schweizonline.eu Open in urlscan Pro
91.229.239.241 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://schweizonline.eu/suis/
Effective URL:
https://schweizonline.eu/suis/app/index.php?view=main&id=a03de83e3d4163a0cbd86f248225c217
Submission Tags: @ecarlesi possiblethreat Search All
Submission: On October 16 via api (October 16th 2024, 7:52:00 pm UTC) from IT — Scanned from IT

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 9 HTTP transactions. The main IP is 91.229.239.241, located in Moldova and belongs to ALEXHOST, MD. The main domain is schweizonline.eu.
TLS certificate: Issued by R10 on October 16th 2024. Valid for: 3 months.

This is the only time schweizonline.eu was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Schweizerische Bundesbahnen (Transportation)

Domain & IP information

	IP Address		AS Autonomous System
1 10	91.229.239.241 91.229.239.241		200019 (ALEXHOST) (ALEXHOST)
9	1

10 91.229.239.241 (Moldova) 1 redirects

ASN200019 (ALEXHOST, MD)
PTR: schweizonline-ch

schweizonline.eu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	schweizonline.eu 1 redirects schweizonline.eu	248 KB
9	1

	Domain	Requested by
10	schweizonline.eu	1 redirects schweizonline.eu
9	1

This site contains no links.

Subject Issuer	Validity	Valid
schweizonline.eu R10	`2024-10-16` - `2025-01-14`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://schweizonline.eu/suis/app/index.php?view=main&id=a03de83e3d4163a0cbd86f248225c217
Frame ID: A0783D337ED6BA6B197E236ED9D381CC
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Login | SwissPass

Page URL History Show full URLs

https://schweizonline.eu/suis/ HTTP 302
https://schweizonline.eu/suis/app/index.php?view=main&id=a03de83e3d4163a0cbd86f248225c217 Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

248 kB
Transfer

501 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://schweizonline.eu/suis/ HTTP 302
https://schweizonline.eu/suis/app/index.php?view=main&id=a03de83e3d4163a0cbd86f248225c217 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request index.php Show response schweizonline.eu/suis/app/ Redirect Chain https://schweizonline.eu/suis/ https://schweizonline.eu/suis/app/index.php?view=main&id=a03de83e3d4163a0cbd86f248225c217	158 KB 26 KB	432ms 431ms	Document text/html	91.229.239.241 ALEXHOST
General Check archive.org Show headers Download Go to Full URL https://schweizonline.eu/suis/app/index.php?view=main&id=a03de83e3d4163a0cbd86f248225c217 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 91.229.239.241 , Moldova, ASN200019 (ALEXHOST, MD), Reverse DNS schweizonline-ch Software Apache/2.4.52 (Ubuntu) / Resource Hash `bc1428d6e63e7cc66da68f871ade238d87cbf4e71a90961e99d66656b7c82d2c` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Response headers Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Content-Encoding gzip Content-Length 26534 Content-Type text/html; charset=UTF-8 Date Wed, 16 Oct 2024 19:51:45 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=99 Pragma no-cache Server Apache/2.4.52 (Ubuntu) Vary Accept-Encoding Redirect headers Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Content-Length 0 Content-Type text/html; charset=UTF-8 Date Wed, 16 Oct 2024 19:51:44 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=100 Location app/index.php?view=main&id=a03de83e3d4163a0cbd86f248225c217 Pragma no-cache Server Apache/2.4.52 (Ubuntu)
GET H/1.1	200 OK	styles.293b78715b3ccf3b.css schweizonline.eu/suis/app/files/	146 KB 22 KB	530ms 344ms	Stylesheet text/css	91.229.239.241 ALEXHOST
General Check archive.org Show headers Download Go to Full URL https://schweizonline.eu/suis/app/files/styles.293b78715b3ccf3b.css Requested by Host: schweizonline.eu URL: https://schweizonline.eu/suis/app/index.php?view=main&id=a03de83e3d4163a0cbd86f248225c217 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 91.229.239.241 , Moldova, ASN200019 (ALEXHOST, MD), Reverse DNS schweizonline-ch Software Apache/2.4.52 (Ubuntu) / Resource Hash `b437cb2204b6e4b986c65ed67a7682123df1507812ad940c2791f37748350429` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://schweizonline.eu/suis/app/index.php?view=main&id=a03de83e3d4163a0cbd86f248225c217 Response headers Content-Encoding gzip ETag "24821-623473fc83700-gzip" Connection Keep-Alive Accept-Ranges bytes Content-Length 22492 Keep-Alive timeout=5, max=98 Date Wed, 16 Oct 2024 19:51:45 GMT Last-Modified Sun, 29 Sep 2024 19:39:40 GMT Vary Accept-Encoding Server Apache/2.4.52 (Ubuntu) Content-Type text/css
GET H/1.1	200 OK	logo.png schweizonline.eu/suis/app/files/img/	2 KB 2 KB	395ms 347ms	Image image/png	91.229.239.241 ALEXHOST
General Check archive.org Show headers Download Go to Show image Full URL https://schweizonline.eu/suis/app/files/img/logo.png Requested by Host: schweizonline.eu URL: https://schweizonline.eu/suis/app/index.php?view=main&id=a03de83e3d4163a0cbd86f248225c217 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 91.229.239.241 , Moldova, ASN200019 (ALEXHOST, MD), Reverse DNS schweizonline-ch Software Apache/2.4.52 (Ubuntu) / Resource Hash `710fc38b83ffa0a39ef53dda4a6d77359a2eea3aa8ad15c1873c7737a06515ec` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://schweizonline.eu/suis/app/index.php?view=main&id=a03de83e3d4163a0cbd86f248225c217 Response headers ETag "8b1-6234745258180" Connection Keep-Alive Accept-Ranges bytes Content-Length 2225 Keep-Alive timeout=5, max=100 Date Wed, 16 Oct 2024 19:51:46 GMT Last-Modified Sun, 29 Sep 2024 19:41:10 GMT Content-Type image/png Server Apache/2.4.52 (Ubuntu)
GET H/1.1	200 OK	logo_text_de-20200819.svg schweizonline.eu/suis/app/resources/img/	137 KB 137 KB	396ms 272ms	Image image/svg+xml	91.229.239.241 ALEXHOST
General Check archive.org Show headers Download Go to Show image Full URL https://schweizonline.eu/suis/app/resources/img/logo_text_de-20200819.svg Requested by Host: schweizonline.eu URL: https://schweizonline.eu/suis/app/index.php?view=main&id=a03de83e3d4163a0cbd86f248225c217 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 91.229.239.241 , Moldova, ASN200019 (ALEXHOST, MD), Reverse DNS schweizonline-ch Software Apache/2.4.52 (Ubuntu) / Resource Hash `c337d42ed7979c6be0282900bd957dd9d112a430dc7761463d655eb8f0d9bc07` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://schweizonline.eu/suis/app/index.php?view=main&id=a03de83e3d4163a0cbd86f248225c217 Response headers ETag "222c3-62347364e1140" Connection Keep-Alive Accept-Ranges bytes Content-Length 139971 Keep-Alive timeout=5, max=97 Date Wed, 16 Oct 2024 19:51:46 GMT Last-Modified Sun, 29 Sep 2024 19:37:01 GMT Content-Type image/svg+xml Server Apache/2.4.52 (Ubuntu)
GET H/1.1	200 OK	logo-20200819.svg schweizonline.eu/suis/app/resources/img/	7 KB 7 KB	284ms 98ms	Image image/svg+xml	91.229.239.241 ALEXHOST
General Check archive.org Show headers Download Go to Show image Full URL https://schweizonline.eu/suis/app/resources/img/logo-20200819.svg Requested by Host: schweizonline.eu URL: https://schweizonline.eu/suis/app/index.php?view=main&id=a03de83e3d4163a0cbd86f248225c217 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 91.229.239.241 , Moldova, ASN200019 (ALEXHOST, MD), Reverse DNS schweizonline-ch Software Apache/2.4.52 (Ubuntu) / Resource Hash `deeee170c3759a6ed35c0c05c5b935d0e7638f1c0c5677166918ecff6edb1909` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://schweizonline.eu/suis/app/index.php?view=main&id=a03de83e3d4163a0cbd86f248225c217 Response headers ETag "1cce-623473ae4fe80" Connection Keep-Alive Accept-Ranges bytes Content-Length 7374 Keep-Alive timeout=5, max=100 Date Wed, 16 Oct 2024 19:51:46 GMT Last-Modified Sun, 29 Sep 2024 19:38:18 GMT Content-Type image/svg+xml Server Apache/2.4.52 (Ubuntu)
GET H/1.1	200 OK	OneTrust_SwissPass_logo_mobile.png schweizonline.eu/suis/app/files/img/	2 KB 2 KB	271ms 71ms	Image image/png	91.229.239.241 ALEXHOST
General Check archive.org Show headers Download Go to Show image Full URL https://schweizonline.eu/suis/app/files/img/OneTrust_SwissPass_logo_mobile.png Requested by Host: schweizonline.eu URL: https://schweizonline.eu/suis/app/index.php?view=main&id=a03de83e3d4163a0cbd86f248225c217 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 91.229.239.241 , Moldova, ASN200019 (ALEXHOST, MD), Reverse DNS schweizonline-ch Software Apache/2.4.52 (Ubuntu) / Resource Hash `e42fe383c86ab1185425bf334a44f9a311dd06d8ccf9e409d05b45dbe0bc48c6` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://schweizonline.eu/suis/app/index.php?view=main&id=a03de83e3d4163a0cbd86f248225c217 Response headers ETag "7aa-62347beae2d40" Connection Keep-Alive Accept-Ranges bytes Content-Length 1962 Keep-Alive timeout=5, max=100 Date Wed, 16 Oct 2024 19:51:46 GMT Last-Modified Sun, 29 Sep 2024 20:15:09 GMT Content-Type image/png Server Apache/2.4.52 (Ubuntu)
GET H/1.1	200 OK	login_bg.png schweizonline.eu/suis/app/files/img/	184 B 468 B	253ms 63ms	Image image/png	91.229.239.241 ALEXHOST
General Check archive.org Show headers Download Go to Show image Full URL https://schweizonline.eu/suis/app/files/img/login_bg.png Requested by Host: schweizonline.eu URL: https://schweizonline.eu/suis/app/index.php?view=main&id=a03de83e3d4163a0cbd86f248225c217 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 91.229.239.241 , Moldova, ASN200019 (ALEXHOST, MD), Reverse DNS schweizonline-ch Software Apache/2.4.52 (Ubuntu) / Resource Hash `545244711b6b4506a511f9505e095665150b90408b1076fdc7095eae160f8c9b` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://schweizonline.eu/suis/app/index.php?view=main&id=a03de83e3d4163a0cbd86f248225c217 Response headers ETag "b8-6234744f7bac0" Connection Keep-Alive Accept-Ranges bytes Content-Length 184 Keep-Alive timeout=5, max=100 Date Wed, 16 Oct 2024 19:51:46 GMT Last-Modified Sun, 29 Sep 2024 19:41:07 GMT Content-Type image/png Server Apache/2.4.52 (Ubuntu)
GET H/1.1	200 OK	SBBWeb-Light.3f0cdd23274e17f7.woff2 schweizonline.eu/suis/app/files/	48 KB 48 KB	164ms 113ms	Font font/woff2	91.229.239.241 ALEXHOST
General Check archive.org Show headers Download Go to Full URL https://schweizonline.eu/suis/app/files/SBBWeb-Light.3f0cdd23274e17f7.woff2 Requested by Host: schweizonline.eu URL: https://schweizonline.eu/suis/app/files/styles.293b78715b3ccf3b.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 91.229.239.241 , Moldova, ASN200019 (ALEXHOST, MD), Reverse DNS schweizonline-ch Software Apache/2.4.52 (Ubuntu) / Resource Hash `de48fe7cfbd2082df946a69799cd1dd63caa7683edff423bb7cd4824d2152125` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://schweizonline.eu Referer https://schweizonline.eu/suis/app/files/styles.293b78715b3ccf3b.css Response headers ETag "c078-6234741366d00" Connection Keep-Alive Accept-Ranges bytes Content-Length 49272 Keep-Alive timeout=5, max=100 Date Wed, 16 Oct 2024 19:51:46 GMT Last-Modified Sun, 29 Sep 2024 19:40:04 GMT Content-Type font/woff2 Server Apache/2.4.52 (Ubuntu)
GET H/1.1	200 OK	favicon.ico schweizonline.eu/suis/app/files/img/	1 KB 1 KB	641ms 640ms	Other image/vnd.microsoft.icon	91.229.239.241 ALEXHOST
General Check archive.org Show headers Download Go to Full URL https://schweizonline.eu/suis/app/files/img/favicon.ico Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 91.229.239.241 , Moldova, ASN200019 (ALEXHOST, MD), Reverse DNS schweizonline-ch Software Apache/2.4.52 (Ubuntu) / Resource Hash `7c1925da382279a72f94990d0a1456f78918619f35780ea0905e4ae0db684677` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://schweizonline.eu/suis/app/index.php?view=main&id=a03de83e3d4163a0cbd86f248225c217 Response headers ETag "47e-62347ad469c40" Connection Keep-Alive Accept-Ranges bytes Content-Length 1150 Keep-Alive timeout=5, max=96 Date Wed, 16 Oct 2024 19:51:47 GMT Last-Modified Sun, 29 Sep 2024 20:10:17 GMT Content-Type image/vnd.microsoft.icon Server Apache/2.4.52 (Ubuntu)

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Schweizerische Bundesbahnen (Transportation)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			schweizonline.eu/	1969-12-31 23:59:59	Name: PHPSESSID Value: nikgdt4dcap0ej42hvstqjl81e

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

schweizonline.eu
91.229.239.241
545244711b6b4506a511f9505e095665150b90408b1076fdc7095eae160f8c9b
710fc38b83ffa0a39ef53dda4a6d77359a2eea3aa8ad15c1873c7737a06515ec
7c1925da382279a72f94990d0a1456f78918619f35780ea0905e4ae0db684677
b437cb2204b6e4b986c65ed67a7682123df1507812ad940c2791f37748350429
bc1428d6e63e7cc66da68f871ade238d87cbf4e71a90961e99d66656b7c82d2c
c337d42ed7979c6be0282900bd957dd9d112a430dc7761463d655eb8f0d9bc07
de48fe7cfbd2082df946a69799cd1dd63caa7683edff423bb7cd4824d2152125
deeee170c3759a6ed35c0c05c5b935d0e7638f1c0c5677166918ecff6edb1909
e42fe383c86ab1185425bf334a44f9a311dd06d8ccf9e409d05b45dbe0bc48c6

schweizonline.eu Open in urlscan Pro 91.229.239.241 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

9 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

248 kBTransfer

501 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

1 Cookies

Indicators

schweizonline.eu Open in urlscan Pro
91.229.239.241 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

248 kB
Transfer

501 kB
Size

1
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!