001::7	3303 (SWISSCOM ...) (SWISSCOM Swisscom Switzerland Ltd)
21	4

8 2001:41d0:1:1b00:87:98:231:3 (France)

ASN16276 (OVH, FR)

www.gomezcotta.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 104.21.233.197 (None, ) 3 redirects

ASN13335 (CLOUDFLARENET, US)

zupimages.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.zupimages.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:a90:c400:4001::7 (Switzerland)

ASN3303 (SWISSCOM Swisscom Switzerland Ltd, CH)

login.scl.swisscom.ch	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	gomezcotta.com www.gomezcotta.com	59 KB
6	zupimages.net 3 redirects zupimages.net — Cisco Umbrella Rank: 140640 www.zupimages.net — Cisco Umbrella Rank: 171108	7 KB
1	swisscom.ch login.scl.swisscom.ch — Cisco Umbrella Rank: 583783	40 KB
21	3

	Domain	Requested by
8	www.gomezcotta.com	www.gomezcotta.com
3	www.zupimages.net	www.gomezcotta.com
3	zupimages.net	3 redirects
1	login.scl.swisscom.ch	www.gomezcotta.com
21	4

This site contains no links.

Subject Issuer	Validity	Valid
gomezcotta.com R11	`2024-08-03` - `2024-11-01`	3 months	crt.sh
login.scl.swisscom.ch SwissSign RSA TLS OV ICA 2022 - 1	`2024-02-13` - `2025-02-13`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.gomezcotta.com/index/swicom/
Frame ID: A3FA82B6A6BECB2EAF26D7F169C00BC4
Requests: 21 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Swisscom Login

Page URL History Show full URLs

http://www.gomezcotta.com/index/swicom/ HTTP 307
https://www.gomezcotta.com/index/swicom/ Page URL

Page Statistics

21
Requests

43 %
HTTPS

67 %
IPv6

3
Domains

4
Subdomains

4
IPs

3
Countries

105 kB
Transfer

413 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.gomezcotta.com/index/swicom/ HTTP 307
https://www.gomezcotta.com/index/swicom/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4

https://zupimages.net/up/22/18/jsx8.png HTTP 301
https://www.zupimages.net/up/22/18/jsx8.png

Request Chain 5

https://zupimages.net/up/22/19/zl6k.png HTTP 301
https://www.zupimages.net/up/22/19/zl6k.png

Request Chain 19

https://zupimages.net/up/22/19/r9dm.png HTTP 301
https://www.zupimages.net/up/22/19/r9dm.png

21 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
www.gomezcotta.com/index/swicom/
Redirect Chain

http://www.gomezcotta.com/index/swicom/
https://www.gomezcotta.com/index/swicom/

7 KB
3 KB

211ms
58ms

Document
text/html

2001:41d0:1:1b00:87:98:231:3
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://www.gomezcotta.com/index/swicom/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2001:41d0:1:1b00:87:98:231:3 , France, ASN16276 (OVH, FR),
Reverse DNS
Software: Apache / PHP/7.4
Resource Hash: 609eabc85950bc368927ad227bafcf74ececbcacd94feba83bf2295435ba7d94

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Wed, 11 Sep 2024 14:15:58 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/7.4

Redirect headers

Location: https://www.gomezcotta.com/index/swicom/
Non-Authoritative-Reason: HttpsUpgrades

GET
H2 200 commons-d5b596036e661ac38f22c70a7cd50323.css
www.gomezcotta.com/index/swicom/index_files/ 364 KB
55 KB 67ms
67ms Stylesheet
text/css 2001:41d0:1:1b00:87:98:231:3
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://www.gomezcotta.com/index/swicom/index_files/commons-d5b596036e661ac38f22c70a7cd50323.css
Requested by: Host: www.gomezcotta.com
URL: https://www.gomezcotta.com/index/swicom/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2001:41d0:1:1b00:87:98:231:3 , France, ASN16276 (OVH, FR),
Reverse DNS
Software: Apache /
Resource Hash: ad2eb9b7eae171b724fd8ecf0ae384de4580980df92cef676be1548fcd2c5dd4

Request headers

Referer: https://www.gomezcotta.com/index/swicom/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 11 Sep 2024 14:15:58 GMT
content-encoding: gzip
last-modified: Tue, 10 Sep 2024 22:29:17 GMT
server: Apache
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=900
accept-ranges: bytes
content-length: 56299
expires: Wed, 11 Sep 2024 14:30:58 GMT

GET
H2 200 username-18965c05ee0f844a4bb9fde6dfa6a0f2.css
www.gomezcotta.com/index/swicom/index_files/ 218 B
386 B 56ms
56ms Stylesheet
text/css 2001:41d0:1:1b00:87:98:231:3
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://www.gomezcotta.com/index/swicom/index_files/username-18965c05ee0f844a4bb9fde6dfa6a0f2.css
Requested by: Host: www.gomezcotta.com
URL: https://www.gomezcotta.com/index/swicom/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2001:41d0:1:1b00:87:98:231:3 , France, ASN16276 (OVH, FR),
Reverse DNS
Software: Apache /
Resource Hash: ef871a6fc64d3235225cf03da396ac7276fcaf902d799bc967eee7a5d6148b22

Request headers

Referer: https://www.gomezcotta.com/index/swicom/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 11 Sep 2024 14:15:58 GMT
content-encoding: gzip
last-modified: Tue, 10 Sep 2024 22:29:26 GMT
server: Apache
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=900
accept-ranges: bytes
content-length: 173
expires: Wed, 11 Sep 2024 14:30:58 GMT

GET
H2 500 webcomponents.esm-1f5f3d9c71b67350c64ec55c2acbadc3.js.t%C3%A9l%C3%A9chargement
www.gomezcotta.com/index/swicom/index_files/ 0
0 269ms
269ms Script
text/html 2001:41d0:1:1b00:87:98:231:3
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://www.gomezcotta.com/index/swicom/index_files/webcomponents.esm-1f5f3d9c71b67350c64ec55c2acbadc3.js.t%C3%A9l%C3%A9chargement
Requested by: Host: www.gomezcotta.com
URL: https://www.gomezcotta.com/index/swicom/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2001:41d0:1:1b00:87:98:231:3 , France, ASN16276 (OVH, FR),
Reverse DNS
Software: Apache / PHP/7.4
Resource Hash

Request headers

Referer: https://www.gomezcotta.com/index/swicom/
Origin: https://www.gomezcotta.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 11 Sep 2024 14:15:58 GMT
server: Apache
x-powered-by: PHP/7.4
content-type: text/html; charset=UTF-8

GET
H2 200 webmail_logo.png
www.gomezcotta.com/index/swicom/index_files/ 562 B
741 B 60ms
60ms Image
image/png 2001:41d0:1:1b00:87:98:231:3
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.gomezcotta.com/index/swicom/index_files/webmail_logo.png
Requested by: Host: www.gomezcotta.com
URL: https://www.gomezcotta.com/index/swicom/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2001:41d0:1:1b00:87:98:231:3 , France, ASN16276 (OVH, FR),
Reverse DNS
Software: Apache /
Resource Hash: f07b8927a11190e0d9988dd003bb5079a5905678ad8951eb424ab7c71dcaba33

Request headers

Referer: https://www.gomezcotta.com/index/swicom/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 11 Sep 2024 14:15:58 GMT
last-modified: Tue, 10 Sep 2024 22:29:33 GMT
server: Apache
content-type: image/png
cache-control: max-age=900
accept-ranges: bytes
content-length: 562
expires: Wed, 11 Sep 2024 14:30:58 GMT

GET
H3

200

jsx8.png
www.zupimages.net/up/22/18/
Redirect Chain

https://zupimages.net/up/22/18/jsx8.png
https://www.zupimages.net/up/22/18/jsx8.png

946 B
1 KB

51ms
51ms

Image
image/png

104.21.233.197
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.zupimages.net/up/22/18/jsx8.png

Requested by

Host: www.gomezcotta.com
URL: https://www.gomezcotta.com/index/swicom/

Protocol

Server

104.21.233.197 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f974ce31c6ace01e0f69069b5a040ed7e856974be629f3dfaf844f23ab4a2efd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.gomezcotta.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 11 Sep 2024 14:15:58 GMT
strict-transport-security: max-age=15768000
cf-cache-status: HIT
last-modified: Wed, 11 Sep 2024 13:21:12 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3038
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vaugMVD4qZR6N8WmsJYIdhhKnDXK8Aow40SLz8l5kJw%2FOvl9Nf9zhStEqN9aIjMRFWEskMZ5Hy9TeNCzO1lsWUL%2FcojuCMVubcfEYQr6toxgbmX%2BJeBNzgvIaDyiNmU%2BQbgjwg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2678400
content-disposition: filename="jsx8.png"
cf-ray: 8c1845e14e685e26-MAD
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block

Redirect headers

date: Wed, 11 Sep 2024 14:15:58 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=048wW2PnD5rONPrNN4g9IPmR0FWd7GoB1ojx5BC%2Ftem7yUffvLricH81UNPORL8nv7hSpeo4v0WLXUWcZrC62SjEwaNO4Ru%2BwTfCGEnOHXs1IuZ1CqW9n4F7bquZ5Ita"}],"group":"cf-nel","max_age":604800}
content-type: text/html
location: https://www.zupimages.net/up/22/18/jsx8.png
cache-control: max-age=3600
cf-ray: 8c1845e0cdec5e26-MAD
alt-svc: h3=":443"; ma=86400
content-length: 167
expires: Wed, 11 Sep 2024 15:15:58 GMT

GET
H3

200

zl6k.png
www.zupimages.net/up/22/19/
Redirect Chain

https://zupimages.net/up/22/19/zl6k.png
https://www.zupimages.net/up/22/19/zl6k.png

759 B
1 KB

68ms
52ms

Image
image/png

104.21.233.197
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.zupimages.net/up/22/19/zl6k.png

Requested by

Host: www.gomezcotta.com
URL: https://www.gomezcotta.com/index/swicom/

Protocol

Server

104.21.233.197 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc6e583306e31702a329f953bebef01332b457bac82dd28e51cd3095e2a06d83

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.gomezcotta.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 11 Sep 2024 14:15:58 GMT
strict-transport-security: max-age=15768000
cf-cache-status: HIT
last-modified: Wed, 11 Sep 2024 13:21:12 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3038
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j8vAEgvl%2Fg661xOTAIvWCWag%2FsoZ4wA42iVSXXUCDwpyeksOT0oly2evZLfsWjMQ37GVJ%2BgPJKVzzQjHBqfb35E2NC5UruGuHN9%2BTOto67Y%2BFTWidLKBx%2B5raIJ5%2BqkppwMQWg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2678400
content-disposition: filename="zl6k.png"
cf-ray: 8c1845e12e4c5e26-MAD
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block

Redirect headers

date: Wed, 11 Sep 2024 14:15:58 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BfCMLAkaRncTr4N0atvVs6gcqoRlZxqfySAVLjWrohyVOozJCqTfLYj4FeVziRwg2uKKQE2RR8Uff%2FvtJV2cVgznfg9j0cyuOoxy7ZJ5nFEKqP7WmSFte2FW0c%2F7WbPP"}],"group":"cf-nel","max_age":604800}
content-type: text/html
location: https://www.zupimages.net/up/22/19/zl6k.png
cache-control: max-age=3600
cf-ray: 8c1845e0cde55e26-MAD
alt-svc: h3=":443"; ma=86400
content-length: 167
expires: Wed, 11 Sep 2024 15:15:58 GMT

GET
H2 500 commons.bundle-2538c7403a35e5210ba22639e7ea5da1.js.t%C3%A9l%C3%A9chargement
www.gomezcotta.com/index/swicom/index_files/ 0
0 268ms
267ms Script
text/html 2001:41d0:1:1b00:87:98:231:3
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://www.gomezcotta.com/index/swicom/index_files/commons.bundle-2538c7403a35e5210ba22639e7ea5da1.js.t%C3%A9l%C3%A9chargement
Requested by: Host: www.gomezcotta.com
URL: https://www.gomezcotta.com/index/swicom/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2001:41d0:1:1b00:87:98:231:3 , France, ASN16276 (OVH, FR),
Reverse DNS
Software: Apache / PHP/7.4
Resource Hash

Request headers

Referer: https://www.gomezcotta.com/index/swicom/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 11 Sep 2024 14:15:59 GMT
server: Apache
x-powered-by: PHP/7.4
content-type: text/html; charset=UTF-8

GET
H2 500 login-layout.bundle-0ffae2a40defd1bb5020c2f27d2c420d.js.t%C3%A9l%C3%A9chargement
www.gomezcotta.com/index/swicom/index_files/ 0
0 265ms
265ms Script
text/html 2001:41d0:1:1b00:87:98:231:3
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://www.gomezcotta.com/index/swicom/index_files/login-layout.bundle-0ffae2a40defd1bb5020c2f27d2c420d.js.t%C3%A9l%C3%A9chargement
Requested by: Host: www.gomezcotta.com
URL: https://www.gomezcotta.com/index/swicom/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2001:41d0:1:1b00:87:98:231:3 , France, ASN16276 (OVH, FR),
Reverse DNS
Software: Apache / PHP/7.4
Resource Hash

Request headers

Referer: https://www.gomezcotta.com/index/swicom/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 11 Sep 2024 14:15:59 GMT
server: Apache
x-powered-by: PHP/7.4
content-type: text/html; charset=UTF-8

GET
H2 500 username.bundle-bbb6eb130f6bd8f1ed56bc3c6520a305.js.t%C3%A9l%C3%A9chargement
www.gomezcotta.com/index/swicom/index_files/ 0
0 282ms
282ms Script
text/html 2001:41d0:1:1b00:87:98:231:3
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://www.gomezcotta.com/index/swicom/index_files/username.bundle-bbb6eb130f6bd8f1ed56bc3c6520a305.js.t%C3%A9l%C3%A9chargement
Requested by: Host: www.gomezcotta.com
URL: https://www.gomezcotta.com/index/swicom/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2001:41d0:1:1b00:87:98:231:3 , France, ASN16276 (OVH, FR),
Reverse DNS
Software: Apache / PHP/7.4
Resource Hash

Request headers

Referer: https://www.gomezcotta.com/index/swicom/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 11 Sep 2024 14:15:59 GMT
server: Apache
x-powered-by: PHP/7.4
content-type: text/html; charset=UTF-8

GET
H/1.1 200
OK lifeform-spritesheet-db5b9234be03de8612bb31c38e09fcf7.png
login.scl.swisscom.ch/ 38 KB
40 KB 288ms
113ms Image
image/png 2a02:a90:c400:4001::7
SWISSCOM Swisscom...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://login.scl.swisscom.ch/lifeform-spritesheet-db5b9234be03de8612bb31c38e09fcf7.png

Requested by

Host: www.gomezcotta.com
URL: https://www.gomezcotta.com/index/swicom/index_files/commons-d5b596036e661ac38f22c70a7cd50323.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2a02:a90:c400:4001::7 , Switzerland, ASN3303 (SWISSCOM Swisscom Switzerland Ltd, CH),

Reverse DNS

Software

Resource Hash

f9adb57dca9cbd2514ed249714b613d65e78a81cadda2882679a9672c812d25e

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.gomezcotta.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Wed, 11 Sep 2024 14:15:59 GMT
Strict-Transport-Security: max-age=16070400; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy-Report-Only: default-src 'none'; script-src 'self' 'unsafe-eval' 'nonce-gRn_f-8IsMYFupXuhD8n4PN5dqcGUKW4lIbvCStgnTA=' 'strict-dynamic' https://r7s.scl.swisscom.ch https://*.online-metrix.net; style-src 'self' 'nonce-gRn_f-8IsMYFupXuhD8n4PN5dqcGUKW4lIbvCStgnTA=' https://r7s.scl.swisscom.ch https://*.online-metrix.net; frame-src 'self' https://r7s.scl.swisscom.ch https://*.online-metrix.net; frame-ancestors 'self'; connect-src 'self' https://r7s.scl.swisscom.ch https://*.online-metrix.net wss://127.0.0.1:*; font-src 'self' data:; img-src 'self' https://*.swisscom.ch https://r7s.scl.swisscom.ch https://*.online-metrix.net; base-uri 'self'; report-uri /csp-violation-reports; report-to default
Content-Length: 38448
X-Xss-Protection: 0
X-Application-Context: login
Referrer-Policy: strict-origin-when-cross-origin
Last-Modified: Thu, 22 Aug 2024 09:51:28 GMT
Etag: W/"db5b9234be03de8612bb31c38e09fcf7"
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Report-To: {"group":"default","max_age":31536000,"endpoints":[{"url":"/csp-violation-reports"}],"include_subdomains":true}
Content-Type: image/png
X-Frame-Options: DENY
X-Vcap-Request-Id: 33b5155a-9d94-4e11-6634-0a177ddd0fba
Cache-Control: max-age=604800
Permissions-Policy: accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), fullscreen=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), web-share=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), hid=(), idle-detection=(), serial=(), window-placement=()
Accept-Ranges: bytes

GET TheSansB_700_-7dac4ba6f5bfb4ba199e7fe3454a6780.woff2
login.scl.swisscom.ch/ 0
0

GET TheSansB_400_-4f0d59a18ca1c88dcfbbce6510b21da5.woff2
login.scl.swisscom.ch/ 0
0

GET TheSansB_300_-725d06aefcb68dc767cf1bc91d7b5c1e.woff2
login.scl.swisscom.ch/ 0
0

GET TheSansB_400_-f5ebe8b3d957cb3898cdfcd302368b82.woff
login.scl.swisscom.ch/ 0
0

GET TheSansB_700_-12f304077148a6519764ab53cef73e8a.woff
login.scl.swisscom.ch/ 0
0

GET TheSansB_300_-241175cc22247923e2aa4702856fa27e.woff
login.scl.swisscom.ch/ 0
0

GET TheSansB_400_-4bbcd055023eeb44538a47d343e0966f.ttf
login.scl.swisscom.ch/ 0
0

GET TheSansB_700_-389285ef4123a6da054df3bf191c4c25.ttf
login.scl.swisscom.ch/ 0
0

GET TheSansB_300_-ea4a24d490218e110e072acdf4832f9a.ttf
login.scl.swisscom.ch/ 0
0

GET
H3

200

r9dm.png
www.zupimages.net/up/22/19/
Redirect Chain

https://zupimages.net/up/22/19/r9dm.png
https://www.zupimages.net/up/22/19/r9dm.png

2 KB
3 KB

54ms
54ms

Other
image/png

104.21.233.197
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zupimages.net/up/22/19/r9dm.png

Protocol

Server

104.21.233.197 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fdf1826e415840b112388f45af496a2b888e25cc0ac88d2704c7192cf40f120e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.gomezcotta.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 11 Sep 2024 14:15:59 GMT
strict-transport-security: max-age=15768000
cf-cache-status: HIT
last-modified: Wed, 11 Sep 2024 11:49:53 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3039
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=w71TkX8%2FL3HWxYeLhk0bEr1qW0YY%2BNJS28LAO%2BSGQ8iR9nbgtQkUBozOnjC2wagLHjOYKZLR254b4OXr%2BW3B2XAYFil4c0%2BdkAclV2reHJZbGyKitxqAZbtfji1tktdKnaLRMg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2678400
content-disposition: filename="r9dm.png"
cf-ray: 8c1845e5ebb95e26-MAD
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block

Redirect headers

date: Wed, 11 Sep 2024 14:15:59 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LFQw%2FTztYqpjvGK%2FePahfTRS%2BYPMOi2FZVBrscARZi16ffCL2YjQh4VoZmKInx2gVrqL4Nu84im8BexblJj%2BEYqjy7vCLvSqXigLf6%2BosoKJRuLgOQQGWPhD4gpIHvCR"}],"group":"cf-nel","max_age":604800}
content-type: text/html
location: https://www.zupimages.net/up/22/19/r9dm.png
cache-control: max-age=3600
cf-ray: 8c1845e59b4d5e26-MAD
alt-svc: h3=":443"; ma=86400
content-length: 167
expires: Wed, 11 Sep 2024 15:15:59 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: login.scl.swisscom.ch
URL: https://login.scl.swisscom.ch/TheSansB_700_-7dac4ba6f5bfb4ba199e7fe3454a6780.woff2

Domain: login.scl.swisscom.ch
URL: https://login.scl.swisscom.ch/TheSansB_400_-4f0d59a18ca1c88dcfbbce6510b21da5.woff2

Domain: login.scl.swisscom.ch
URL: https://login.scl.swisscom.ch/TheSansB_300_-725d06aefcb68dc767cf1bc91d7b5c1e.woff2

Domain: login.scl.swisscom.ch
URL: https://login.scl.swisscom.ch/TheSansB_400_-f5ebe8b3d957cb3898cdfcd302368b82.woff

Domain: login.scl.swisscom.ch
URL: https://login.scl.swisscom.ch/TheSansB_700_-12f304077148a6519764ab53cef73e8a.woff

Domain: login.scl.swisscom.ch
URL: https://login.scl.swisscom.ch/TheSansB_300_-241175cc22247923e2aa4702856fa27e.woff

Domain: login.scl.swisscom.ch
URL: https://login.scl.swisscom.ch/TheSansB_400_-4bbcd055023eeb44538a47d343e0966f.ttf

Domain: login.scl.swisscom.ch
URL: https://login.scl.swisscom.ch/TheSansB_700_-389285ef4123a6da054df3bf191c4c25.ttf

Domain: login.scl.swisscom.ch
URL: https://login.scl.swisscom.ch/TheSansB_300_-ea4a24d490218e110e072acdf4832f9a.ttf

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Swisscom (Telecommunication)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.gomezcotta.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: a3a714cde19b0807a7c7cffe5b470468

22 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://www.gomezcotta.com/index/swicom/index_files/webcomponents.esm-1f5f3d9c71b67350c64ec55c2acbadc3.js.t%C3%A9l%C3%A9chargement Message: Failed to load resource: the server responded with a status of 500 ()
network	error	URL: https://www.gomezcotta.com/index/swicom/index_files/login-layout.bundle-0ffae2a40defd1bb5020c2f27d2c420d.js.t%C3%A9l%C3%A9chargement Message: Failed to load resource: the server responded with a status of 500 ()
network	error	URL: https://www.gomezcotta.com/index/swicom/index_files/commons.bundle-2538c7403a35e5210ba22639e7ea5da1.js.t%C3%A9l%C3%A9chargement Message: Failed to load resource: the server responded with a status of 500 ()
network	error	URL: https://www.gomezcotta.com/index/swicom/index_files/username.bundle-bbb6eb130f6bd8f1ed56bc3c6520a305.js.t%C3%A9l%C3%A9chargement Message: Failed to load resource: the server responded with a status of 500 ()
javascript	error	URL: https://www.gomezcotta.com/index/swicom/ Message: Access to font at 'https://login.scl.swisscom.ch/TheSansB_400_-4f0d59a18ca1c88dcfbbce6510b21da5.woff2' from origin 'https://www.gomezcotta.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://login.scl.swisscom.ch/TheSansB_400_-4f0d59a18ca1c88dcfbbce6510b21da5.woff2 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://www.gomezcotta.com/index/swicom/ Message: Access to font at 'https://login.scl.swisscom.ch/TheSansB_700_-7dac4ba6f5bfb4ba199e7fe3454a6780.woff2' from origin 'https://www.gomezcotta.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://login.scl.swisscom.ch/TheSansB_700_-7dac4ba6f5bfb4ba199e7fe3454a6780.woff2 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://www.gomezcotta.com/index/swicom/ Message: Access to font at 'https://login.scl.swisscom.ch/TheSansB_300_-725d06aefcb68dc767cf1bc91d7b5c1e.woff2' from origin 'https://www.gomezcotta.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://login.scl.swisscom.ch/TheSansB_300_-725d06aefcb68dc767cf1bc91d7b5c1e.woff2 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://www.gomezcotta.com/index/swicom/ Message: Access to font at 'https://login.scl.swisscom.ch/TheSansB_400_-f5ebe8b3d957cb3898cdfcd302368b82.woff' from origin 'https://www.gomezcotta.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://login.scl.swisscom.ch/TheSansB_400_-f5ebe8b3d957cb3898cdfcd302368b82.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://www.gomezcotta.com/index/swicom/ Message: Access to font at 'https://login.scl.swisscom.ch/TheSansB_700_-12f304077148a6519764ab53cef73e8a.woff' from origin 'https://www.gomezcotta.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://login.scl.swisscom.ch/TheSansB_700_-12f304077148a6519764ab53cef73e8a.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://www.gomezcotta.com/index/swicom/ Message: Access to font at 'https://login.scl.swisscom.ch/TheSansB_300_-241175cc22247923e2aa4702856fa27e.woff' from origin 'https://www.gomezcotta.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://login.scl.swisscom.ch/TheSansB_300_-241175cc22247923e2aa4702856fa27e.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://www.gomezcotta.com/index/swicom/ Message: Access to font at 'https://login.scl.swisscom.ch/TheSansB_700_-389285ef4123a6da054df3bf191c4c25.ttf' from origin 'https://www.gomezcotta.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://login.scl.swisscom.ch/TheSansB_700_-389285ef4123a6da054df3bf191c4c25.ttf Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://www.gomezcotta.com/index/swicom/ Message: Access to font at 'https://login.scl.swisscom.ch/TheSansB_400_-4bbcd055023eeb44538a47d343e0966f.ttf' from origin 'https://www.gomezcotta.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://login.scl.swisscom.ch/TheSansB_400_-4bbcd055023eeb44538a47d343e0966f.ttf Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://www.gomezcotta.com/index/swicom/ Message: Access to font at 'https://login.scl.swisscom.ch/TheSansB_300_-ea4a24d490218e110e072acdf4832f9a.ttf' from origin 'https://www.gomezcotta.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://login.scl.swisscom.ch/TheSansB_300_-ea4a24d490218e110e072acdf4832f9a.ttf Message: Failed to load resource: net::ERR_FAILED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

login.scl.swisscom.ch
www.gomezcotta.com
www.zupimages.net
zupimages.net
login.scl.swisscom.ch
104.21.233.197
2001:41d0:1:1b00:87:98:231:3
2a02:a90:c400:4001::7
609eabc85950bc368927ad227bafcf74ececbcacd94feba83bf2295435ba7d94
ad2eb9b7eae171b724fd8ecf0ae384de4580980df92cef676be1548fcd2c5dd4
dc6e583306e31702a329f953bebef01332b457bac82dd28e51cd3095e2a06d83
ef871a6fc64d3235225cf03da396ac7276fcaf902d799bc967eee7a5d6148b22
f07b8927a11190e0d9988dd003bb5079a5905678ad8951eb424ab7c71dcaba33
f974ce31c6ace01e0f69069b5a040ed7e856974be629f3dfaf844f23ab4a2efd
f9adb57dca9cbd2514ed249714b613d65e78a81cadda2882679a9672c812d25e
fdf1826e415840b112388f45af496a2b888e25cc0ac88d2704c7192cf40f120e

www.gomezcotta.com Open in urlscan Pro 2001:41d0:1:1b00:87:98:231:3 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

21 Requests

43 %HTTPS

67 %IPv6

3 Domains

4 Subdomains

4 IPs

3 Countries

105 kBTransfer

413 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

21 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

1 Cookies

22 Console Messages

Indicators

www.gomezcotta.com Open in urlscan Pro
2001:41d0:1:1b00:87:98:231:3 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

21
Requests

43 %
HTTPS

67 %
IPv6

3
Domains

4
Subdomains

4
IPs

3
Countries

105 kB
Transfer

413 kB
Size

1
Cookies

21 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!