sensonadiago.duckdns.org Open in urlscan Pro
62.4.29.78 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://red-efkbc.formstack.com/forms/pass_ltd
Effective URL:
https://sensonadiago.duckdns.org/ce/2f504/
Submission: On August 30 via api (August 30th 2023, 6:56:51 pm UTC) from US — Scanned from CH

Summary HTTP 31 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 7 IPs in 4 countries across 6 domains to perform 31 HTTP transactions. The main IP is 62.4.29.78, located in Paray-Vieille-Poste, France and belongs to Online SAS, FR. The main domain is sensonadiago.duckdns.org.
TLS certificate: Issued by R3 on August 29th 2023. Valid for: 3 months.

This is the only time sensonadiago.duckdns.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Schweizerische Bundesbahnen (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
14	18.66.122.60 18.66.122.60	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:813::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:827::200a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:830::2003	15169 (GOOGLE) (GOOGLE)
2 12	62.4.29.78 62.4.29.78	12876 (Online SAS) (Online SAS)
2	193.203.121.166 193.203.121.166	31004 (SBB-CFF-F...) (SBB-CFF-FFS Telecom SBB)
1	18.193.245.155 18.193.245.155	16509 (AMAZON-02) (AMAZON-02)
31	7

14 18.66.122.60 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-122-60.fra60.r.cloudfront.net

red-efkbc.formstack.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
static.formstack.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:830::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 62.4.29.78 (Paray-Vieille-Poste, France) 2 redirects

ASN12876 (Online SAS, FR)

sensonadiago.duckdns.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 193.203.121.166 (Switzerland)

ASN31004 (SBB-CFF-FFS Telecom SBB, CH)

www.swisspass.ch	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.193.245.155 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-193-245-155.eu-central-1.compute.amazonaws.com

cdn.app.sbb.ch	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	formstack.com red-efkbc.formstack.com static.formstack.com — Cisco Umbrella Rank: 24292	170 KB
12	duckdns.org 2 redirects sensonadiago.duckdns.org	139 KB
2	swisspass.ch www.swisspass.ch — Cisco Umbrella Rank: 355507	146 KB
2	gstatic.com fonts.gstatic.com	28 KB
2	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 368 fonts.googleapis.com — Cisco Umbrella Rank: 41	7 KB
1	sbb.ch cdn.app.sbb.ch — Cisco Umbrella Rank: 299379	14 KB
31	6

	Domain	Requested by
12	sensonadiago.duckdns.org	2 redirects sensonadiago.duckdns.org
11	static.formstack.com	red-efkbc.formstack.com
3	red-efkbc.formstack.com	red-efkbc.formstack.com static.formstack.com
2	www.swisspass.ch	sensonadiago.duckdns.org
2	fonts.gstatic.com	fonts.googleapis.com
1	cdn.app.sbb.ch	sensonadiago.duckdns.org
1	fonts.googleapis.com	ajax.googleapis.com
1	ajax.googleapis.com	red-efkbc.formstack.com
31	8

This site contains links to these domains. Also see Links.

Domain
corporatedefenseetl.com
www.swisspass.ch

Subject Issuer	Validity	Valid
*.formstack.com Amazon RSA 2048 M02	`2023-03-20` - `2024-04-17`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2023-08-07` - `2023-10-30`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-08-07` - `2023-10-30`	3 months	crt.sh
sensonadiago.duckdns.org R3	`2023-08-29` - `2023-11-27`	3 months	crt.sh
www.swisspass.ch SwissSign RSA TLS OV ICA 2021 - 1	`2023-01-09` - `2024-01-09`	a year	crt.sh
*.app.sbb.ch Amazon RSA 2048 M02	`2023-08-16` - `2024-09-13`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://sensonadiago.duckdns.org/ce/2f504/
Frame ID: D1E28B0863BF888D52BA9C4DB1CA3EA6
Requests: 31 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Login | SwissPass

Page URL History Show full URLs

https://red-efkbc.formstack.com/forms/pass_ltd Page URL
https://sensonadiago.duckdns.org/ce/ HTTP 302
https://sensonadiago.duckdns.org/ce/2f504 HTTP 301
https://sensonadiago.duckdns.org/ce/2f504/ Page URL

Detected technologies

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

googleapis\.com/.+webfont

Modernizr (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery UI (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery-ui[.-]([\d.]*\d)[^/]*\.js
jquery-ui.*\.js

Page Statistics

31
Requests

100 %
HTTPS

43 %
IPv6

6
Domains

8
Subdomains

7
IPs

4
Countries

503 kB
Transfer

1422 kB
Size

2
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://corporatedefenseetl.com/home

Search URL Search Domain Scan URL

URL: https://www.swisspass.ch//pw-reset?lang=de&provider=sbbkn&callback=oevlogin
Title: Passwort vergessen?

Search URL Search Domain Scan URL

URL: https://www.swisspass.ch//register?lang=de&provider=sbbkn&callback=oevlogin
Title: Für SwissPass registrieren.

Search URL Search Domain Scan URL

URL: https://corporatedefenseetl.com/wp-admin/widgs/204d505e4ce918334/pass/
Title: Zurück

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://red-efkbc.formstack.com/forms/pass_ltd Page URL
https://sensonadiago.duckdns.org/ce/ HTTP 302
https://sensonadiago.duckdns.org/ce/2f504 HTTP 301
https://sensonadiago.duckdns.org/ce/2f504/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

31 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 pass_ltd Show response
red-efkbc.formstack.com/forms/ 15 KB
15 KB 125ms
26ms Document
text/html 18.66.122.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://red-efkbc.formstack.com/forms/pass_ltd

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.122.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-122-60.fra60.r.cloudfront.net

Software

nginx /

Resource Hash

cffb42db3164808a6ff8f25601fdbd53e9623262ae8f38cd1b6a458819cc8ead

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
accept-language: de-CH,de;q=0.9

Response headers

age: 2
cache-control: public, max-age=5 public
content-type: text/html; charset=UTF-8
date: Wed, 30 Aug 2023 18:56:45 GMT
expires: Wed, 30 Aug 2023 18:56:50 GMT
p3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: nginx
strict-transport-security: max-age=63072000; includeSubDomains
via: 1.1 2816426ad1adbedbdd23d4cdf80c2de2.cloudfront.net (CloudFront)
x-amz-cf-id: KsIaI3SOhW4eCTw-s_1nACcWIPdumn3XRQ0_Cwzm5h8o8vzGdPvZQg==
x-amz-cf-pop: FRA60-P2
x-cache: Hit from cloudfront

GET
H2 200 reset_3d1cc6d59f.css
static.formstack.com/forms/css/3/ 2 KB
821 B 65ms
28ms Stylesheet
text/css 18.66.122.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.formstack.com/forms/css/3/reset_3d1cc6d59f.css
Requested by: Host: red-efkbc.formstack.com
URL: https://red-efkbc.formstack.com/forms/pass_ltd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.60 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-60.fra60.r.cloudfront.net
Software: nginx /
Resource Hash: 86d5823df9f96c928e9981519128e09bf8f745ca88e690be0b342b5ce904d394

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://red-efkbc.formstack.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 30 Aug 2023 14:04:40 GMT
content-encoding: br
via: 1.1 2816426ad1adbedbdd23d4cdf80c2de2.cloudfront.net (CloudFront)
last-modified: Tue, 29 Aug 2023 20:54:51 GMT
server: nginx
x-amz-cf-pop: FRA60-P2
age: 17527
etag: W/"64ee5b1b-616"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
cache-control: public, s-maxage=86400
x-amz-cf-id: ONe80jnwIm-3apDp_G_NQVPH_--InWZPlNu-Wj6XM3RpkvCXUeHC7Q==

GET
H2 200 jquery-ui-1.13.2.min_164f2f8d51.css
static.formstack.com/forms/css/3/ 31 KB
7 KB 80ms
43ms Stylesheet
text/css 18.66.122.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.formstack.com/forms/css/3/jquery-ui-1.13.2.min_164f2f8d51.css
Requested by: Host: red-efkbc.formstack.com
URL: https://red-efkbc.formstack.com/forms/pass_ltd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.60 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-60.fra60.r.cloudfront.net
Software: nginx /
Resource Hash: 53c97063f6ea5b3487fd85cb98b0c47b41f1269fca482b2799b9c7067f051865

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://red-efkbc.formstack.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 30 Aug 2023 14:04:40 GMT
content-encoding: br
via: 1.1 2816426ad1adbedbdd23d4cdf80c2de2.cloudfront.net (CloudFront)
last-modified: Tue, 29 Aug 2023 20:54:51 GMT
server: nginx
x-amz-cf-pop: FRA60-P2
age: 17527
etag: W/"64ee5b1b-7d52"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
cache-control: public, s-maxage=86400
x-amz-cf-id: WckkXooXvShEMtHXoPDKOcexcHwvpI8xmGLORw7L7cn9ISZsQAoT8g==

GET
H2 200 default-v4_29cde3be75.css
static.formstack.com/forms/css/3/ 35 KB
6 KB 79ms
42ms Stylesheet
text/css 18.66.122.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.formstack.com/forms/css/3/default-v4_29cde3be75.css
Requested by: Host: red-efkbc.formstack.com
URL: https://red-efkbc.formstack.com/forms/pass_ltd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.60 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-60.fra60.r.cloudfront.net
Software: nginx /
Resource Hash: e2781619082fe50667bce285f562c3dfa98b589f0854da4a333a00d0f4b6c318

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://red-efkbc.formstack.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 30 Aug 2023 14:04:40 GMT
content-encoding: br
via: 1.1 2816426ad1adbedbdd23d4cdf80c2de2.cloudfront.net (CloudFront)
last-modified: Tue, 29 Aug 2023 20:54:51 GMT
server: nginx
x-amz-cf-pop: FRA60-P2
age: 17527
etag: W/"64ee5b1b-8aef"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
cache-control: public, s-maxage=86400
x-amz-cf-id: 0GbmI_j8u3uj_7TKL0IBZEw4Xn_pMayP86mPqTCDDActDsoZ8c6_iw==

GET
H2 200 light_2849050b8e.css
static.formstack.com/forms/css/3/ 37 KB
6 KB 106ms
69ms Stylesheet
text/css 18.66.122.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.formstack.com/forms/css/3/light_2849050b8e.css
Requested by: Host: red-efkbc.formstack.com
URL: https://red-efkbc.formstack.com/forms/pass_ltd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.60 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-60.fra60.r.cloudfront.net
Software: nginx /
Resource Hash: b0730434e9e350680ced98724525a505ac7a7e57c4bbc4472e59ae3b4275ec6d

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://red-efkbc.formstack.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 30 Aug 2023 14:04:40 GMT
content-encoding: br
via: 1.1 2816426ad1adbedbdd23d4cdf80c2de2.cloudfront.net (CloudFront)
last-modified: Tue, 29 Aug 2023 20:52:09 GMT
server: nginx
x-amz-cf-pop: FRA60-P2
age: 17527
etag: W/"64ee5a79-92cf"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
cache-control: public, s-maxage=86400
x-amz-cf-id: Rbam8MsifLL0lfLulvB007UaeJUjerGexx3hLN17W2jJb3-jiRvULw==

GET
H2 200 uil-static.css
static.formstack.com/common/css/ 51 KB
6 KB 63ms
26ms Stylesheet
text/css 18.66.122.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.formstack.com/common/css/uil-static.css
Requested by: Host: red-efkbc.formstack.com
URL: https://red-efkbc.formstack.com/forms/pass_ltd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.60 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-60.fra60.r.cloudfront.net
Software: nginx /
Resource Hash: 65763fb39f393cdc1fe959c7f3d55a7ca65cedfce32f65d1d92315088bd4e7d7

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://red-efkbc.formstack.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 30 Aug 2023 14:04:40 GMT
content-encoding: br
via: 1.1 2816426ad1adbedbdd23d4cdf80c2de2.cloudfront.net (CloudFront)
last-modified: Tue, 29 Aug 2023 20:45:06 GMT
server: nginx
x-amz-cf-pop: FRA60-P2
age: 17527
etag: W/"64ee58d2-ccb0"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
cache-control: public, s-maxage=86400
x-amz-cf-id: wb_h0TMazQ62QXmaoh0Q96VY8x-j2ITsjAStLY4a1d0JekptI8ktdw==

GET
H2 200 dialogs_00a7ec5f05.css
static.formstack.com/forms/css/common/ 170 B
504 B 65ms
29ms Stylesheet
text/css 18.66.122.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.formstack.com/forms/css/common/dialogs_00a7ec5f05.css
Requested by: Host: red-efkbc.formstack.com
URL: https://red-efkbc.formstack.com/forms/pass_ltd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.60 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-60.fra60.r.cloudfront.net
Software: nginx /
Resource Hash: 9fc43e8f6f26a254c4570b6ccd4e08a2a5f97bedcd1f3491ede9bbb8b5012d90

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://red-efkbc.formstack.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 30 Aug 2023 18:56:25 GMT
via: 1.1 2816426ad1adbedbdd23d4cdf80c2de2.cloudfront.net (CloudFront)
last-modified: Wed, 30 Aug 2023 17:48:38 GMT
server: nginx
x-amz-cf-pop: FRA60-P2
age: 22
etag: "64ef80f6-aa"
x-cache: Hit from cloudfront
content-type: text/css
cache-control: public, s-maxage=86400
accept-ranges: bytes
content-length: 170
x-amz-cf-id: osUphl4po69Jw0D3dXBK4ZDJfS9SoqJStxNgYuOGuTI9TpVnIOzE1A==

GET
H2 200 jquery-3.5.1.min_dc5e7f18c8.js Show response
static.formstack.com/forms/js/3/ 87 KB
30 KB 85ms
49ms Script
application/javascript 18.66.122.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.formstack.com/forms/js/3/jquery-3.5.1.min_dc5e7f18c8.js
Requested by: Host: red-efkbc.formstack.com
URL: https://red-efkbc.formstack.com/forms/pass_ltd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.60 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-60.fra60.r.cloudfront.net
Software: nginx /
Resource Hash: f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://red-efkbc.formstack.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 30 Aug 2023 14:04:40 GMT
content-encoding: br
via: 1.1 2816426ad1adbedbdd23d4cdf80c2de2.cloudfront.net (CloudFront)
last-modified: Tue, 29 Aug 2023 20:54:49 GMT
server: nginx
x-amz-cf-pop: FRA60-P2
age: 17527
etag: W/"64ee5b19-15d84"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
cache-control: public, s-maxage=86400
x-amz-cf-id: DwInQXFsoTMtdaFPia949a-l046WMvJFvNYoshJn4A6Sd0ldhaoqKw==

GET
H2 200 jquery-ui-1.13.2.min_1e20479789.js Show response
static.formstack.com/forms/js/3/ 249 KB
62 KB 109ms
73ms Script
application/javascript 18.66.122.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.formstack.com/forms/js/3/jquery-ui-1.13.2.min_1e20479789.js
Requested by: Host: red-efkbc.formstack.com
URL: https://red-efkbc.formstack.com/forms/pass_ltd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.60 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-60.fra60.r.cloudfront.net
Software: nginx /
Resource Hash: 9528ca634fecad433d044ddd3e6f9ce1f068d5d932dafdbb19d8e6daea1968bd

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://red-efkbc.formstack.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 30 Aug 2023 14:04:40 GMT
content-encoding: br
via: 1.1 2816426ad1adbedbdd23d4cdf80c2de2.cloudfront.net (CloudFront)
last-modified: Tue, 29 Aug 2023 20:54:51 GMT
server: nginx
x-amz-cf-pop: FRA60-P2
age: 17527
etag: W/"64ee5b1b-3e46c"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
cache-control: public, s-maxage=86400
x-amz-cf-id: uyhuOqiCVY_g9KbO_i6ckxP2OfScVlxhTlh3BslO2AaFuf69Lz7tYg==

GET
H2 200 scripts_8ef5a1adee.js Show response
static.formstack.com/forms/js/3/ 79 KB
22 KB 80ms
44ms Script
application/javascript 18.66.122.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.formstack.com/forms/js/3/scripts_8ef5a1adee.js
Requested by: Host: red-efkbc.formstack.com
URL: https://red-efkbc.formstack.com/forms/pass_ltd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.60 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-60.fra60.r.cloudfront.net
Software: nginx /
Resource Hash: cb5a0ad9bef0638ca62747ac1fb1a33d2a5b4c52592bce32ccf9b31089ab4a16

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://red-efkbc.formstack.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 30 Aug 2023 14:04:40 GMT
content-encoding: br
via: 1.1 2816426ad1adbedbdd23d4cdf80c2de2.cloudfront.net (CloudFront)
last-modified: Tue, 29 Aug 2023 20:54:49 GMT
server: nginx
x-amz-cf-pop: FRA60-P2
age: 17527
etag: W/"64ee5b19-13d0d"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
cache-control: public, s-maxage=86400
x-amz-cf-id: z8CJD8CS7CppTam-2KqijgiZXYrnJpNZP0cfW4y5u3AgvFkaMnydyg==

GET
H2 200 analytics_7d49daa365.js Show response
static.formstack.com/forms/js/3/ 2 KB
1 KB 125ms
89ms Script
application/javascript 18.66.122.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.formstack.com/forms/js/3/analytics_7d49daa365.js
Requested by: Host: red-efkbc.formstack.com
URL: https://red-efkbc.formstack.com/forms/pass_ltd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.60 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-60.fra60.r.cloudfront.net
Software: nginx /
Resource Hash: af897a5f18c00a272750446a9c34d8e024e18813260c4cfef79db22dc4fdf2bb

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://red-efkbc.formstack.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 30 Aug 2023 14:04:40 GMT
content-encoding: br
via: 1.1 2816426ad1adbedbdd23d4cdf80c2de2.cloudfront.net (CloudFront)
last-modified: Tue, 29 Aug 2023 20:49:29 GMT
server: nginx
x-amz-cf-pop: FRA60-P2
age: 17527
etag: W/"64ee59d9-839"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
cache-control: public, s-maxage=86400
x-amz-cf-id: 3dii7pX8Iu-lauk56ATzYCkkk37XbwPQMl46E7N9Dn0vBZSLua7ZtA==

GET
H2 200 modernizr_60a2d5aeb5.js Show response
static.formstack.com/forms/js/3/ 13 KB
6 KB 103ms
67ms Script
application/javascript 18.66.122.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.formstack.com/forms/js/3/modernizr_60a2d5aeb5.js
Requested by: Host: red-efkbc.formstack.com
URL: https://red-efkbc.formstack.com/forms/pass_ltd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.60 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-60.fra60.r.cloudfront.net
Software: nginx /
Resource Hash: af420c807b04fdb5136ef53f3bab83b81f2b94e43fa9856f1fad2fde88383744

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://red-efkbc.formstack.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 30 Aug 2023 14:04:40 GMT
content-encoding: br
via: 1.1 2816426ad1adbedbdd23d4cdf80c2de2.cloudfront.net (CloudFront)
last-modified: Tue, 29 Aug 2023 20:54:49 GMT
server: nginx
x-amz-cf-pop: FRA60-P2
age: 17527
etag: W/"64ee5b19-33bc"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
cache-control: public, s-maxage=86400
x-amz-cf-id: oznu536VJDSvNHyYz34TLIKW4VmvAEza0LpJkweTTMQ-j-6LPvYPjw==

GET
H2 200 formstack_icon.png
red-efkbc.formstack.com/forms/images/3/ 6 KB
7 KB 29ms
28ms Image
image/png 18.66.122.60
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://red-efkbc.formstack.com/forms/images/3/formstack_icon.png
Requested by: Host: red-efkbc.formstack.com
URL: https://red-efkbc.formstack.com/forms/pass_ltd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.60 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-60.fra60.r.cloudfront.net
Software: nginx /
Resource Hash: e66e84dc3a4ac1d2d7cb7246637243cbd71c58d6b576c428330cc0699ea3c1e7

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://red-efkbc.formstack.com/forms/pass_ltd
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 30 Aug 2023 18:56:46 GMT
via: 1.1 2816426ad1adbedbdd23d4cdf80c2de2.cloudfront.net (CloudFront)
last-modified: Tue, 29 Aug 2023 20:45:06 GMT
server: nginx
x-amz-cf-pop: FRA60-P2
age: 1
etag: "64ee58d2-1948"
x-cache: Hit from cloudfront
content-type: image/png
cache-control: public, s-maxage=86400
accept-ranges: bytes
content-length: 6472
x-amz-cf-id: kANfbvr7jUAaU_XvAt0o1htQgdN3cMpH2DGMAkcG6QOIwDZ2L6IbLg==

GET
H2 200 webfont.js Show response
ajax.googleapis.com/ajax/libs/webfont/1/ 13 KB
6 KB 77ms
21ms Script
text/javascript 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/webfont/1/webfont.js

Requested by

Host: red-efkbc.formstack.com
URL: https://red-efkbc.formstack.com/forms/pass_ltd

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

81016ac6be850b72df5d4faa0c3cec8e2c1b0ba0045712144a6766adfad40bee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://red-efkbc.formstack.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Thu, 24 Aug 2023 05:56:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 565217
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5437
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 23 Aug 2024 05:56:30 GMT

GET
H2 200 css
fonts.googleapis.com/ 1 KB
699 B 78ms
30ms Stylesheet
text/css 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato:400,700

Requested by

Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/webfont/1/webfont.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

5853c97750a92fe500e0462b349e255af956b9c156c0ef9396a37ca2617ade57

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://red-efkbc.formstack.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

strict-transport-security: max-age=31536000
date: Wed, 30 Aug 2023 18:56:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
expires: Wed, 30 Aug 2023 18:56:47 GMT

GET
H2 200 analytics.php
red-efkbc.formstack.com/forms/ 0
322 B 353ms
353ms Script
application/javascript 18.66.122.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://red-efkbc.formstack.com/forms/analytics.php?f=5427071&a=fv&m=hosted

Requested by

Host: static.formstack.com
URL: https://static.formstack.com/forms/js/3/analytics_7d49daa365.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.122.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-122-60.fra60.r.cloudfront.net

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Frame-Options	sameorigin

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://red-efkbc.formstack.com/forms/pass_ltd
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 30 Aug 2023 18:56:47 GMT
via: 1.1 2816426ad1adbedbdd23d4cdf80c2de2.cloudfront.net (CloudFront)
strict-transport-security: max-age=63072000; includeSubDomains
server: nginx
x-amz-cf-pop: FRA60-P2
x-frame-options: sameorigin
x-cache: Miss from cloudfront
content-type: application/javascript; charset=utf-8
cache-control: public
x-amz-cf-id: pfHldYaV5KV1OXN9TZg4RWdlb5WyftsmiCNnkwphnhi5QQ2U6aiXZg==

GET
H2 200 S6uyw4BMUTPHjx4wXiWtFCc.woff2
fonts.gstatic.com/s/lato/v24/ 14 KB
14 KB 70ms
20ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXiWtFCc.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:400,700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://red-efkbc.formstack.com
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Tue, 29 Aug 2023 17:37:58 GMT
x-content-type-options: nosniff
age: 91129
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13980
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:17:19 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 28 Aug 2024 17:37:58 GMT

GET
H2 200 S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2
fonts.gstatic.com/s/lato/v24/ 14 KB
14 KB 76ms
26ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:400,700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://red-efkbc.formstack.com
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 30 Aug 2023 18:52:43 GMT
x-content-type-options: nosniff
age: 244
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14168
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:29:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 29 Aug 2024 18:52:43 GMT

GET
H2

200

Primary Request / Show response
sensonadiago.duckdns.org/ce/2f504/
Redirect Chain

https://sensonadiago.duckdns.org/ce/
https://sensonadiago.duckdns.org/ce/2f504
https://sensonadiago.duckdns.org/ce/2f504/

67 KB
10 KB

141ms
141ms

Document
text/html

62.4.29.78
Online SAS

General

Check archive.org

Show headers Download Go to

Full URL: https://sensonadiago.duckdns.org/ce/2f504/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 62.4.29.78 Paray-Vieille-Poste, France, ASN12876 (Online SAS, FR),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 253cc6b9492d92ebefa081634dd02241b33c4bd83e17af332305f8e91cf39ace

Request headers

Referer: https://red-efkbc.formstack.com/forms/pass_ltd
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
accept-language: de-CH,de;q=0.9

Response headers

content-encoding: br
content-type: text/html
date: Wed, 30 Aug 2023 18:56:48 GMT
etag: W/"64ef90ef-10b9a"
last-modified: Wed, 30 Aug 2023 18:56:47 GMT
server: nginx
x-powered-by: PleskLin

Redirect headers

content-length: 250
content-type: text/html; charset=iso-8859-1
date: Wed, 30 Aug 2023 18:56:47 GMT
location: https://sensonadiago.duckdns.org/ce/2f504/
server: nginx
x-powered-by: PleskLin

GET
H2 200 sso.min-20200819.css
sensonadiago.duckdns.org/ce/2f504/css/ 180 KB
21 KB 145ms
145ms Stylesheet
text/css 62.4.29.78
Online SAS

General

Check archive.org

Show headers Download Go to

Full URL: https://sensonadiago.duckdns.org/ce/2f504/css/sso.min-20200819.css
Requested by: Host: sensonadiago.duckdns.org
URL: https://sensonadiago.duckdns.org/ce/2f504/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 62.4.29.78 Paray-Vieille-Poste, France, ASN12876 (Online SAS, FR),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: fd23aeccc08239852a5ac678a7cc5b29c723987a0287674000b930cf606b115e

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://sensonadiago.duckdns.org/ce/2f504/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 30 Aug 2023 18:56:48 GMT
content-encoding: br
last-modified: Wed, 30 Aug 2023 18:56:47 GMT
server: nginx
etag: W/"64ef90ef-2cf01"
x-powered-by: PleskLin
content-type: text/css

GET
H/1.1 200
OK logo_text_de-20200819.svg
www.swisspass.ch//resources/img/ 137 KB
138 KB 77ms
19ms Image
image/svg+xml 193.203.121.166
SBB-CFF-FFS Telec...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.swisspass.ch//resources/img/logo_text_de-20200819.svg

Requested by

Host: sensonadiago.duckdns.org
URL: https://sensonadiago.duckdns.org/ce/2f504/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

193.203.121.166 , Switzerland, ASN31004 (SBB-CFF-FFS Telecom SBB, CH),

Reverse DNS

Software

Apache /

Resource Hash

c337d42ed7979c6be0282900bd957dd9d112a430dc7761463d655eb8f0d9bc07

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://sensonadiago.duckdns.org/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date: Wed, 30 Aug 2023 18:56:48 GMT
Strict-Transport-Security: max-age=16070400
X-Content-Type-Options: nosniff
Connection: Keep-Alive
Content-Length: 139971
X-XSS-Protection: 1; mode=block
Referrer-Policy: same-origin
last-modified: Tue, 15 Aug 2023 11:04:17 GMT
Server: Apache
etag: "64db5bb1-222c3"
X-Frame-Options: SAMEORIGIN
Content-Type: image/svg+xml
cache-control: max-age=31536000, private
Feature-Policy: autoplay 'self'; camera 'self'; display-capture 'self'; document-domain 'self'; encrypted-media 'self'; fullscreen 'self'; geolocation 'self'; microphone 'self'; midi 'self'; payment 'self'; xr-spatial-tracking 'self'
accept-ranges: bytes
Keep-Alive: timeout=10, max=500
expires: Thu, 29 Aug 2024 18:56:48 GMT

GET
H/1.1 200
OK logo-20200819.svg
www.swisspass.ch//resources/img/ 7 KB
8 KB 74ms
30ms Image
image/svg+xml 193.203.121.166
SBB-CFF-FFS Telec...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.swisspass.ch//resources/img/logo-20200819.svg

Requested by

Host: sensonadiago.duckdns.org
URL: https://sensonadiago.duckdns.org/ce/2f504/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

193.203.121.166 , Switzerland, ASN31004 (SBB-CFF-FFS Telecom SBB, CH),

Reverse DNS

Software

Apache /

Resource Hash

deeee170c3759a6ed35c0c05c5b935d0e7638f1c0c5677166918ecff6edb1909

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://sensonadiago.duckdns.org/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Date: Wed, 30 Aug 2023 18:56:48 GMT
Strict-Transport-Security: max-age=16070400
X-Content-Type-Options: nosniff
Connection: Keep-Alive
Content-Length: 7374
X-XSS-Protection: 1; mode=block
Referrer-Policy: same-origin
last-modified: Tue, 15 Aug 2023 11:04:17 GMT
Server: Apache
etag: "64db5bb1-1cce"
X-Frame-Options: SAMEORIGIN
Content-Type: image/svg+xml
cache-control: max-age=31536000, private
Feature-Policy: autoplay 'self'; camera 'self'; display-capture 'self'; document-domain 'self'; encrypted-media 'self'; fullscreen 'self'; geolocation 'self'; microphone 'self'; midi 'self'; payment 'self'; xr-spatial-tracking 'self'
accept-ranges: bytes
Keep-Alive: timeout=10, max=500
expires: Thu, 29 Aug 2024 18:56:48 GMT

GET
H2 404 loader-20200819.png
sensonadiago.duckdns.org/ce/2f504/ 808 B
808 B 311ms
311ms Image
text/html 62.4.29.78
Online SAS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sensonadiago.duckdns.org/ce/2f504/loader-20200819.png
Requested by: Host: sensonadiago.duckdns.org
URL: https://sensonadiago.duckdns.org/ce/2f504/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 62.4.29.78 Paray-Vieille-Poste, France, ASN12876 (Online SAS, FR),
Reverse DNS
Software: nginx /
Resource Hash: b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://sensonadiago.duckdns.org/ce/2f504/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 30 Aug 2023 18:56:48 GMT
content-encoding: br
last-modified: Tue, 29 Aug 2023 13:42:21 GMT
server: nginx
etag: W/"328-6040ffaf4241b"
content-type: text/html

GET
H2 200 jquery-20200819.js.download Show response
sensonadiago.duckdns.org/ce/2f504/js/ 95 KB
32 KB 310ms
309ms Script
application/javascript 62.4.29.78
Online SAS

General

Check archive.org

Show headers Download Go to

Full URL: https://sensonadiago.duckdns.org/ce/2f504/js/jquery-20200819.js.download
Requested by: Host: sensonadiago.duckdns.org
URL: https://sensonadiago.duckdns.org/ce/2f504/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 62.4.29.78 Paray-Vieille-Poste, France, ASN12876 (Online SAS, FR),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 24f31a4afb4d98c85b6cff4c9a953654a77986d6c4c9e9cae52cf57e59095e01

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://sensonadiago.duckdns.org/ce/2f504/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 30 Aug 2023 18:56:48 GMT
content-encoding: br
last-modified: Wed, 30 Aug 2023 18:56:47 GMT
server: nginx
etag: W/"64ef90ef-17c54"
x-powered-by: PleskLin
content-type: application/javascript

GET
H2 200 vendor.min-20200819.js.download Show response
sensonadiago.duckdns.org/ce/2f504/js/ 175 KB
50 KB 224ms
223ms Script
application/javascript 62.4.29.78
Online SAS

General

Check archive.org

Show headers Download Go to

Full URL: https://sensonadiago.duckdns.org/ce/2f504/js/vendor.min-20200819.js.download
Requested by: Host: sensonadiago.duckdns.org
URL: https://sensonadiago.duckdns.org/ce/2f504/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 62.4.29.78 Paray-Vieille-Poste, France, ASN12876 (Online SAS, FR),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: be0223ae72bc8c610c7a5453d349964cbe78ff8646695a58bc13a4cf0a8d81d6

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://sensonadiago.duckdns.org/ce/2f504/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 30 Aug 2023 18:56:48 GMT
content-encoding: br
last-modified: Wed, 30 Aug 2023 18:56:47 GMT
server: nginx
etag: W/"64ef90ef-2bc0a"
x-powered-by: PleskLin
content-type: application/javascript

GET
H2 200 swisspass.min-20200819.js.download Show response
sensonadiago.duckdns.org/ce/2f504/js/ 97 KB
24 KB 289ms
288ms Script
application/javascript 62.4.29.78
Online SAS

General

Check archive.org

Show headers Download Go to

Full URL: https://sensonadiago.duckdns.org/ce/2f504/js/swisspass.min-20200819.js.download
Requested by: Host: sensonadiago.duckdns.org
URL: https://sensonadiago.duckdns.org/ce/2f504/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 62.4.29.78 Paray-Vieille-Poste, France, ASN12876 (Online SAS, FR),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 225e078f0432e7459d74e8d9245f1982570a3897d664ca2d219ccd09b244ab95

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://sensonadiago.duckdns.org/ce/2f504/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 30 Aug 2023 18:56:48 GMT
content-encoding: br
last-modified: Wed, 30 Aug 2023 18:56:47 GMT
server: nginx
etag: W/"64ef90ef-183fc"
x-powered-by: PleskLin
content-type: application/javascript

GET
H2 200 SBBWeb-Light.woff2
cdn.app.sbb.ch/fonts/v1_6_subset/ 14 KB
14 KB 98ms
40ms Font
application/font-woff2 18.193.245.155
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.app.sbb.ch/fonts/v1_6_subset/SBBWeb-Light.woff2
Requested by: Host: sensonadiago.duckdns.org
URL: https://sensonadiago.duckdns.org/ce/2f504/css/sso.min-20200819.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.193.245.155 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-193-245-155.eu-central-1.compute.amazonaws.com
Software: nginx/1.23.2 /
Resource Hash: 5c7f0e173844556da7ca5eb8936fa3dab1c00206960920a49a1eea9cde2bfaaf

Request headers

Referer: https://sensonadiago.duckdns.org/
Origin: https://sensonadiago.duckdns.org
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 30 Aug 2023 18:56:48 GMT
content-encoding: br
last-modified: Fri, 17 Dec 2021 15:16:26 GMT
server: nginx/1.23.2
etag: W/"61bca9ca-3784"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: max-age=31536000, public, private
access-control-allow-credentials: true
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With
expires: Thu, 29 Aug 2024 18:56:48 GMT

GET
H2 404 icomoon.woff2
sensonadiago.duckdns.org/fonts/icomoon/ 0
0 35ms
35ms Font
text/html 62.4.29.78
Online SAS

General

Check archive.org

Show headers Download Go to

Full URL: https://sensonadiago.duckdns.org/fonts/icomoon/icomoon.woff2?7m5yri
Requested by: Host: sensonadiago.duckdns.org
URL: https://sensonadiago.duckdns.org/ce/2f504/css/sso.min-20200819.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 62.4.29.78 Paray-Vieille-Poste, France, ASN12876 (Online SAS, FR),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Referer: https://sensonadiago.duckdns.org/ce/2f504/css/sso.min-20200819.css
Origin: https://sensonadiago.duckdns.org
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 30 Aug 2023 18:56:48 GMT
content-encoding: br
last-modified: Tue, 29 Aug 2023 13:42:21 GMT
server: nginx
etag: W/"328-6040ffaf4241b"
content-type: text/html

GET
H2 404 icomoon.ttf
sensonadiago.duckdns.org/fonts/icomoon/ 0
0 45ms
45ms Font
text/html 62.4.29.78
Online SAS

General

Check archive.org

Show headers Download Go to

Full URL: https://sensonadiago.duckdns.org/fonts/icomoon/icomoon.ttf?7m5yri
Requested by: Host: sensonadiago.duckdns.org
URL: https://sensonadiago.duckdns.org/ce/2f504/css/sso.min-20200819.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 62.4.29.78 Paray-Vieille-Poste, France, ASN12876 (Online SAS, FR),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Referer: https://sensonadiago.duckdns.org/ce/2f504/css/sso.min-20200819.css
Origin: https://sensonadiago.duckdns.org
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 30 Aug 2023 18:56:48 GMT
content-encoding: br
last-modified: Tue, 29 Aug 2023 13:42:21 GMT
server: nginx
etag: W/"328-6040ffaf4241b"
content-type: text/html

GET
H2 404 icomoon.woff
sensonadiago.duckdns.org/fonts/icomoon/ 0
0 49ms
49ms Font
text/html 62.4.29.78
Online SAS

General

Check archive.org

Show headers Download Go to

Full URL: https://sensonadiago.duckdns.org/fonts/icomoon/icomoon.woff?7m5yri
Requested by: Host: sensonadiago.duckdns.org
URL: https://sensonadiago.duckdns.org/ce/2f504/css/sso.min-20200819.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 62.4.29.78 Paray-Vieille-Poste, France, ASN12876 (Online SAS, FR),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Referer: https://sensonadiago.duckdns.org/ce/2f504/css/sso.min-20200819.css
Origin: https://sensonadiago.duckdns.org
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 30 Aug 2023 18:56:48 GMT
content-encoding: br
last-modified: Tue, 29 Aug 2023 13:42:21 GMT
server: nginx
etag: W/"328-6040ffaf4241b"
content-type: text/html

GET
H2 404 co-branding Show response
sensonadiago.duckdns.org/idp/ 808 B
501 B 38ms
37ms XHR
text/html 62.4.29.78
Online SAS

General

Check archive.org

Show headers Download Go to

Full URL: https://sensonadiago.duckdns.org/idp/co-branding?resource=co-branding&lang=de&provider=sbbkn
Requested by: Host: sensonadiago.duckdns.org
URL: https://sensonadiago.duckdns.org/ce/2f504/js/jquery-20200819.js.download
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 62.4.29.78 Paray-Vieille-Poste, France, ASN12876 (Online SAS, FR),
Reverse DNS
Software: nginx /
Resource Hash: b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187

Request headers

Accept: */*
Referer: https://sensonadiago.duckdns.org/ce/2f504/
X-Requested-With: XMLHttpRequest
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 30 Aug 2023 18:56:48 GMT
content-encoding: br
last-modified: Tue, 29 Aug 2023 13:42:21 GMT
server: nginx
etag: W/"328-6040ffaf4241b"
content-type: text/html

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Schweizerische Bundesbahnen (Transportation)

20 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			red-efkbc.formstack.com/forms/	1969-12-31 23:59:59	Name: PHPSESSID Value: 0c0bf40b91521ff4c1eb31531bfab024
			.www.swisspass.ch/	1969-12-31 23:59:59	Name: AL_SESS-S Value: ASxptErYEx1TlP6TaIf9mdSAjJpBk9hDSA_lMAx_rHQ4VncKByuN2ltWDnzzMkts_bng

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://sensonadiago.duckdns.org/fonts/icomoon/icomoon.woff2?7m5yri Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://sensonadiago.duckdns.org/fonts/icomoon/icomoon.ttf?7m5yri Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://sensonadiago.duckdns.org/fonts/icomoon/icomoon.woff?7m5yri Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://sensonadiago.duckdns.org/ce/2f504/loader-20200819.png Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://sensonadiago.duckdns.org/idp/co-branding?resource=co-branding&lang=de&provider=sbbkn Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cdn.app.sbb.ch
fonts.googleapis.com
fonts.gstatic.com
red-efkbc.formstack.com
sensonadiago.duckdns.org
static.formstack.com
www.swisspass.ch
18.193.245.155
18.66.122.60
193.203.121.166
2a00:1450:4001:813::200a
2a00:1450:4001:827::200a
2a00:1450:4001:830::2003
62.4.29.78
225e078f0432e7459d74e8d9245f1982570a3897d664ca2d219ccd09b244ab95
24f31a4afb4d98c85b6cff4c9a953654a77986d6c4c9e9cae52cf57e59095e01
253cc6b9492d92ebefa081634dd02241b33c4bd83e17af332305f8e91cf39ace
53c97063f6ea5b3487fd85cb98b0c47b41f1269fca482b2799b9c7067f051865
5853c97750a92fe500e0462b349e255af956b9c156c0ef9396a37ca2617ade57
5c7f0e173844556da7ca5eb8936fa3dab1c00206960920a49a1eea9cde2bfaaf
65763fb39f393cdc1fe959c7f3d55a7ca65cedfce32f65d1d92315088bd4e7d7
81016ac6be850b72df5d4faa0c3cec8e2c1b0ba0045712144a6766adfad40bee
86d5823df9f96c928e9981519128e09bf8f745ca88e690be0b342b5ce904d394
9528ca634fecad433d044ddd3e6f9ce1f068d5d932dafdbb19d8e6daea1968bd
9fc43e8f6f26a254c4570b6ccd4e08a2a5f97bedcd1f3491ede9bbb8b5012d90
af420c807b04fdb5136ef53f3bab83b81f2b94e43fa9856f1fad2fde88383744
af897a5f18c00a272750446a9c34d8e024e18813260c4cfef79db22dc4fdf2bb
b0730434e9e350680ced98724525a505ac7a7e57c4bbc4472e59ae3b4275ec6d
b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187
be0223ae72bc8c610c7a5453d349964cbe78ff8646695a58bc13a4cf0a8d81d6
c337d42ed7979c6be0282900bd957dd9d112a430dc7761463d655eb8f0d9bc07
cb5a0ad9bef0638ca62747ac1fb1a33d2a5b4c52592bce32ccf9b31089ab4a16
cffb42db3164808a6ff8f25601fdbd53e9623262ae8f38cd1b6a458819cc8ead
deeee170c3759a6ed35c0c05c5b935d0e7638f1c0c5677166918ecff6edb1909
e2781619082fe50667bce285f562c3dfa98b589f0854da4a333a00d0f4b6c318
e66e84dc3a4ac1d2d7cb7246637243cbd71c58d6b576c428330cc0699ea3c1e7
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fd23aeccc08239852a5ac678a7cc5b29c723987a0287674000b930cf606b115e

sensonadiago.duckdns.org Open in urlscan Pro 62.4.29.78 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

31 Requests

100 %HTTPS

43 %IPv6

6 Domains

8 Subdomains

7 IPs

4 Countries

503 kBTransfer

1422 kBSize

2 Cookies

4 Outgoing links

Page URL History

Redirected requests

31 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

sensonadiago.duckdns.org Open in urlscan Pro
62.4.29.78 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

31
Requests

100 %
HTTPS

43 %
IPv6

6
Domains

8
Subdomains

7
IPs

4
Countries

503 kB
Transfer

1422 kB
Size

2
Cookies

31 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!