urlscan.io logo urlscan.io
SecurityTrails logo

sparbillett.dsiag.ch Open in urlscan Pro
34.160.100.209  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://sparbillett.dsiag.ch/
Submission: On July 04 via automatic, source certstream-suspicious — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 7 HTTP transactions. The main IP is 34.160.100.209, located in Kansas City, United States and belongs to GOOGLE, US. The main domain is sparbillett.dsiag.ch.
TLS certificate: Issued by GTS CA 1D4 on July 4th 2022. Valid for: 3 months.
This is the only time sparbillett.dsiag.ch was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Schweizerische Bundesbahnen (Transportation)

Domain & IP information

IP Address AS Autonomous System
5 34.160.100.209 15169 (GOOGLE)
2 52.59.17.81 16509 (AMAZON-02)
7 2
Apex Domain
Subdomains		 Transfer
5 dsiag.ch
sparbillett.dsiag.ch
122 KB
2 sbb.ch
cdn.app.sbb.ch — Cisco Umbrella Rank: 331383
29 KB
7 2
Domain Requested by
5 sparbillett.dsiag.ch sparbillett.dsiag.ch
2 cdn.app.sbb.ch sparbillett.dsiag.ch
7 2

This site contains no links.

Subject Issuer Validity Valid
sparbillett.dsiag.ch
GTS CA 1D4		 2022-07-04 -
2022-10-02		 3 months crt.sh
*.app.sbb.ch
Amazon		 2021-10-15 -
2022-11-13		 a year crt.sh

This page contains 1 frames:

Primary Page: https://sparbillett.dsiag.ch/
Frame ID: 4F349E9C5DB4ABC03E4CAA48E127FEEF
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Sparbillett-Finder

Page Statistics

7
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

151 kB
Transfer

455 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
sparbillett.dsiag.ch/ 		18 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://sparbillett.dsiag.ch/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.160.100.209 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
209.100.160.34.bc.googleusercontent.com
Software
/
Resource Hash
0ecbfc455d1df8654bf87594759241731087e93ad4ce2892bb61e9e246063467

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding
gzip
content-type
text/html
date
Mon, 04 Jul 2022 14:15:06 GMT
via
1.1 google
runtime.063c5c7cea90076d.js
sparbillett.dsiag.ch/ 		1 KB
714 B 		Script
General
Check archive.org
Download Go to
Full URL
https://sparbillett.dsiag.ch/runtime.063c5c7cea90076d.js
Requested by
Host: sparbillett.dsiag.ch
URL: https://sparbillett.dsiag.ch/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.160.100.209 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
209.100.160.34.bc.googleusercontent.com
Software
/
Resource Hash
c23162ee92673ec1d8dbc74beaf22c7f10d1bbbb24d1a522ee6b6ea0b5dc5451

Request headers

Referer
https://sparbillett.dsiag.ch/
Origin
https://sparbillett.dsiag.ch
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Mon, 04 Jul 2022 14:15:06 GMT
via
1.1 google
last-modified
Thu, 01 Jan 1970 00:00:01 GMT
accept-ranges
bytes
content-encoding
gzip
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-type
application/javascript
polyfills.695a44330ea4a7a8.js
sparbillett.dsiag.ch/ 		33 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://sparbillett.dsiag.ch/polyfills.695a44330ea4a7a8.js
Requested by
Host: sparbillett.dsiag.ch
URL: https://sparbillett.dsiag.ch/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.160.100.209 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
209.100.160.34.bc.googleusercontent.com
Software
/
Resource Hash
61ef2f4d8ff15d1fb7fa69ee83bb6e7b53656d2198c08f5eadbe0a45b2d96115

Request headers

Referer
https://sparbillett.dsiag.ch/
Origin
https://sparbillett.dsiag.ch
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Mon, 04 Jul 2022 14:15:06 GMT
via
1.1 google
last-modified
Thu, 01 Jan 1970 00:00:01 GMT
accept-ranges
bytes
content-encoding
gzip
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-type
application/javascript
main.3f9faaf1ca583401.js
sparbillett.dsiag.ch/ 		298 KB
93 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://sparbillett.dsiag.ch/main.3f9faaf1ca583401.js
Requested by
Host: sparbillett.dsiag.ch
URL: https://sparbillett.dsiag.ch/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.160.100.209 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
209.100.160.34.bc.googleusercontent.com
Software
/
Resource Hash
39780391922e00043c8fe04e34878ed84178e91b0f7ffffdb6e3140633d6560a

Request headers

Referer
https://sparbillett.dsiag.ch/
Origin
https://sparbillett.dsiag.ch
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Mon, 04 Jul 2022 14:15:06 GMT
via
1.1 google
last-modified
Thu, 01 Jan 1970 00:00:01 GMT
accept-ranges
bytes
content-encoding
gzip
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-type
application/javascript
styles.aaf14bd36c9d9357.css
sparbillett.dsiag.ch/ 		77 KB
12 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://sparbillett.dsiag.ch/styles.aaf14bd36c9d9357.css
Requested by
Host: sparbillett.dsiag.ch
URL: https://sparbillett.dsiag.ch/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.160.100.209 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
209.100.160.34.bc.googleusercontent.com
Software
/
Resource Hash
8b96d67535bc3921a74d9b8362ee4e092c9787ef08daa71b58e02264d17f7fe9

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://sparbillett.dsiag.ch/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Mon, 04 Jul 2022 14:15:06 GMT
via
1.1 google
last-modified
Thu, 01 Jan 1970 00:00:01 GMT
accept-ranges
bytes
content-encoding
gzip
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-type
text/css
SBBWeb-Roman.woff2
cdn.app.sbb.ch/fonts/v1_6_subset/ 		14 KB
14 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://cdn.app.sbb.ch/fonts/v1_6_subset/SBBWeb-Roman.woff2
Requested by
Host: sparbillett.dsiag.ch
URL: https://sparbillett.dsiag.ch/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.59.17.81 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-59-17-81.eu-central-1.compute.amazonaws.com
Software
nginx/1.15.12 /
Resource Hash
966a89b8080879ba41c6b9f15c5efb58182c33a0d2d1e08748beb554b28b4997

Request headers

Referer
https://sparbillett.dsiag.ch/
Origin
https://sparbillett.dsiag.ch
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Mon, 04 Jul 2022 14:15:06 GMT
content-encoding
br
last-modified
Fri, 17 Dec 2021 15:16:26 GMT
server
nginx/1.15.12
etag
W/"61bca9ca-3748"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
max-age=31536000, public, private
access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With
expires
Tue, 04 Jul 2023 14:15:06 GMT
SBBWeb-Thin.woff2
cdn.app.sbb.ch/fonts/v1_6_subset/ 		14 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://cdn.app.sbb.ch/fonts/v1_6_subset/SBBWeb-Thin.woff2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.59.17.81 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-59-17-81.eu-central-1.compute.amazonaws.com
Software
nginx/1.15.12 /
Resource Hash
d54c676681d2c4e3b931e77908b1345441a0cf6e8f2339d4d3a56c1083aab7e6

Request headers

Referer
https://sparbillett.dsiag.ch/
Origin
https://sparbillett.dsiag.ch
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Mon, 04 Jul 2022 14:15:06 GMT
content-encoding
br
last-modified
Fri, 17 Dec 2021 15:16:26 GMT
server
nginx/1.15.12
etag
W/"61bca9ca-3900"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
max-age=31536000, public, private
access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With
expires
Tue, 04 Jul 2023 14:15:06 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Schweizerische Bundesbahnen (Transportation)

154 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| webpackChunksupersaver function| Zone function| __zone_symbol__Promise function| __zone_symbol__fetch function| __zone_symbol__queueMicrotask function| __zone_symbol__setTimeout function| __zone_symbol__clearTimeout function| __zone_symbol__setInterval function| __zone_symbol__clearInterval function| __zone_symbol__requestAnimationFrame function| __zone_symbol__cancelAnimationFrame function| __zone_symbol__webkitRequestAnimationFrame function| __zone_symbol__webkitCancelAnimationFrame function| __zone_symbol__alert function| __zone_symbol__prompt function| __zone_symbol__confirm function| __zone_symbol__MutationObserver function| __zone_symbol__WebKitMutationObserver function| __zone_symbol__IntersectionObserver function| __zone_symbol__FileReader boolean| __zone_symbol__ononsearchpatched boolean| __zone_symbol__ononappinstalledpatched boolean| __zone_symbol__ononbeforeinstallpromptpatched boolean| __zone_symbol__ononbeforexrselectpatched boolean| __zone_symbol__ononabortpatched boolean| __zone_symbol__ononblurpatched boolean| __zone_symbol__ononcancelpatched boolean| __zone_symbol__ononcanplaypatched boolean| __zone_symbol__ononcanplaythroughpatched boolean| __zone_symbol__ononchangepatched boolean| __zone_symbol__ononclickpatched boolean| __zone_symbol__ononclosepatched boolean| __zone_symbol__ononcontextlostpatched boolean| __zone_symbol__ononcontextmenupatched boolean| __zone_symbol__ononcontextrestoredpatched boolean| __zone_symbol__ononcuechangepatched boolean| __zone_symbol__onondblclickpatched boolean| __zone_symbol__onondragpatched boolean| __zone_symbol__onondragendpatched boolean| __zone_symbol__onondragenterpatched boolean| __zone_symbol__onondragleavepatched boolean| __zone_symbol__onondragoverpatched boolean| __zone_symbol__onondragstartpatched boolean| __zone_symbol__onondroppatched boolean| __zone_symbol__onondurationchangepatched boolean| __zone_symbol__ononemptiedpatched boolean| __zone_symbol__ononendedpatched boolean| __zone_symbol__ononerrorpatched boolean| __zone_symbol__ononfocuspatched boolean| __zone_symbol__ononformdatapatched boolean| __zone_symbol__ononinputpatched boolean| __zone_symbol__ononinvalidpatched boolean| __zone_symbol__ononkeydownpatched boolean| __zone_symbol__ononkeypresspatched boolean| __zone_symbol__ononkeyuppatched boolean| __zone_symbol__ononloadpatched boolean| __zone_symbol__ononloadeddatapatched boolean| __zone_symbol__ononloadedmetadatapatched boolean| __zone_symbol__ononloadstartpatched boolean| __zone_symbol__ononmousedownpatched boolean| __zone_symbol__ononmouseenterpatched boolean| __zone_symbol__ononmouseleavepatched boolean| __zone_symbol__ononmousemovepatched boolean| __zone_symbol__ononmouseoutpatched boolean| __zone_symbol__ononmouseoverpatched boolean| __zone_symbol__ononmouseuppatched boolean| __zone_symbol__ononmousewheelpatched boolean| __zone_symbol__ononpausepatched boolean| __zone_symbol__ononplaypatched boolean| __zone_symbol__ononplayingpatched boolean| __zone_symbol__ononprogresspatched boolean| __zone_symbol__ononratechangepatched boolean| __zone_symbol__ononresetpatched boolean| __zone_symbol__ononresizepatched boolean| __zone_symbol__ononscrollpatched boolean| __zone_symbol__ononsecuritypolicyviolationpatched boolean| __zone_symbol__ononseekedpatched boolean| __zone_symbol__ononseekingpatched boolean| __zone_symbol__ononselectpatched boolean| __zone_symbol__ononslotchangepatched boolean| __zone_symbol__ononstalledpatched boolean| __zone_symbol__ononsubmitpatched boolean| __zone_symbol__ononsuspendpatched boolean| __zone_symbol__onontimeupdatepatched boolean| __zone_symbol__onontogglepatched boolean| __zone_symbol__ononvolumechangepatched boolean| __zone_symbol__ononwaitingpatched boolean| __zone_symbol__ononwebkitanimationendpatched boolean| __zone_symbol__ononwebkitanimationiterationpatched boolean| __zone_symbol__ononwebkitanimationstartpatched boolean| __zone_symbol__ononwebkittransitionendpatched boolean| __zone_symbol__ononwheelpatched boolean| __zone_symbol__ononauxclickpatched boolean| __zone_symbol__onongotpointercapturepatched boolean| __zone_symbol__ononlostpointercapturepatched boolean| __zone_symbol__ononpointerdownpatched boolean| __zone_symbol__ononpointermovepatched boolean| __zone_symbol__ononpointeruppatched boolean| __zone_symbol__ononpointercancelpatched boolean| __zone_symbol__ononpointeroverpatched boolean| __zone_symbol__ononpointeroutpatched boolean| __zone_symbol__ononpointerenterpatched boolean| __zone_symbol__ononpointerleavepatched boolean| __zone_symbol__ononselectstartpatched boolean| __zone_symbol__ononselectionchangepatched boolean| __zone_symbol__ononanimationendpatched boolean| __zone_symbol__ononanimationiterationpatched boolean| __zone_symbol__ononanimationstartpatched boolean| __zone_symbol__onontransitionrunpatched boolean| __zone_symbol__onontransitionstartpatched boolean| __zone_symbol__onontransitionendpatched boolean| __zone_symbol__onontransitioncancelpatched boolean| __zone_symbol__ononafterprintpatched boolean| __zone_symbol__ononbeforeprintpatched boolean| __zone_symbol__ononbeforeunloadpatched boolean| __zone_symbol__ononhashchangepatched boolean| __zone_symbol__ononlanguagechangepatched boolean| __zone_symbol__ononmessagepatched boolean| __zone_symbol__ononmessageerrorpatched boolean| __zone_symbol__ononofflinepatched boolean| __zone_symbol__onononlinepatched boolean| __zone_symbol__ononpagehidepatched boolean| __zone_symbol__ononpageshowpatched boolean| __zone_symbol__ononpopstatepatched boolean| __zone_symbol__ononrejectionhandledpatched boolean| __zone_symbol__ononstoragepatched boolean| __zone_symbol__ononunhandledrejectionpatched boolean| __zone_symbol__ononunloadpatched boolean| __zone_symbol__onondevicemotionpatched boolean| __zone_symbol__onondeviceorientationpatched boolean| __zone_symbol__onondeviceorientationabsolutepatched boolean| __zone_symbol__ononbeforematchpatched boolean| __zone_symbol__ononpointerrawupdatepatched object| __zone_symbol__popstatefalse object| __zone_symbol__hashchangefalse function| $localize function| getAngularTestability function| getAllAngularTestabilities function| getAllAngularRootElements object| frameworkStabilizers function| __zone_symbol__addEventListener function| __zone_symbol__removeEventListener undefined| __zone_symbol__eventListeners undefined| __zone_symbol__removeAllListeners function| eventListeners function| removeAllListeners

0 Cookies