urlscan.io logo urlscan.io
SecurityTrails logo

eservice.cembra.ch.serviceid199814.xyz Open in urlscan Pro
193.32.161.73  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://eservice.cembra.ch.serviceid199814.xyz/cem.php
Effective URL: http://eservice.cembra.ch.serviceid199814.xyz/cembra/6d53a3fe7397a853869fe5fbd9b6e6e3/login/
Submission: On April 23 via automatic, source openphish
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 14 HTTP transactions. The main IP is 193.32.161.73, located in and belongs to STROYMASTER, RU. The main domain is eservice.cembra.ch.serviceid199814.xyz.
This is the only time eservice.cembra.ch.serviceid199814.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Cembra (Banking)

Domain & IP information

IP Address AS Autonomous System
3 17 193.32.161.73 50329 (STROYMASTER)
14 1
Apex Domain
Subdomains		 Transfer
17 serviceid199814.xyz
eservice.cembra.ch.serviceid199814.xyz
139 KB
14 1
Domain Requested by
17 eservice.cembra.ch.serviceid199814.xyz 3 redirects eservice.cembra.ch.serviceid199814.xyz
14 1

This site contains no links.

Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://eservice.cembra.ch.serviceid199814.xyz/cembra/6d53a3fe7397a853869fe5fbd9b6e6e3/login/
Frame ID: 5DFA638A954DD2BCA674090D604E2408
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://eservice.cembra.ch.serviceid199814.xyz/cem.php HTTP 302
    http://eservice.cembra.ch.serviceid199814.xyz/cembra/ Page URL
  2. http://eservice.cembra.ch.serviceid199814.xyz/cembra/6d53a3fe7397a853869fe5fbd9b6e6e3 HTTP 301
    http://eservice.cembra.ch.serviceid199814.xyz/cembra/6d53a3fe7397a853869fe5fbd9b6e6e3/ HTTP 302
    http://eservice.cembra.ch.serviceid199814.xyz/cembra/6d53a3fe7397a853869fe5fbd9b6e6e3/login/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i
Overall confidence: 100%
Detected patterns
  • headers server /Ubuntu/i
Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+font-awesome(?:\.min)?\.css/i
Overall confidence: 100%
Detected patterns
  • script /jquery.*\.js/i
  • env /^jQuery$/i

Page Statistics

14
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

138 kB
Transfer

293 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://eservice.cembra.ch.serviceid199814.xyz/cem.php HTTP 302
    http://eservice.cembra.ch.serviceid199814.xyz/cembra/ Page URL
  2. http://eservice.cembra.ch.serviceid199814.xyz/cembra/6d53a3fe7397a853869fe5fbd9b6e6e3 HTTP 301
    http://eservice.cembra.ch.serviceid199814.xyz/cembra/6d53a3fe7397a853869fe5fbd9b6e6e3/ HTTP 302
    http://eservice.cembra.ch.serviceid199814.xyz/cembra/6d53a3fe7397a853869fe5fbd9b6e6e3/login/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://eservice.cembra.ch.serviceid199814.xyz/cem.php HTTP 302
  • http://eservice.cembra.ch.serviceid199814.xyz/cembra/

14 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Cookie set /
eservice.cembra.ch.serviceid199814.xyz/cembra/
Redirect Chain
  • http://eservice.cembra.ch.serviceid199814.xyz/cem.php
  • http://eservice.cembra.ch.serviceid199814.xyz/cembra/
626 B
699 B 		Document
General
Check archive.org
Download Go to
Full URL
http://eservice.cembra.ch.serviceid199814.xyz/cembra/
Protocol
HTTP/1.1
Server
193.32.161.73 -, , ASN50329 (STROYMASTER, RU),
Reverse DNS
Software
nginx/1.4.6 (Ubuntu) /
Resource Hash
e11df31f9f3697b0a0478025cd93a807f361afab02aed3c3bc4ee5a2dacc32f9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options sameorigin

Request headers

Host
eservice.cembra.ch.serviceid199814.xyz
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Server
nginx/1.4.6 (Ubuntu)
Date
Tue, 23 Apr 2019 07:43:05 GMT
Content-Type
text/html
Content-Length
413
Connection
keep-alive
Set-Cookie
real=OK
Vary
Accept-Encoding
Content-Encoding
gzip
X-Content-Type-Options
nosniff
X-Frame-Options
sameorigin

Redirect headers

Server
nginx/1.4.6 (Ubuntu)
Date
Tue, 23 Apr 2019 07:43:04 GMT
Content-Type
text/html
Content-Length
0
Connection
keep-alive
Location
/cembra/
X-Content-Type-Options
nosniff
X-Frame-Options
sameorigin
Primary Request /
eservice.cembra.ch.serviceid199814.xyz/cembra/6d53a3fe7397a853869fe5fbd9b6e6e3/login/
Redirect Chain
  • http://eservice.cembra.ch.serviceid199814.xyz/cembra/6d53a3fe7397a853869fe5fbd9b6e6e3?
  • http://eservice.cembra.ch.serviceid199814.xyz/cembra/6d53a3fe7397a853869fe5fbd9b6e6e3/
  • http://eservice.cembra.ch.serviceid199814.xyz/cembra/6d53a3fe7397a853869fe5fbd9b6e6e3/login/?
8 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://eservice.cembra.ch.serviceid199814.xyz/cembra/6d53a3fe7397a853869fe5fbd9b6e6e3/login/?
Requested by
Host: eservice.cembra.ch.serviceid199814.xyz
URL: http://eservice.cembra.ch.serviceid199814.xyz/cembra/
Protocol
HTTP/1.1
Server
193.32.161.73 -, , ASN50329 (STROYMASTER, RU),
Reverse DNS
Software
nginx/1.4.6 (Ubuntu) /
Resource Hash
8593ed28744b518e43fe072f4af2b21a30f0d434ff4f8313386746f4e8693848
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options sameorigin

Request headers

Host
eservice.cembra.ch.serviceid199814.xyz
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
http://eservice.cembra.ch.serviceid199814.xyz/cembra/
Accept-Encoding
gzip, deflate
Cookie
bid=6d53a3fe7397a853869fe5fbd9b6e6e3; real=OK
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://eservice.cembra.ch.serviceid199814.xyz/cembra/

Response headers

Server
nginx/1.4.6 (Ubuntu)
Date
Tue, 23 Apr 2019 07:43:06 GMT
Content-Type
text/html
Content-Length
3319
Connection
keep-alive
Vary
Accept-Encoding
Content-Encoding
gzip
X-Content-Type-Options
nosniff
X-Frame-Options
sameorigin

Redirect headers

Server
nginx/1.4.6 (Ubuntu)
Date
Tue, 23 Apr 2019 07:43:06 GMT
Content-Type
text/html
Content-Length
0
Connection
keep-alive
Set-Cookie
bid=6d53a3fe7397a853869fe5fbd9b6e6e3
location
login/?
X-Content-Type-Options
nosniff
X-Frame-Options
sameorigin
jquery.min.js
eservice.cembra.ch.serviceid199814.xyz/cembra/bower_components/jquery/dist/ 		85 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://eservice.cembra.ch.serviceid199814.xyz/cembra/bower_components/jquery/dist/jquery.min.js
Requested by
Host: eservice.cembra.ch.serviceid199814.xyz
URL: http://eservice.cembra.ch.serviceid199814.xyz/cembra/6d53a3fe7397a853869fe5fbd9b6e6e3/login/?
Protocol
HTTP/1.1
Server
193.32.161.73 -, , ASN50329 (STROYMASTER, RU),
Reverse DNS
Software
nginx/1.4.6 (Ubuntu) /
Resource Hash
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options sameorigin

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
eservice.cembra.ch.serviceid199814.xyz
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
http://eservice.cembra.ch.serviceid199814.xyz/cembra/6d53a3fe7397a853869fe5fbd9b6e6e3/login/?
Cookie
real=OK
Connection
keep-alive
Cache-Control
no-cache
Referer
http://eservice.cembra.ch.serviceid199814.xyz/cembra/6d53a3fe7397a853869fe5fbd9b6e6e3/login/?
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 23 Apr 2019 07:43:06 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Mon, 05 Jun 2017 03:55:06 GMT
Server
nginx/1.4.6 (Ubuntu)
ETag
"15283-5512e77ee3a80-gzip"
X-Frame-Options
sameorigin
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Vary
Accept-Encoding
Content-Length
30138
ua-parser.min.js
eservice.cembra.ch.serviceid199814.xyz/cembra/bower_components/ua-parser-js/dist/ 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://eservice.cembra.ch.serviceid199814.xyz/cembra/bower_components/ua-parser-js/dist/ua-parser.min.js
Requested by
Host: eservice.cembra.ch.serviceid199814.xyz
URL: http://eservice.cembra.ch.serviceid199814.xyz/cembra/6d53a3fe7397a853869fe5fbd9b6e6e3/login/?
Protocol
HTTP/1.1
Server
193.32.161.73 -, , ASN50329 (STROYMASTER, RU),
Reverse DNS
Software
nginx/1.4.6 (Ubuntu) /
Resource Hash
0fda30cf243e7650bf3e1666eddeb4fbba6b788ede36753eda5e2964cc14c896
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options sameorigin

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
eservice.cembra.ch.serviceid199814.xyz
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
http://eservice.cembra.ch.serviceid199814.xyz/cembra/6d53a3fe7397a853869fe5fbd9b6e6e3/login/?
Cookie
real=OK
Connection
keep-alive
Cache-Control
no-cache
Referer
http://eservice.cembra.ch.serviceid199814.xyz/cembra/6d53a3fe7397a853869fe5fbd9b6e6e3/login/?
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 23 Apr 2019 07:43:06 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Thu, 12 Oct 2017 08:16:24 GMT
Server
nginx/1.4.6 (Ubuntu)
ETag
"4298-55b5527f0e600-gzip"
X-Frame-Options
sameorigin
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Vary
Accept-Encoding
Content-Length
6063
font-awesome.min.css
eservice.cembra.ch.serviceid199814.xyz/cembra/bower_components/font-awesome/css/ 		30 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://eservice.cembra.ch.serviceid199814.xyz/cembra/bower_components/font-awesome/css/font-awesome.min.css
Requested by
Host: eservice.cembra.ch.serviceid199814.xyz
URL: http://eservice.cembra.ch.serviceid199814.xyz/cembra/6d53a3fe7397a853869fe5fbd9b6e6e3/login/?
Protocol
HTTP/1.1
Server
193.32.161.73 -, , ASN50329 (STROYMASTER, RU),
Reverse DNS
Software
nginx/1.4.6 (Ubuntu) /
Resource Hash
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options sameorigin

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
eservice.cembra.ch.serviceid199814.xyz
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://eservice.cembra.ch.serviceid199814.xyz/cembra/6d53a3fe7397a853869fe5fbd9b6e6e3/login/?
Cookie
real=OK
Connection
keep-alive
Cache-Control
no-cache
Referer
http://eservice.cembra.ch.serviceid199814.xyz/cembra/6d53a3fe7397a853869fe5fbd9b6e6e3/login/?
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 23 Apr 2019 07:43:06 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Sun, 09 Apr 2017 04:29:24 GMT
Server
nginx/1.4.6 (Ubuntu)
ETag
"7918-54cb44da47100-gzip"
X-Frame-Options
sameorigin
Content-Type
text/css
Connection
keep-alive
Accept-Ranges
bytes
Vary
Accept-Encoding
Content-Length
7053
core_form.js
eservice.cembra.ch.serviceid199814.xyz/cembra/core/form/ 		13 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://eservice.cembra.ch.serviceid199814.xyz/cembra/core/form/core_form.js
Requested by
Host: eservice.cembra.ch.serviceid199814.xyz
URL: http://eservice.cembra.ch.serviceid199814.xyz/cembra/6d53a3fe7397a853869fe5fbd9b6e6e3/login/?
Protocol
HTTP/1.1
Server
193.32.161.73 -, , ASN50329 (STROYMASTER, RU),
Reverse DNS
Software
nginx/1.4.6 (Ubuntu) /
Resource Hash
fc3912b3289c2b0d7969cc6f482aa6357b39e9af52786240d0087fa8badfbfb4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options sameorigin

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
eservice.cembra.ch.serviceid199814.xyz
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
http://eservice.cembra.ch.serviceid199814.xyz/cembra/6d53a3fe7397a853869fe5fbd9b6e6e3/login/?
Cookie
real=OK
Connection
keep-alive
Cache-Control
no-cache
Referer
http://eservice.cembra.ch.serviceid199814.xyz/cembra/6d53a3fe7397a853869fe5fbd9b6e6e3/login/?
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 23 Apr 2019 07:43:06 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Mon, 15 Apr 2019 10:02:30 GMT
Server
nginx/1.4.6 (Ubuntu)
ETag
"339a-5868ec01a9980-gzip"
X-Frame-Options
sameorigin
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Vary
Accept-Encoding
Content-Length
3393
core_form.css
eservice.cembra.ch.serviceid199814.xyz/cembra/core/form/ 		123 B
440 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://eservice.cembra.ch.serviceid199814.xyz/cembra/core/form/core_form.css
Requested by
Host: eservice.cembra.ch.serviceid199814.xyz
URL: http://eservice.cembra.ch.serviceid199814.xyz/cembra/6d53a3fe7397a853869fe5fbd9b6e6e3/login/?
Protocol
HTTP/1.1
Server
193.32.161.73 -, , ASN50329 (STROYMASTER, RU),
Reverse DNS
Software
nginx/1.4.6 (Ubuntu) /
Resource Hash
25f1028ab83ced059823685b557d4c4be3bae2cc31095f71c12b8752cecdf874
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options sameorigin

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
eservice.cembra.ch.serviceid199814.xyz
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://eservice.cembra.ch.serviceid199814.xyz/cembra/6d53a3fe7397a853869fe5fbd9b6e6e3/login/?
Cookie
real=OK
Connection
keep-alive
Cache-Control
no-cache
Referer
http://eservice.cembra.ch.serviceid199814.xyz/cembra/6d53a3fe7397a853869fe5fbd9b6e6e3/login/?
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 23 Apr 2019 07:43:06 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Tue, 08 Jan 2019 11:35:56 GMT
Server
nginx/1.4.6 (Ubuntu)
ETag
"7b-57ef0bfa3ff00-gzip"
X-Frame-Options
sameorigin
Content-Type
text/css
Connection
keep-alive
Accept-Ranges
bytes
Vary
Accept-Encoding
Content-Length
78
css.css
eservice.cembra.ch.serviceid199814.xyz/cembra/login/form/ 		0
308 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://eservice.cembra.ch.serviceid199814.xyz/cembra/login/form/css.css
Requested by
Host: eservice.cembra.ch.serviceid199814.xyz
URL: http://eservice.cembra.ch.serviceid199814.xyz/cembra/6d53a3fe7397a853869fe5fbd9b6e6e3/login/?
Protocol
HTTP/1.1
Server
193.32.161.73 -, , ASN50329 (STROYMASTER, RU),
Reverse DNS
Software
nginx/1.4.6 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options sameorigin

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
eservice.cembra.ch.serviceid199814.xyz
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://eservice.cembra.ch.serviceid199814.xyz/cembra/6d53a3fe7397a853869fe5fbd9b6e6e3/login/?
Cookie
real=OK
Connection
keep-alive
Cache-Control
no-cache
Referer
http://eservice.cembra.ch.serviceid199814.xyz/cembra/6d53a3fe7397a853869fe5fbd9b6e6e3/login/?
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 23 Apr 2019 07:43:06 GMT
X-Content-Type-Options
nosniff
Last-Modified
Tue, 08 Jan 2019 11:35:38 GMT
Server
nginx/1.4.6 (Ubuntu)
ETag
"0-57ef0be915680"
X-Frame-Options
sameorigin
Content-Type
text/css
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
0
index.css
eservice.cembra.ch.serviceid199814.xyz/cembra/login/ 		64 KB
11 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://eservice.cembra.ch.serviceid199814.xyz/cembra/login/index.css
Requested by
Host: eservice.cembra.ch.serviceid199814.xyz
URL: http://eservice.cembra.ch.serviceid199814.xyz/cembra/6d53a3fe7397a853869fe5fbd9b6e6e3/login/?
Protocol
HTTP/1.1
Server
193.32.161.73 -, , ASN50329 (STROYMASTER, RU),
Reverse DNS
Software
nginx/1.4.6 (Ubuntu) /
Resource Hash
4f48b41381ada5a2fe900c0d21469e7231980f76b4ce1f042b2775584d8f9218
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options sameorigin

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
eservice.cembra.ch.serviceid199814.xyz
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://eservice.cembra.ch.serviceid199814.xyz/cembra/6d53a3fe7397a853869fe5fbd9b6e6e3/login/?
Cookie
real=OK
Connection
keep-alive
Cache-Control
no-cache
Referer
http://eservice.cembra.ch.serviceid199814.xyz/cembra/6d53a3fe7397a853869fe5fbd9b6e6e3/login/?
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 23 Apr 2019 07:43:06 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Sun, 14 Apr 2019 20:07:56 GMT
Server
nginx/1.4.6 (Ubuntu)
ETag
"ffbf-586831775ff00-gzip"
X-Frame-Options
sameorigin
Content-Type
text/css
Connection
keep-alive
Accept-Ranges
bytes
Vary
Accept-Encoding
Content-Length
10513
form.js
eservice.cembra.ch.serviceid199814.xyz/cembra/login/form/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://eservice.cembra.ch.serviceid199814.xyz/cembra/login/form/form.js?v=5cbec1e93ee4b
Requested by
Host: eservice.cembra.ch.serviceid199814.xyz
URL: http://eservice.cembra.ch.serviceid199814.xyz/cembra/6d53a3fe7397a853869fe5fbd9b6e6e3/login/?
Protocol
HTTP/1.1
Server
193.32.161.73 -, , ASN50329 (STROYMASTER, RU),
Reverse DNS
Software
nginx/1.4.6 (Ubuntu) /
Resource Hash
3313adfd96cd1f18e33c56cb79dc695984137a64d16795f48b35802c4275d7f3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options sameorigin

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
eservice.cembra.ch.serviceid199814.xyz
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
http://eservice.cembra.ch.serviceid199814.xyz/cembra/6d53a3fe7397a853869fe5fbd9b6e6e3/login/?
Cookie
real=OK
Connection
keep-alive
Cache-Control
no-cache
Referer
http://eservice.cembra.ch.serviceid199814.xyz/cembra/6d53a3fe7397a853869fe5fbd9b6e6e3/login/?
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 23 Apr 2019 07:43:06 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Mon, 15 Apr 2019 09:59:10 GMT
Server
nginx/1.4.6 (Ubuntu)
ETag
"dcf-5868eb42ed780-gzip"
X-Frame-Options
sameorigin
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Vary
Accept-Encoding
Content-Length
954
cembra-money-bank.jpg
eservice.cembra.ch.serviceid199814.xyz/cembra/login/ 		6 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://eservice.cembra.ch.serviceid199814.xyz/cembra/login/cembra-money-bank.jpg
Requested by
Host: eservice.cembra.ch.serviceid199814.xyz
URL: http://eservice.cembra.ch.serviceid199814.xyz/cembra/6d53a3fe7397a853869fe5fbd9b6e6e3/login/?
Protocol
HTTP/1.1
Server
193.32.161.73 -, , ASN50329 (STROYMASTER, RU),
Reverse DNS
Software
nginx/1.4.6 (Ubuntu) /
Resource Hash
03ecd6b09492d7422b2523dbd0b58a365bcd58e67649f3d88ecd284c2167891c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options sameorigin

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
eservice.cembra.ch.serviceid199814.xyz
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://eservice.cembra.ch.serviceid199814.xyz/cembra/6d53a3fe7397a853869fe5fbd9b6e6e3/login/?
Cookie
real=OK
Connection
keep-alive
Cache-Control
no-cache
Referer
http://eservice.cembra.ch.serviceid199814.xyz/cembra/6d53a3fe7397a853869fe5fbd9b6e6e3/login/?
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 23 Apr 2019 07:43:06 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sun, 14 Apr 2019 20:07:56 GMT
Server
nginx/1.4.6 (Ubuntu)
ETag
"1902-586831775ff00"
X-Frame-Options
sameorigin
Content-Type
image/jpeg
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
6402
loading.gif
eservice.cembra.ch.serviceid199814.xyz/cembra/login/ 		771 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://eservice.cembra.ch.serviceid199814.xyz/cembra/login/loading.gif
Requested by
Host: eservice.cembra.ch.serviceid199814.xyz
URL: http://eservice.cembra.ch.serviceid199814.xyz/cembra/6d53a3fe7397a853869fe5fbd9b6e6e3/login/?
Protocol
HTTP/1.1
Server
193.32.161.73 -, , ASN50329 (STROYMASTER, RU),
Reverse DNS
Software
nginx/1.4.6 (Ubuntu) /
Resource Hash
81a161d5793ac2a33f02ddcd64fb0dc2d028616dac084e4f64e77f4898b0c4e4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options sameorigin

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
eservice.cembra.ch.serviceid199814.xyz
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://eservice.cembra.ch.serviceid199814.xyz/cembra/6d53a3fe7397a853869fe5fbd9b6e6e3/login/?
Cookie
real=OK
Connection
keep-alive
Cache-Control
no-cache
Referer
http://eservice.cembra.ch.serviceid199814.xyz/cembra/6d53a3fe7397a853869fe5fbd9b6e6e3/login/?
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 23 Apr 2019 07:43:06 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sun, 14 Apr 2019 20:07:56 GMT
Server
nginx/1.4.6 (Ubuntu)
ETag
"303-586831775ff00"
X-Frame-Options
sameorigin
Content-Type
image/gif
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
771
eservice-login-background.jpg
eservice.cembra.ch.serviceid199814.xyz/cembra/login/ 		34 KB
35 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://eservice.cembra.ch.serviceid199814.xyz/cembra/login/eservice-login-background.jpg
Requested by
Host: eservice.cembra.ch.serviceid199814.xyz
URL: http://eservice.cembra.ch.serviceid199814.xyz/cembra/6d53a3fe7397a853869fe5fbd9b6e6e3/login/?
Protocol
HTTP/1.1
Server
193.32.161.73 -, , ASN50329 (STROYMASTER, RU),
Reverse DNS
Software
nginx/1.4.6 (Ubuntu) /
Resource Hash
ed5c4f940fbb29ad6ea580e52d696b5badd28efa17ef068f0dda1f5c4026ca45
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options sameorigin

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
eservice.cembra.ch.serviceid199814.xyz
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://eservice.cembra.ch.serviceid199814.xyz/cembra/login/index.css
Cookie
real=OK
Connection
keep-alive
Cache-Control
no-cache
Referer
http://eservice.cembra.ch.serviceid199814.xyz/cembra/login/index.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 23 Apr 2019 07:43:06 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sun, 14 Apr 2019 20:07:56 GMT
Server
nginx/1.4.6 (Ubuntu)
ETag
"88e5-586831775ff00"
X-Frame-Options
sameorigin
Content-Type
image/jpeg
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
35045
vistasansbook-071211005emigrewebonly_001.woff
eservice.cembra.ch.serviceid199814.xyz/cembra/login/ 		32 KB
32 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://eservice.cembra.ch.serviceid199814.xyz/cembra/login/vistasansbook-071211005emigrewebonly_001.woff
Requested by
Host: eservice.cembra.ch.serviceid199814.xyz
URL: http://eservice.cembra.ch.serviceid199814.xyz/cembra/6d53a3fe7397a853869fe5fbd9b6e6e3/login/?
Protocol
HTTP/1.1
Server
193.32.161.73 -, , ASN50329 (STROYMASTER, RU),
Reverse DNS
Software
nginx/1.4.6 (Ubuntu) /
Resource Hash
b37a9db57ad291741c5a43f24d69e73bd672e47034dd6f8e28599fb907abb768
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options sameorigin

Request headers

Pragma
no-cache
Origin
http://eservice.cembra.ch.serviceid199814.xyz
Accept-Encoding
gzip, deflate
Host
eservice.cembra.ch.serviceid199814.xyz
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
http://eservice.cembra.ch.serviceid199814.xyz/cembra/login/index.css
Cookie
real=OK
Connection
keep-alive
Cache-Control
no-cache
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://eservice.cembra.ch.serviceid199814.xyz/cembra/login/index.css
Origin
http://eservice.cembra.ch.serviceid199814.xyz

Response headers

Date
Tue, 23 Apr 2019 07:43:06 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sun, 14 Apr 2019 20:07:56 GMT
Server
nginx/1.4.6 (Ubuntu)
ETag
"7e58-586831775ff00"
X-Frame-Options
sameorigin
Content-Type
application/x-font-woff
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
32344

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Cembra (Banking)

29 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| $ function| jQuery function| UAParser function| next__ function| finish__ function| set_event function| def_plugin_data_receiver function| deep_json_parse object| cookies function| advanced_string_validation function| sin_luhn function| cc_luhn function| dob_luhn function| exp_with_day_luhn function| exp_luhn function| qasame__ function| valid_a function| valid_q function| ask_def_proxy function| send1 object| _0xa211 function| _kaktys_encode string| bid object| php_js string| el object| loader_

2 Cookies

Domain/Path Name / Value
eservice.cembra.ch.serviceid199814.xyz/cembra Name: real
Value: OK
eservice.cembra.ch.serviceid199814.xyz/cembra/6d53a3fe7397a853869fe5fbd9b6e6e3 Name: bid
Value: 6d53a3fe7397a853869fe5fbd9b6e6e3

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Frame-Options sameorigin