swisspass-oevlogin-pwle.radiant.cl Open in urlscan Pro
200.35.157.30 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://swisspass-oevlogin-pwle.radiant.cl/
Effective URL:
http://swisspass-oevlogin-pwle.radiant.cl/swisspass-vcaptcha.aspx?id=671799e7928ad
Submission: On October 22 via manual (October 22nd 2024, 12:26:22 pm UTC) from CL — Scanned from DE

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 8 HTTP transactions. The main IP is 200.35.157.30, located in Chile and belongs to Gtd Internet S.A., CL. The main domain is swisspass-oevlogin-pwle.radiant.cl.

This is the only time swisspass-oevlogin-pwle.radiant.cl was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Schweizerische Bundesbahnen (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
3 6	200.35.157.30 200.35.157.30	14259 (Gtd Inter...) (Gtd Internet S.A.)
3	142.250.186.132 142.250.186.132	15169 (GOOGLE) (GOOGLE)
1	2600:9000:237... 2600:9000:237d:ec00:8:ddec:8f00:21	16509 (AMAZON-02) (AMAZON-02)
1	142.250.185.227 142.250.185.227	15169 (GOOGLE) (GOOGLE)
8	4

6 200.35.157.30 (Chile) 3 redirects

ASN14259 (Gtd Internet S.A., CL)
PTR: srv30.creattiva.cl

swisspass-oevlogin-pwle.radiant.cl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.186.132 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:237d:ec00:8:ddec:8f00:21 (United States)

ASN16509 (AMAZON-02, US)

d27la2n6wh4qws.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.227 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f3.1e100.net

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	radiant.cl 3 redirects swisspass-oevlogin-pwle.radiant.cl	14 KB
3	google.com www.google.com — Cisco Umbrella Rank: 3	972 B
1	gstatic.com www.gstatic.com	217 KB
1	cloudfront.net d27la2n6wh4qws.cloudfront.net	3 KB
8	4

	Domain	Requested by
6	swisspass-oevlogin-pwle.radiant.cl	3 redirects swisspass-oevlogin-pwle.radiant.cl
3	www.google.com	swisspass-oevlogin-pwle.radiant.cl www.gstatic.com
1	www.gstatic.com	www.google.com
1	d27la2n6wh4qws.cloudfront.net	swisspass-oevlogin-pwle.radiant.cl
8	4

This site contains no links.

Subject Issuer	Validity	Valid
*.google.com WR2	`2024-09-30` - `2024-12-23`	3 months	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2024-07-30` - `2025-07-03`	a year	crt.sh
*.gstatic.com WR2	`2024-09-30` - `2024-12-23`	3 months	crt.sh

This page contains 3 frames:

Primary Page: http://swisspass-oevlogin-pwle.radiant.cl/swisspass-vcaptcha.aspx?id=671799e7928ad
Frame ID: C79D25066EC729AFBD0DE7CD9406A22A
Requests: 6 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcbshIqAAAAANlN8vv8K7cDhYrUJk4jfWosWyV9&co=aHR0cDovL3N3aXNzcGFzcy1vZXZsb2dpbi1wd2xlLnJhZGlhbnQuY2w6ODA.&hl=de-CH&v=lqsTZ5beIbCkK4uGEGv9JmUR&size=normal&cb=3rzoabtvxtm8
Frame ID: D6BD0BB4DF07ACD04B9C6E7834B13E4B
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=de-CH&v=lqsTZ5beIbCkK4uGEGv9JmUR&k=6LcbshIqAAAAANlN8vv8K7cDhYrUJk4jfWosWyV9
Frame ID: DBB5D5A47ABDD029A03A19C702F9669A
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

reCAPTCHA Check - SwissPass® - Blog post council confront

Page URL History Show full URLs

http://swisspass-oevlogin-pwle.radiant.cl/ HTTP 307
https://swisspass-oevlogin-pwle.radiant.cl/ HTTP 302
https://swisspass-oevlogin-pwle.radiant.cl/create_dash?id=84453be26be0a83edcbce02c1a0dbfe5 HTTP 307
http://swisspass-oevlogin-pwle.radiant.cl/ HTTP 302
http://swisspass-oevlogin-pwle.radiant.cl/create_dash?id=051928341be67dcba03f0e04104d9047 HTTP 302
http://swisspass-oevlogin-pwle.radiant.cl/swisspass-vcaptcha.aspx?id=671799e7928ad Page URL

Detected technologies

Microsoft ASP.NET (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

\.aspx?(?:$|\?)

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

<div[^>]+class="g-recaptcha"
/recaptcha/api\.js

Page Statistics

8
Requests

63 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

234 kB
Transfer

902 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://swisspass-oevlogin-pwle.radiant.cl/ HTTP 307
https://swisspass-oevlogin-pwle.radiant.cl/ HTTP 302
https://swisspass-oevlogin-pwle.radiant.cl/create_dash?id=84453be26be0a83edcbce02c1a0dbfe5 HTTP 307
http://swisspass-oevlogin-pwle.radiant.cl/ HTTP 302
http://swisspass-oevlogin-pwle.radiant.cl/create_dash?id=051928341be67dcba03f0e04104d9047 HTTP 302
http://swisspass-oevlogin-pwle.radiant.cl/swisspass-vcaptcha.aspx?id=671799e7928ad Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request swisspass-vcaptcha.aspx Show response
swisspass-oevlogin-pwle.radiant.cl/
Redirect Chain

http://swisspass-oevlogin-pwle.radiant.cl/
https://swisspass-oevlogin-pwle.radiant.cl/
https://swisspass-oevlogin-pwle.radiant.cl/create_dash?id=84453be26be0a83edcbce02c1a0dbfe5
http://swisspass-oevlogin-pwle.radiant.cl/
http://swisspass-oevlogin-pwle.radiant.cl/create_dash?id=051928341be67dcba03f0e04104d9047
http://swisspass-oevlogin-pwle.radiant.cl/swisspass-vcaptcha.aspx?id=671799e7928ad

4 KB
2 KB

629ms
629ms

Document
text/html

200.35.157.30
Gtd Internet S.A.

General

Check archive.org

Show headers Download Go to

Full URL: http://swisspass-oevlogin-pwle.radiant.cl/swisspass-vcaptcha.aspx?id=671799e7928ad
Protocol: HTTP/1.1
Server: 200.35.157.30 , Chile, ASN14259 (Gtd Internet S.A., CL),
Reverse DNS: srv30.creattiva.cl
Software: Apache /
Resource Hash: 15cad116e6b6038be711ce8bbcb1ab55d591e28ab7af5d86d117c0b99e074639

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

Cache-Control: no-store, no-cache, must-revalidate
Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 1624
Content-Type: text/html; charset=UTF-8
Date: Tue, 22 Oct 2024 12:26:15 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive: timeout=5, max=98
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding,User-Agent

Redirect headers

Cache-Control: no-store, no-cache, must-revalidate
Connection: Keep-Alive
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Date: Tue, 22 Oct 2024 12:26:15 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive: timeout=5, max=99
Location: ./swisspass-vcaptcha.aspx?id=671799e7928ad
Pragma: no-cache
Server: Apache
Vary: User-Agent

GET
H3 200 api.js Show response
www.google.com/recaptcha/ 1 KB
972 B 88ms
37ms Script
text/javascript 142.250.186.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?hl=de-ch

Requested by

Host: swisspass-oevlogin-pwle.radiant.cl
URL: http://swisspass-oevlogin-pwle.radiant.cl/swisspass-vcaptcha.aspx?id=671799e7928ad

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f4.1e100.net

Software

ESF /

Resource Hash

f822af04784150f15be6ae7c23671ea1ac44084f2c0ed94e6813d155dc3125d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://swisspass-oevlogin-pwle.radiant.cl/

Response headers

cache-control: private, max-age=300
content-encoding: gzip
cross-origin-resource-policy: cross-origin
report-to: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
x-content-type-options: nosniff
expires: Tue, 22 Oct 2024 12:26:17 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
date: Tue, 22 Oct 2024 12:26:17 GMT
x-xss-protection: 0
content-type: text/javascript; charset=utf-8
server: ESF
x-frame-options: SAMEORIGIN

GET
H/1.1 200
OK logo_text_de-20200819.png
swisspass-oevlogin-pwle.radiant.cl/img/ 11 KB
12 KB 262ms
262ms Image
image/png 200.35.157.30
Gtd Internet S.A.

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://swisspass-oevlogin-pwle.radiant.cl/img/logo_text_de-20200819.png
Requested by: Host: swisspass-oevlogin-pwle.radiant.cl
URL: http://swisspass-oevlogin-pwle.radiant.cl/swisspass-vcaptcha.aspx?id=671799e7928ad
Protocol: HTTP/1.1
Server: 200.35.157.30 , Chile, ASN14259 (Gtd Internet S.A., CL),
Reverse DNS: srv30.creattiva.cl
Software: Apache /
Resource Hash: e0f4424a0cfc4143868873503307ca73dd8011e931f21e2d90e018cecf2b8e20

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://swisspass-oevlogin-pwle.radiant.cl/swisspass-vcaptcha.aspx?id=671799e7928ad

Response headers

Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 11662
Keep-Alive: timeout=5, max=97
Date: Tue, 22 Oct 2024 12:26:16 GMT
Last-Modified: Wed, 13 Sep 2023 04:28:36 GMT
Content-Type: image/png
Server: Apache

GET
H2 200 logo.png
d27la2n6wh4qws.cloudfront.net/1.11.298/assets/resources/img/ 3 KB
3 KB 346ms
28ms Image
image/png 2600:9000:237d:ec00:8:ddec:8f00:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://d27la2n6wh4qws.cloudfront.net/1.11.298/assets/resources/img/logo.png

Requested by

Host: swisspass-oevlogin-pwle.radiant.cl
URL: http://swisspass-oevlogin-pwle.radiant.cl/swisspass-vcaptcha.aspx?id=671799e7928ad

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:237d:ec00:8:ddec:8f00:21 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

3397660196a35ebb826091bedd3ec322aa58c0e9c4e439eb17d0db3f0259cb9c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://swisspass-oevlogin-pwle.radiant.cl/

Response headers

etag: "c062969b1d72ed33224ed92158d2ebc3"
age: 382899
x-content-type-options: nosniff
x-cache: Hit from cloudfront
x-amz-cf-id: M8pTE057CjeA6oLIpuiRmsHIn2LvGmYPF26Jpw448_b2nChsrugBGw==
date: Fri, 18 Oct 2024 02:04:39 GMT
content-type: image/png
last-modified: Thu, 11 Jul 2024 10:04:23 GMT
vary: Origin
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
cache-control: max-age=31536000
referrer-policy: strict-origin-when-cross-origin
via: 1.1 f212784a4dc77817b66a91a042658fa6.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 2694
x-xss-protection: 1; mode=block
x-amz-cf-pop: MUC50-P2
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H/1.1 200
OK welcome.jpg
swisspass-oevlogin-pwle.radiant.cl/img/ 337 KB
0 494ms
261ms Image
image/jpeg 200.35.157.30
Gtd Internet S.A.

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://swisspass-oevlogin-pwle.radiant.cl/img/welcome.jpg
Requested by: Host: swisspass-oevlogin-pwle.radiant.cl
URL: http://swisspass-oevlogin-pwle.radiant.cl/swisspass-vcaptcha.aspx
Protocol: HTTP/1.1
Server: 200.35.157.30 , Chile, ASN14259 (Gtd Internet S.A., CL),
Reverse DNS: srv30.creattiva.cl
Software: Apache /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://swisspass-oevlogin-pwle.radiant.cl/swisspass-vcaptcha.aspx

Response headers

Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Length: 603024
Keep-Alive: timeout=5, max=100
Date: Tue, 22 Oct 2024 12:26:16 GMT
Last-Modified: Wed, 13 Sep 2023 04:28:48 GMT
Content-Type: image/jpeg
Server: Apache

GET
H3 200 recaptcha__de_ch.js Show response
www.gstatic.com/recaptcha/releases/lqsTZ5beIbCkK4uGEGv9JmUR/ 546 KB
217 KB 67ms
24ms Script
text/javascript 142.250.185.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/lqsTZ5beIbCkK4uGEGv9JmUR/recaptcha__de_ch.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?hl=de-ch

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f3.1e100.net

Software

sffe /

Resource Hash

6307cf9d8e899ec60da1f51db7c50c725ccc3f31257e3feb7c420dfa8d03009e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: http://swisspass-oevlogin-pwle.radiant.cl
Referer: http://swisspass-oevlogin-pwle.radiant.cl/

Response headers

content-encoding: gzip
age: 549299
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
x-content-type-options: nosniff
expires: Thu, 16 Oct 2025 03:51:18 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 16 Oct 2024 03:51:18 GMT
last-modified: Mon, 14 Oct 2024 18:32:27 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
accept-ranges: bytes
access-control-allow-origin: *
content-length: 221983
x-xss-protection: 0
server: sffe

GET
H3 200 anchor
www.google.com/recaptcha/api2/ Frame D6BD 0
0 128ms
78ms Document
text/html 142.250.186.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcbshIqAAAAANlN8vv8K7cDhYrUJk4jfWosWyV9&co=aHR0cDovL3N3aXNzcGFzcy1vZXZsb2dpbi1wd2xlLnJhZGlhbnQuY2w6ODA.&hl=de-CH&v=lqsTZ5beIbCkK4uGEGv9JmUR&size=normal&cb=3rzoabtvxtm8

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/lqsTZ5beIbCkK4uGEGv9JmUR/recaptcha__de_ch.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f4.1e100.net

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-aOTqYnV77YeGZfY23HjcDw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://swisspass-oevlogin-pwle.radiant.cl/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-aOTqYnV77YeGZfY23HjcDw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy: cross-origin
date: Tue, 22 Oct 2024 12:26:17 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server: ESF
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 bframe
www.google.com/recaptcha/api2/ Frame DBB5 0
0 37ms
36ms Document
text/html 142.250.186.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=de-CH&v=lqsTZ5beIbCkK4uGEGv9JmUR&k=6LcbshIqAAAAANlN8vv8K7cDhYrUJk4jfWosWyV9

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/lqsTZ5beIbCkK4uGEGv9JmUR/recaptcha__de_ch.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f4.1e100.net

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-9_zsDgRIo4sl-ikt4gabyQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://swisspass-oevlogin-pwle.radiant.cl/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-9_zsDgRIo4sl-ikt4gabyQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy: cross-origin
date: Tue, 22 Oct 2024 12:26:18 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server: ESF
x-content-type-options: nosniff
x-xss-protection: 0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Schweizerische Bundesbahnen (Transportation)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			swisspass-oevlogin-pwle.radiant.cl/	1969-12-31 23:59:59	Name: PHPSESSID Value: 678ef9017eb03fb2ee773270e20ac391

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

d27la2n6wh4qws.cloudfront.net
swisspass-oevlogin-pwle.radiant.cl
www.google.com
www.gstatic.com
142.250.185.227
142.250.186.132
200.35.157.30
2600:9000:237d:ec00:8:ddec:8f00:21
15cad116e6b6038be711ce8bbcb1ab55d591e28ab7af5d86d117c0b99e074639
3397660196a35ebb826091bedd3ec322aa58c0e9c4e439eb17d0db3f0259cb9c
6307cf9d8e899ec60da1f51db7c50c725ccc3f31257e3feb7c420dfa8d03009e
e0f4424a0cfc4143868873503307ca73dd8011e931f21e2d90e018cecf2b8e20
f822af04784150f15be6ae7c23671ea1ac44084f2c0ed94e6813d155dc3125d9

swisspass-oevlogin-pwle.radiant.cl Open in urlscan Pro 200.35.157.30 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

8 Requests

63 %HTTPS

25 %IPv6

4 Domains

4 Subdomains

4 IPs

2 Countries

234 kBTransfer

902 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

10 JavaScript Global Variables

1 Cookies

Indicators

swisspass-oevlogin-pwle.radiant.cl Open in urlscan Pro
200.35.157.30 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

63 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

234 kB
Transfer

902 kB
Size

1
Cookies

8 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!