gm3.291.mytemp.website Open in urlscan Pro
173.201.177.224 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://gm3.291.mytemp.website/suiss/a/d/sign.php
Submission: On November 21 via automatic, source phishtank (November 21st 2024, 12:31:25 pm UTC) — Scanned from DE

Summary HTTP 19 Redirects Behaviour Indicators

Summary

This website contacted 7 IPs in 2 countries across 6 domains to perform 19 HTTP transactions. The main IP is 173.201.177.224, located in United States and belongs to AS-26496-GO-DADDY-COM-LLC, US. The main domain is gm3.291.mytemp.website.

This is the only time gm3.291.mytemp.website was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Schweizerische Bundesbahnen (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
9	173.201.177.224 173.201.177.224	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC)
1 2	23.53.42.170 23.53.42.170	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
1	3.66.238.47 3.66.238.47	16509 (AMAZON-02) (AMAZON-02)
1	2a06:98c1:320... 2a06:98c1:3200::90:80	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a02:26f0:350... 2a02:26f0:3500:18::1724:a29c	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
4	2a02:26f0:350... 2a02:26f0:3500:89a::228b	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
19	7

9 173.201.177.224 (United States)

ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: ip-173-201-177-224.ip.secureserver.net

gm3.291.mytemp.website	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.53.42.170 (Frankfurt am Main, Germany) 1 redirects

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)
PTR: a23-53-42-170.deploy.static.akamaitechnologies.com

img1.wsimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.66.238.47 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-66-238-47.eu-central-1.compute.amazonaws.com

cdn.app.sbb.ch	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a06:98c1:3200::90:80 (United States)

ASN13335 (CLOUDFLARENET, US)

resources.swisspass.ch	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:3500:18::1724:a29c (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)

events.api.secureserver.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a02:26f0:3500:89a::228b (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)

csp.secureserver.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	mytemp.website gm3.291.mytemp.website	305 KB
6	secureserver.net events.api.secureserver.net — Cisco Umbrella Rank: 13900 csp.secureserver.net — Cisco Umbrella Rank: 13675	572 B
2	wsimg.com 1 redirects img1.wsimg.com — Cisco Umbrella Rank: 10742	21 KB
1	swisspass.ch resources.swisspass.ch	197 KB
1	sbb.ch cdn.app.sbb.ch — Cisco Umbrella Rank: 433694	14 KB
0	duckdns.org Failed telegrambotcheck.duckdns.org Failed
19	6

	Domain	Requested by
9	gm3.291.mytemp.website	gm3.291.mytemp.website
4	csp.secureserver.net	img1.wsimg.com
2	events.api.secureserver.net	img1.wsimg.com
2	img1.wsimg.com	1 redirects gm3.291.mytemp.website
1	resources.swisspass.ch	gm3.291.mytemp.website
1	cdn.app.sbb.ch	gm3.291.mytemp.website
0	telegrambotcheck.duckdns.org Failed	gm3.291.mytemp.website
19	7

This site contains no links.

Subject Issuer	Validity	Valid
*.app.sbb.ch Amazon RSA 2048 M02	`2024-07-16` - `2025-08-14`	a year	crt.sh
swisspass.ch SwissSign RSA TLS DV ICA 2022 - 1	`2024-03-14` - `2025-03-14`	a year	crt.sh
*.api.secureserver.net Starfield Secure Certificate Authority - G2	`2024-07-15` - `2025-08-16`	a year	crt.sh
*.secureserver.net Starfield Secure Certificate Authority - G2	`2024-10-17` - `2025-11-18`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://gm3.291.mytemp.website/suiss/a/d/sign.php
Frame ID: 4E78F3EE193A04C2972D615191C527D0
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

SwissPass

Page URL History Show full URLs

http://gm3.291.mytemp.website/suiss/a/d/sign.php HTTP 307
https://gm3.291.mytemp.website/suiss/a/d/sign.php HTTP 307
http://gm3.291.mytemp.website/suiss/a/d/sign.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

19
Requests

42 %
HTTPS

50 %
IPv6

6
Domains

7
Subdomains

7
IPs

2
Countries

538 kB
Transfer

1031 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://gm3.291.mytemp.website/suiss/a/d/sign.php HTTP 307
https://gm3.291.mytemp.website/suiss/a/d/sign.php HTTP 307
http://gm3.291.mytemp.website/suiss/a/d/sign.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 5

https://img1.wsimg.com/traffic-assets/js/tccl.min.js HTTP 301
https://img1.wsimg.com/signals/js/clients/scc-c2/scc-c2.min.js

19 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request sign.php Show response
gm3.291.mytemp.website/suiss/a/d/
Redirect Chain

http://gm3.291.mytemp.website/suiss/a/d/sign.php
https://gm3.291.mytemp.website/suiss/a/d/sign.php
http://gm3.291.mytemp.website/suiss/a/d/sign.php

24 KB
5 KB

261ms
260ms

Document
text/html

173.201.177.224
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: http://gm3.291.mytemp.website/suiss/a/d/sign.php
Protocol: HTTP/1.1
Server: 173.201.177.224 , United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: ip-173-201-177-224.ip.secureserver.net
Software: Apache / PHP/8.2.24
Resource Hash: 8c96f402fb1124c88bad7253bd5464bc14596e85270f1f52ff5cfc5ddecdf061

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

Connection: Upgrade, Keep-Alive
Content-Encoding: gzip
Content-Length: 5034
Content-Type: text/html; charset=UTF-8
Date: Thu, 21 Nov 2024 12:31:14 GMT
Keep-Alive: timeout=5
Server: Apache
Upgrade: h2,h2c
Vary: Accept-Encoding
X-Powered-By: PHP/8.2.24

Redirect headers

Location: http://gm3.291.mytemp.website/suiss/a/d/sign.php
Non-Authoritative-Reason: HttpsUpgrades

GET
H/1.1 200
OK sso.min-20200819.css
gm3.291.mytemp.website/suiss/a/d/Login%20_%20SwissPass_files/ 180 KB
23 KB 175ms
174ms Stylesheet
text/css 173.201.177.224
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: http://gm3.291.mytemp.website/suiss/a/d/Login%20_%20SwissPass_files/sso.min-20200819.css
Requested by: Host: gm3.291.mytemp.website
URL: http://gm3.291.mytemp.website/suiss/a/d/sign.php
Protocol: HTTP/1.1
Server: 173.201.177.224 , United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: ip-173-201-177-224.ip.secureserver.net
Software: Apache /
Resource Hash: da86a8f910323e36049f6fee7c877d53f9f5020f2031efdfabaec371476e1b5a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: http://gm3.291.mytemp.website/suiss/a/d/sign.php

Response headers

Content-Encoding: gzip
ETag: "e60f3c-2ce5a-61721e0044600-gzip"
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 23708
Keep-Alive: timeout=5
Date: Thu, 21 Nov 2024 12:31:15 GMT
Last-Modified: Sun, 28 Apr 2024 06:02:00 GMT
Vary: Accept-Encoding
Server: Apache
Content-Type: text/css

GET
H/1.1 200
OK jq.js Show response
gm3.291.mytemp.website/suiss/a/d/assets/js/ 361 KB
123 KB 322ms
164ms Script
text/javascript 173.201.177.224
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: http://gm3.291.mytemp.website/suiss/a/d/assets/js/jq.js
Requested by: Host: gm3.291.mytemp.website
URL: http://gm3.291.mytemp.website/suiss/a/d/sign.php
Protocol: HTTP/1.1
Server: 173.201.177.224 , United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: ip-173-201-177-224.ip.secureserver.net
Software: Apache /
Resource Hash: d066c11600369c32eea993e482d74be1bcc76c906f18f2ea7cd995bba6ecc385

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: http://gm3.291.mytemp.website/suiss/a/d/sign.php

Response headers

Upgrade: h2,h2c
Transfer-Encoding: chunked
Content-Encoding: gzip
ETag: "e616cd-5a219-61721e0044600-gzip"
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5
Date: Thu, 21 Nov 2024 12:31:15 GMT
Last-Modified: Sun, 28 Apr 2024 06:02:00 GMT
Vary: Accept-Encoding
Server: Apache
Content-Type: text/javascript

GET
H/1.1 200
OK logo_text_de-20200819.svg
gm3.291.mytemp.website/suiss/a/d/ 137 KB
137 KB 320ms
162ms Image
image/svg+xml 173.201.177.224
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://gm3.291.mytemp.website/suiss/a/d/logo_text_de-20200819.svg
Requested by: Host: gm3.291.mytemp.website
URL: http://gm3.291.mytemp.website/suiss/a/d/sign.php
Protocol: HTTP/1.1
Server: 173.201.177.224 , United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: ip-173-201-177-224.ip.secureserver.net
Software: Apache /
Resource Hash: c337d42ed7979c6be0282900bd957dd9d112a430dc7761463d655eb8f0d9bc07

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: http://gm3.291.mytemp.website/suiss/a/d/sign.php

Response headers

Upgrade: h2,h2c
ETag: "e60efe-222c3-61721e0044600"
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Length: 139971
Keep-Alive: timeout=5
Date: Thu, 21 Nov 2024 12:31:15 GMT
Last-Modified: Sun, 28 Apr 2024 06:02:00 GMT
Vary: Accept-Encoding
Server: Apache
Content-Type: image/svg+xml

GET
H/1.1 200
OK logo-20200819.svg
gm3.291.mytemp.website/suiss/a/d/ 7 KB
8 KB 321ms
162ms Image
image/svg+xml 173.201.177.224
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://gm3.291.mytemp.website/suiss/a/d/logo-20200819.svg
Requested by: Host: gm3.291.mytemp.website
URL: http://gm3.291.mytemp.website/suiss/a/d/sign.php
Protocol: HTTP/1.1
Server: 173.201.177.224 , United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: ip-173-201-177-224.ip.secureserver.net
Software: Apache /
Resource Hash: deeee170c3759a6ed35c0c05c5b935d0e7638f1c0c5677166918ecff6edb1909

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: http://gm3.291.mytemp.website/suiss/a/d/sign.php

Response headers

Upgrade: h2,h2c
ETag: "e60ef0-1cce-61721e0044600"
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Length: 7374
Keep-Alive: timeout=5
Date: Thu, 21 Nov 2024 12:31:15 GMT
Last-Modified: Sun, 28 Apr 2024 06:02:00 GMT
Vary: Accept-Encoding
Server: Apache
Content-Type: image/svg+xml

GET
H/1.1 200
OK loader-20200819.png
gm3.291.mytemp.website/suiss/a/d/Login%20_%20SwissPass_files/ 272 B
565 B 317ms
158ms Image
image/png 173.201.177.224
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://gm3.291.mytemp.website/suiss/a/d/Login%20_%20SwissPass_files/loader-20200819.png
Requested by: Host: gm3.291.mytemp.website
URL: http://gm3.291.mytemp.website/suiss/a/d/sign.php
Protocol: HTTP/1.1
Server: 173.201.177.224 , United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: ip-173-201-177-224.ip.secureserver.net
Software: Apache /
Resource Hash: f766c7457c6ec463eaa85778aa47261344f1772e0b7cf1987ad212f889f472f5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: http://gm3.291.mytemp.website/suiss/a/d/sign.php

Response headers

Upgrade: h2,h2c
ETag: "e60f36-110-61721e0044600"
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Length: 272
Keep-Alive: timeout=5
Date: Thu, 21 Nov 2024 12:31:15 GMT
Last-Modified: Sun, 28 Apr 2024 06:02:00 GMT
Content-Type: image/png
Server: Apache

GET
H2

200

scc-c2.min.js Show response
img1.wsimg.com/signals/js/clients/scc-c2/
Redirect Chain

https://img1.wsimg.com/traffic-assets/js/tccl.min.js
https://img1.wsimg.com/signals/js/clients/scc-c2/scc-c2.min.js

105 KB
21 KB

22ms
12ms

Script
text/javascript

23.53.42.170
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://img1.wsimg.com/signals/js/clients/scc-c2/scc-c2.min.js
Requested by: Host: gm3.291.mytemp.website
URL: http://gm3.291.mytemp.website/suiss/a/d/sign.php
Protocol: H2
Server: 23.53.42.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a23-53-42-170.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 1b4dacb0dafda81d48ee0890ea113b3b8275bf2d16d5325f971f16eb75f7218a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: http://gm3.291.mytemp.website/

Response headers

content-encoding: gzip
x-amz-meta-version: 0.4.7
etag: "6a7950cc31489069917bf817b62b2bfe"
x-amz-version-id: 4pexUB2ckSZgPfbjokD3loiC8DEV2lsi
expires: Thu, 21 Nov 2024 13:01:15 GMT
date: Thu, 21 Nov 2024 12:31:15 GMT
last-modified: Tue, 24 Sep 2024 20:55:06 GMT
content-type: text/javascript
vary: Accept-Encoding
x-amz-id-2: QzDvbQPoC/yd79cRYoiDycnbcXh2pSFm1kZVkCYVTGf1LaJCMTtIuUb9W5RhaUG/ykPbw3BtR3s=
cache-control: max-age=1800
timing-allow-origin: *
x-amz-request-id: VGKSC2ZC5C6TW48G
accept-ranges: bytes
access-control-allow-origin: *
content-length: 20968
x-amz-server-side-encryption: AES256

Redirect headers

expires: Fri, 21 Nov 2025 12:31:15 GMT
cache-control: max-age=31536000
location: https://img1.wsimg.com/signals/js/clients/scc-c2/scc-c2.min.js
content-length: 0
access-control-allow-origin: *
date: Thu, 21 Nov 2024 12:31:15 GMT
timing-allow-origin: *

GET
H2 200 SBBWeb-Light.woff2
cdn.app.sbb.ch/fonts/v1_6_subset/ 14 KB
14 KB 70ms
18ms Font
application/font-woff2 3.66.238.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.app.sbb.ch/fonts/v1_6_subset/SBBWeb-Light.woff2
Requested by: Host: gm3.291.mytemp.website
URL: http://gm3.291.mytemp.website/suiss/a/d/Login%20_%20SwissPass_files/sso.min-20200819.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.238.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-238-47.eu-central-1.compute.amazonaws.com
Software: nginx/1.27.2 /
Resource Hash: 5c7f0e173844556da7ca5eb8936fa3dab1c00206960920a49a1eea9cde2bfaaf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: http://gm3.291.mytemp.website
Referer: http://gm3.291.mytemp.website/

Response headers

access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With
cache-control: max-age=31536000, public, private
content-encoding: br
etag: W/"672b9464-3784"
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
expires: Fri, 21 Nov 2025 12:31:15 GMT
access-control-allow-origin: *
date: Thu, 21 Nov 2024 12:31:15 GMT
content-type: application/font-woff2
last-modified: Wed, 06 Nov 2024 16:08:04 GMT
server: nginx/1.27.2
vary: Accept-Encoding

POST receive_token
telegrambotcheck.duckdns.org/ 0
0

GET
H/1.1 200
OK loader-20200819.png
gm3.291.mytemp.website/suiss/a/d/Login%20_%20SwissPass_files/ 272 B
0 0ms
0ms Image
image/png 173.201.177.224
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://gm3.291.mytemp.website/suiss/a/d/Login%20_%20SwissPass_files/loader-20200819.png
Requested by: Host: gm3.291.mytemp.website
URL: http://gm3.291.mytemp.website/suiss/a/d/sign.php
Protocol: HTTP/1.1
Server: 173.201.177.224 , United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: ip-173-201-177-224.ip.secureserver.net
Software: Apache /
Resource Hash: f766c7457c6ec463eaa85778aa47261344f1772e0b7cf1987ad212f889f472f5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: http://gm3.291.mytemp.website/suiss/a/d/sign.php

Response headers

Accept-Ranges: bytes
Content-Length: 272
Date: Thu, 21 Nov 2024 12:31:15 GMT
ETag: "e60f36-110-61721e0044600"
Last-Modified: Sun, 28 Apr 2024 06:02:00 GMT
Content-Type: image/png
Server: Apache

GET
H2 200 login_bg.jpg
resources.swisspass.ch/content/dam/swisspass/co-branding/swiss_ch/ 196 KB
197 KB 246ms
29ms Image
image/jpeg 2a06:98c1:3200::90:80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://resources.swisspass.ch/content/dam/swisspass/co-branding/swiss_ch/login_bg.jpg

Requested by

Host: gm3.291.mytemp.website
URL: http://gm3.291.mytemp.website/suiss/a/d/sign.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3200::90:80 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

58a037c0bde953b48561826f3df16031f7ddfce33c4018619d3f39c6af6eec1b

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: http://gm3.291.mytemp.website/

Response headers

cf-bgj: h2pri
etag: "310e5-62763f5bb4aff"
age: 8686
cf-cache-status: HIT
x-content-type-options: nosniff
expires: Thu, 21 Nov 2024 18:31:16 GMT
x-url: /content/dam/swisspass/co-branding/swiss_ch/login_bg.jpg
x-varnish: 287960613
x-cache: MISS
date: Thu, 21 Nov 2024 12:31:16 GMT
content-type: image/jpeg
last-modified: Thu, 21 Nov 2024 03:35:38 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=16070400; includeSubDomains
cache-control: public, max-age=21600
referrer-policy: same-origin
cf-ray: 8e60b21e39059242-MUC
accept-ranges: bytes
content-length: 200933
x-plattform: cprod
x-xss-protection: 1; mode=block
server: cloudflare

GET
H/1.1 200
OK icomoon.woff2
gm3.291.mytemp.website/suiss/a/d/ 7 KB
7 KB 163ms
158ms Font
font/woff2 173.201.177.224
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: http://gm3.291.mytemp.website/suiss/a/d/icomoon.woff2
Requested by: Host: gm3.291.mytemp.website
URL: http://gm3.291.mytemp.website/suiss/a/d/sign.php
Protocol: HTTP/1.1
Server: 173.201.177.224 , United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: ip-173-201-177-224.ip.secureserver.net
Software: Apache /
Resource Hash: 78a4a776506b173ae79fd021d0e9003c7d653ca204ea1d69bea4d553f92f787d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: http://gm3.291.mytemp.website
Referer: http://gm3.291.mytemp.website/suiss/a/d/sign.php

Response headers

ETag: "e60ef2-1a14-61721e0044600"
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 6676
Keep-Alive: timeout=5
Date: Thu, 21 Nov 2024 12:31:16 GMT
Last-Modified: Sun, 28 Apr 2024 06:02:00 GMT
Vary: Accept-Encoding
Server: Apache
Content-Type: font/woff2

GET
H2 200 event Show response
events.api.secureserver.net/t/1/tl/ 43 B
286 B 293ms
158ms Fetch
image/gif 2a02:26f0:3500:18::1724:a29c
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: img1.wsimg.com
URL: https://img1.wsimg.com/traffic-assets/js/tccl.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:3500:18::1724:a29c Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

Resource Hash

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: http://gm3.291.mytemp.website/

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains
x-robots-tag: noindex, nofollow
cache-control: private
access-control-allow-credentials: true
x-content-type-options: nosniff
access-control-allow-origin: http://gm3.291.mytemp.website
content-length: 43
x-xss-protection: 1; mode=block
date: Thu, 21 Nov 2024 12:31:16 GMT
content-type: image/gif
x-frame-options: DENY

GET
H2 200 event Show response
events.api.secureserver.net/t/1/tl/ 43 B
286 B 269ms
138ms Fetch
image/gif 2a02:26f0:3500:18::1724:a29c
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL

https://events.api.secureserver.net/t/1/tl/event?dh=gm3.291.mytemp.website&dr=&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F130.0.0.0%20Safari%2F537.36&client_name=scc-c2&cv=0.4.7&vg=d337bbd5-cded-4c59-bdf5-ca12fcefb440&vtg=d337bbd5-cded-4c59-bdf5-ca12fcefb440&dp=%2Fsuiss%2Fa%2Fd%2Fsign.php&trace_id=c292ac6e65c64035a04bd6c424dde86f&cts=2024-11-21T12%3A31%3A16.243Z&hit_id=3fdb00d9-6629-4b80-b662-cef4198a54cc&ea=pageperf&ht=perf&eid=traffic.tcc.instrumentation.navigation.timing&trfd=%7B%22ap%22%3A%22cpsh-oh%22%2C%22server%22%3A%22p3plzcpnl508423%22%2C%22dcenter%22%3A%22p3%22%2C%22cp_id%22%3A%2210152425%22%2C%22cp_cl%22%3A%228%22%7D&ap=cpsh-oh&vci=1607902802&z=115779477&tce=1732192274770&tcs=1732192274770&tdc=1732192276238&tdclee=1732192275976&tdcles=1732192275976&tdi=1732192275976&tdl=1732192275153&tdle=1732192274770&tdls=1732192274770&tfs=1732192274770&tns=1732192271474&trqs=1732192274777&tre=1732192275039&trps=1732192275036&tles=1732192276238&tlee=0&nt=navigate&LCP=4560&nav_type=hard

Requested by

Host: img1.wsimg.com
URL: https://img1.wsimg.com/traffic-assets/js/tccl.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:3500:18::1724:a29c Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

Resource Hash

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: http://gm3.291.mytemp.website/

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains
x-robots-tag: noindex, nofollow
cache-control: private
access-control-allow-credentials: true
x-content-type-options: nosniff
access-control-allow-origin: http://gm3.291.mytemp.website
content-length: 43
x-xss-protection: 1; mode=block
date: Thu, 21 Nov 2024 12:31:16 GMT
content-type: image/gif
x-frame-options: DENY

GET
H/1.1 200
OK favicon.ico
gm3.291.mytemp.website/suiss/a/d/Login%20_%20SwissPass_files/ 1 KB
1 KB 162ms
162ms Other
image/x-icon 173.201.177.224
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: http://gm3.291.mytemp.website/suiss/a/d/Login%20_%20SwissPass_files/favicon.ico?v=20140709-1126
Protocol: HTTP/1.1
Server: 173.201.177.224 , United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: ip-173-201-177-224.ip.secureserver.net
Software: Apache /
Resource Hash: 7c1925da382279a72f94990d0a1456f78918619f35780ea0905e4ae0db684677

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: http://gm3.291.mytemp.website/suiss/a/d/sign.php

Response headers

ETag: "e60f30-47e-61721e0044600"
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 1150
Keep-Alive: timeout=5
Date: Thu, 21 Nov 2024 12:31:16 GMT
Last-Modified: Sun, 28 Apr 2024 06:02:00 GMT
Vary: Accept-Encoding
Server: Apache
Content-Type: image/x-icon

POST
H/1.1 202
Accepted eventbus
csp.secureserver.net/ 0
0 193ms
191ms Fetch
application/json 2a02:26f0:3500:89a::228b
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL

https://csp.secureserver.net/eventbus

Requested by

Host: img1.wsimg.com
URL: https://img1.wsimg.com/traffic-assets/js/tccl.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:3500:89a::228b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains ; preload

Request headers

Authorization: api-key b18ef4f046435b64a469b32c3c1c20a3
Referer: http://gm3.291.mytemp.website/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

Strict-Transport-Security: max-age=86400 ; includeSubDomains ; preload
Cache-Control: max-age=0, no-cache, no-store
x-amz-apigw-id: BmMzSEC9oAMEvkA=
x-envoy-upstream-service-time: 96
Pragma: no-cache
x-amzn-trace-id: Root=1-673f2814-1afe7cf9677edace7f547463
Connection: keep-alive
x-amzn-requestid: 5aa97520-520f-4a8e-bb8e-8511dbce75e7
Expires: Thu, 21 Nov 2024 12:31:16 GMT
Access-Control-Allow-Origin: *
Content-Length: 0
Date: Thu, 21 Nov 2024 12:31:16 GMT
Content-Type: application/json

POST
H/1.1 202
Accepted eventbus
csp.secureserver.net/ 0
0 197ms
196ms Fetch
application/json 2a02:26f0:3500:89a::228b
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL

https://csp.secureserver.net/eventbus

Requested by

Host: img1.wsimg.com
URL: https://img1.wsimg.com/traffic-assets/js/tccl.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:3500:89a::228b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains ; preload

Request headers

Authorization: api-key 8da2217409854bee82e12dc4ca0b39fb
Referer: http://gm3.291.mytemp.website/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

Strict-Transport-Security: max-age=86400 ; includeSubDomains ; preload
Cache-Control: max-age=0, no-cache, no-store
x-amz-apigw-id: BmMzSG0LoAMEoPw=
x-envoy-upstream-service-time: 94
Pragma: no-cache
x-amzn-trace-id: Root=1-673f2814-6ecd3b3211d65db852a9c808
Connection: keep-alive
x-amzn-requestid: 4c8e08f8-6968-466a-a056-39c6cddaec86
Expires: Thu, 21 Nov 2024 12:31:16 GMT
Access-Control-Allow-Origin: *
Content-Length: 0
Date: Thu, 21 Nov 2024 12:31:16 GMT
Content-Type: application/json

OPTIONS
H/1.1 200
OK eventbus
csp.secureserver.net/ 0
0 155ms
110ms Preflight
application/json 2a02:26f0:3500:89a::228b
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL

https://csp.secureserver.net/eventbus

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:3500:89a::228b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains ; preload

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: POST
Origin: http://gm3.291.mytemp.website
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Headers: content-type,authorization
Access-Control-Allow-Methods: OPTIONS,POST
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 0
Content-Type: application/json
Date: Thu, 21 Nov 2024 12:31:16 GMT
Expires: Thu, 21 Nov 2024 12:31:16 GMT
Pragma: no-cache
Strict-Transport-Security: max-age=86400 ; includeSubDomains ; preload
x-amz-apigw-id: BmMzREPcIAMEqcw=
x-amzn-requestid: dd7bbfae-3a2b-4784-8467-7bf05740a764
x-amzn-trace-id: Root=1-673f2814-123e63d3214eaf3479df50e6
x-envoy-upstream-service-time: 6

OPTIONS
H/1.1 200
OK eventbus
csp.secureserver.net/ 0
0 148ms
103ms Preflight
application/json 2a02:26f0:3500:89a::228b
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL

https://csp.secureserver.net/eventbus

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:3500:89a::228b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains ; preload

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: POST
Origin: http://gm3.291.mytemp.website
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Headers: content-type,authorization
Access-Control-Allow-Methods: OPTIONS,POST
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 0
Content-Type: application/json
Date: Thu, 21 Nov 2024 12:31:16 GMT
Expires: Thu, 21 Nov 2024 12:31:16 GMT
Pragma: no-cache
Strict-Transport-Security: max-age=86400 ; includeSubDomains ; preload
x-amz-apigw-id: BmMzRG7poAMEf_g=
x-amzn-requestid: 96a6a27e-a3d4-488a-913c-7d0b0004c88f
x-amzn-trace-id: Root=1-673f2814-520a5f222b443dba0b47bdf1
x-envoy-upstream-service-time: 8

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: telegrambotcheck.duckdns.org
URL: http://telegrambotcheck.duckdns.org:5000/receive_token?referrer=loco

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Schweizerische Bundesbahnen (Transportation)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.swisspass.ch/	1970-01-21 01:09:54	Name: __cf_bm Value: v0vAGVNa4EH7eDbotbk0Rz81DF3El4XcVIdcSBVb8T4-1732192276-1.0.1.1-fe8aj.h4jk0ZdeBaH65pUfBB0DxmUiv0VNsdY9Dw5.nXp.u4RsYJE6shHjA3zU21a6iDEab8us9E2CGXFIIMVw

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	warning	URL: http://gm3.291.mytemp.website/suiss/a/d/sign.php Message: [DOM] Found 2 elements with non-unique id #login_button: (More info: https://goo.gl/9p2vKq) %o %o
recommendation	verbose	URL: http://gm3.291.mytemp.website/suiss/a/d/sign.php Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
javascript	error	URL: http://gm3.291.mytemp.website/suiss/a/d/sign.php Message: Access to fetch at 'http://telegrambotcheck.duckdns.org:5000/receive_token?referrer=loco' from origin 'http://gm3.291.mytemp.website' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.
network	error	URL: http://telegrambotcheck.duckdns.org:5000/receive_token?referrer=loco Message: Failed to load resource: net::ERR_FAILED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.app.sbb.ch
csp.secureserver.net
events.api.secureserver.net
gm3.291.mytemp.website
img1.wsimg.com
resources.swisspass.ch
telegrambotcheck.duckdns.org
telegrambotcheck.duckdns.org
173.201.177.224
23.53.42.170
2a02:26f0:3500:18::1724:a29c
2a02:26f0:3500:89a::228b
2a06:98c1:3200::90:80
3.66.238.47
1b4dacb0dafda81d48ee0890ea113b3b8275bf2d16d5325f971f16eb75f7218a
58a037c0bde953b48561826f3df16031f7ddfce33c4018619d3f39c6af6eec1b
5c7f0e173844556da7ca5eb8936fa3dab1c00206960920a49a1eea9cde2bfaaf
78a4a776506b173ae79fd021d0e9003c7d653ca204ea1d69bea4d553f92f787d
7c1925da382279a72f94990d0a1456f78918619f35780ea0905e4ae0db684677
8c96f402fb1124c88bad7253bd5464bc14596e85270f1f52ff5cfc5ddecdf061
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
c337d42ed7979c6be0282900bd957dd9d112a430dc7761463d655eb8f0d9bc07
d066c11600369c32eea993e482d74be1bcc76c906f18f2ea7cd995bba6ecc385
da86a8f910323e36049f6fee7c877d53f9f5020f2031efdfabaec371476e1b5a
deeee170c3759a6ed35c0c05c5b935d0e7638f1c0c5677166918ecff6edb1909
f766c7457c6ec463eaa85778aa47261344f1772e0b7cf1987ad212f889f472f5

gm3.291.mytemp.website Open in urlscan Pro 173.201.177.224 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

19 Requests

42 %HTTPS

50 %IPv6

6 Domains

7 Subdomains

7 IPs

2 Countries

538 kBTransfer

1031 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

19 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

12 JavaScript Global Variables

1 Cookies

4 Console Messages

Indicators

gm3.291.mytemp.website Open in urlscan Pro
173.201.177.224 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

19
Requests

42 %
HTTPS

50 %
IPv6

6
Domains

7
Subdomains

7
IPs

2
Countries

538 kB
Transfer

1031 kB
Size

1
Cookies

19 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!