b501587e0a.nxcli.io
Open in
urlscan Pro
199.189.225.122
Malicious Activity!
Public Scan
URL:
https://b501587e0a.nxcli.io/rechnung/
Submission: On August 13 via automatic, source openphish — Scanned from DE
Submission: On August 13 via automatic, source openphish — Scanned from DE
Summary
This website contacted 2 IPs
in 1 countries
across 2 domains to perform 22 HTTP transactions.
The main IP is 199.189.225.122, located in
United States and
belongs to LIQUIDWEB, US.
The main domain is b501587e0a.nxcli.io.
TLS certificate: Issued by R11 on August 13th 2024. Valid for: 3 months.
This is the only time b501587e0a.nxcli.io was scanned on urlscan.io!
TLS certificate: Issued by R11 on August 13th 2024. Valid for: 3 months.
This is the only time b501587e0a.nxcli.io was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Swisscom (Telecommunication)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 21 | 199.189.225.122 199.189.225.122 | 32244 (LIQUIDWEB) (LIQUIDWEB) | |
| 22 | 2 |
21
199.189.225.122
(United States)
ASN32244 (LIQUIDWEB, US)
PTR: cloudhost-10344724.us-midwest-2.nxcli.net
ASN32244 (LIQUIDWEB, US)
PTR: cloudhost-10344724.us-midwest-2.nxcli.net
| b501587e0a.nxcli.io |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 21 |
nxcli.io
b501587e0a.nxcli.io |
464 KB |
| 0 |
Failed
function sub() { [native code] }. Failed |
|
| 22 | 2 |
| Domain | Requested by | |
|---|---|---|
| 21 | b501587e0a.nxcli.io |
b501587e0a.nxcli.io
|
| 0 | invalid Failed |
b501587e0a.nxcli.io
|
| 22 | 2 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| swisscom.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| b501587e0a.nxcli.io R11 |
2024-08-13 - 2024-11-11 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://b501587e0a.nxcli.io/rechnung/
Frame ID: 0D4FEC6EC43A7DCA9C032485AE78C4DD
Requests: 22 HTTP requests in this frame
1 Outgoing links
These are links going to different origins than the main page.
URL: https://swisscom.com/login-hilfe
Title: Über Swisscom Anmeldung
Title: Über Swisscom Anmeldung
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
22 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
/
b501587e0a.nxcli.io/rechnung/ |
16 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
commons-9fbd2472e09932d4f4af29e5bf2e8a3b.css
b501587e0a.nxcli.io/rechnung/assets/ |
460 KB 61 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
username-fa6d102d6372f230a60c0776f6a8ca43.css
b501587e0a.nxcli.io/rechnung/assets/ |
310 B 318 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
/
invalid/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
swisscom-logo-lifeform-38be0de766af1aaa475f946c32b47944.svg
b501587e0a.nxcli.io/rechnung/assets/ |
6 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
commons.bundle-c4cc2085bfe34c15cfa907eecf723c07.js
b501587e0a.nxcli.io/rechnung/assets/ |
317 KB 91 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
login-layout.bundle-042dfd4c798b854eb14823831f796dfa.js
b501587e0a.nxcli.io/rechnung/assets/ |
7 KB 3 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
username.bundle-4f06dd16ae6035161554f3b7d98c2439.js
b501587e0a.nxcli.io/rechnung/assets/ |
3 KB 1 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
lifeform-spritesheet-db5b9234be03de8612bb31c38e09fcf7.png
b501587e0a.nxcli.io/rechnung/assets/ |
38 KB 38 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
TheSansB_700_-7dac4ba6f5bfb4ba199e7fe3454a6780.woff2
b501587e0a.nxcli.io/rechnung/assets/ |
48 KB 47 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
TheSansB_600_-a54202ef3bf0e3da19bca052e636ca9c.woff2
b501587e0a.nxcli.io/rechnung/assets/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
TheSansB_400_-4f0d59a18ca1c88dcfbbce6510b21da5.woff2
b501587e0a.nxcli.io/rechnung/assets/ |
50 KB 49 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
sdx-icons-62055c634c75de69ad240abe81da89a9.woff2
b501587e0a.nxcli.io/rechnung/assets/ |
76 KB 77 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
8628.bundle.js
b501587e0a.nxcli.io/rechnung/assets/ |
30 KB 12 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
4817.bundle.js
b501587e0a.nxcli.io/rechnung/assets/ |
58 KB 12 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
3363.bundle.js
b501587e0a.nxcli.io/rechnung/assets/ |
1 KB 554 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
7362.bundle.js
b501587e0a.nxcli.io/rechnung/assets/ |
25 KB 5 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
9213.bundle.js
b501587e0a.nxcli.io/rechnung/assets/ |
23 KB 4 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
4240.bundle.js
b501587e0a.nxcli.io/rechnung/assets/ |
16 KB 4 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
TheSansB_500_-d7955bec1417e0168f42adfe7ceaf8b5.woff2
b501587e0a.nxcli.io/rechnung/assets/ |
51 KB 50 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
TheSansB_600_-1a12a4e45d0f484435f06ff5f6379eb5.ttf
b501587e0a.nxcli.io/rechnung/assets/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
favicon.ico
b501587e0a.nxcli.io/rechnung/assets/ |
4 KB 2 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- invalid
- URL
- chrome-extension://invalid/
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Swisscom (Telecommunication)35 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| webpackChunklogin function| __extends function| __assign function| __rest function| __decorate function| __param function| __metadata function| __awaiter function| __generator function| __exportStar function| __createBinding function| __values function| __read function| __spread function| __spreadArrays function| __spreadArray function| __await function| __asyncGenerator function| __asyncDelegator function| __asyncValues function| __makeTemplateObject function| __importStar function| __importDefault function| __classPrivateFieldGet function| __classPrivateFieldSet function| __classPrivateFieldIn function| flatpickr object| sdx function| loginSdkClickContinue function| loginSdkGetCurrentPage function| loginSdkIsErrorMessageShown function| loginSdkSetUsername function| loginSdkSetUsernameFieldReadOnly function| loginSdkGetUsername function| btnClick0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
4 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
b501587e0a.nxcli.io
invalid
invalid
199.189.225.122
09525fb3b4747dfbceaa9401af3c089fae3aa045934b77ec444cfe62c0efd3da
1057dc80f9cd81707a72f2168177c1313f3d5c167b37ac9ead1cb9ff7c20dc24
111288b03ac39c556614a53affb70c3058d2cc3ccfb34bf3707c236446ed1602
2b39bb562a09516cfcd4140902f76552383061509948eac5fb6d46c698269a85
330fddfd254cb42deebdac50ccbc6d9988d365378457fae29dc10b3c2edb43e4
33378d64ea729ba7e9b88800b05742916fd577806182fc87f01a4177069cce78
51e018d8b91c8818b60d691d858ae8545f1c43f7963d2f22fadf45a395bd5636
6010e95e45ae8c7c0064724e1ea3ac9495ae55a6241633446db052364c06f5f3
67db3f64ddd5ec31350e71ccab4187675a6e71ce177e9e4c6e2602ba6e8205e4
74848c1887df61850b38fe52e4f1a73056cc6a69f4ec09b4b9368689a7ecdc6f
883aaf522a475a6736d4c994c177bd19d21ddabe5ee3e4292097579760ce9c89
88e7d504adfbbf095869aa2d9b0858af4d76276953bee52ad769641ea0ebfed3
903d29bb994ee6b716da4b7ae237ba8f6bf9a697fb65757aabffa3e5351553e9
cd310a8d15c3132a0bff5b362ca8839a4ed334561327520cbef337f286e40249
d8b6ed8687a497b1dfd1c8f9c7cd3c630b29ee638941f7652143a768da4529fe
dc0de3257086e956e5aa2d7da9039b3aa593d0e117c78afb86ab312c104656dc
f0cc4ee9dc83925f474ab0b5ed3a5395038c979e157d4bae8e67225f1b0922d8
f9adb57dca9cbd2514ed249714b613d65e78a81cadda2882679a9672c812d25e
fbaed6b321ef988e76822226561714453cfeda47da1972e1850d228e1d0f74c9