ferrocarriles-federales-suizos.web.app
Open in
urlscan Pro
2620:0:890::100
Malicious Activity!
Public Scan
Submission: On April 27 via automatic, source openphish — Scanned from DE
Summary
TLS certificate: Issued by GTS CA 1D4 on March 6th 2023. Valid for: 3 months.
This is the only time ferrocarriles-federales-suizos.web.app was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Schweizerische Bundesbahnen (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 2620:0:890::100 2620:0:890::100 | 54113 (FASTLY) (FASTLY) | |
18 | 104.154.100.138 104.154.100.138 | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM) | |
1 | 2a00:1450:400... 2a00:1450:4001:80e::200e | 15169 (GOOGLE) (GOOGLE) | |
2 | 162.19.58.161 162.19.58.161 | 16276 (OVH) (OVH) | |
3 | 2a02:26f0:f50... 2a02:26f0:f500:38c::312e | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
3 | 3.127.130.128 3.127.130.128 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2a00:1450:400... 2a00:1450:4001:80b::2002 | 15169 (GOOGLE) (GOOGLE) | |
1 | 45.90.57.160 45.90.57.160 | () () | |
30 | 8 |
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 138.100.154.104.bc.googleusercontent.com
gulf-coast-web.websitepro-staging.com |
ASN15169 (GOOGLE, US)
encrypted-tbn0.gstatic.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-3-127-130-128.eu-central-1.compute.amazonaws.com
cdn.app.sbb.ch |
ASN15169 (GOOGLE, US)
securepubads.g.doubleclick.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
18 |
websitepro-staging.com
gulf-coast-web.websitepro-staging.com |
359 KB |
3 |
sbb.ch
cdn.app.sbb.ch — Cisco Umbrella Rank: 533686 |
44 KB |
3 |
flaticon.com
cdn-icons-png.flaticon.com — Cisco Umbrella Rank: 46059 |
48 KB |
2 |
ibb.co
i.ibb.co — Cisco Umbrella Rank: 10780 |
8 KB |
1 |
propertytax4less.com
examples.propertytax4less.com |
146 B |
1 |
doubleclick.net
securepubads.g.doubleclick.net — Cisco Umbrella Rank: 269 |
129 KB |
1 |
gstatic.com
encrypted-tbn0.gstatic.com |
3 KB |
1 |
web.app
ferrocarriles-federales-suizos.web.app |
1005 B |
30 | 8 |
Domain | Requested by | |
---|---|---|
18 | gulf-coast-web.websitepro-staging.com |
ferrocarriles-federales-suizos.web.app
gulf-coast-web.websitepro-staging.com |
3 | cdn.app.sbb.ch |
gulf-coast-web.websitepro-staging.com
|
3 | cdn-icons-png.flaticon.com |
gulf-coast-web.websitepro-staging.com
|
2 | i.ibb.co |
gulf-coast-web.websitepro-staging.com
|
1 | examples.propertytax4less.com |
ferrocarriles-federales-suizos.web.app
|
1 | securepubads.g.doubleclick.net |
gulf-coast-web.websitepro-staging.com
|
1 | encrypted-tbn0.gstatic.com |
gulf-coast-web.websitepro-staging.com
|
1 | ferrocarriles-federales-suizos.web.app | |
30 | 8 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
web.app GTS CA 1D4 |
2023-03-06 - 2023-06-04 |
3 months | crt.sh |
*.websitepro-staging.com R3 |
2023-03-27 - 2023-06-25 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-04-03 - 2023-06-26 |
3 months | crt.sh |
i.ibb.co R3 |
2023-04-11 - 2023-07-10 |
3 months | crt.sh |
freepik.com Sectigo RSA Domain Validation Secure Server CA |
2022-07-22 - 2023-07-22 |
a year | crt.sh |
*.app.sbb.ch Amazon RSA 2048 M01 |
2023-02-10 - 2023-10-14 |
8 months | crt.sh |
*.g.doubleclick.net GTS CA 1C3 |
2023-04-03 - 2023-06-26 |
3 months | crt.sh |
examples.propertytax4less.com ZeroSSL ECC Domain Secure Site CA |
2023-03-29 - 2023-06-27 |
3 months | crt.sh |
This page contains 4 frames:
Primary Page:
https://ferrocarriles-federales-suizos.web.app/
Frame ID: B52916CF32E0944E4DC5ABB4D1AD2418
Requests: 1 HTTP requests in this frame
Frame:
https://gulf-coast-web.websitepro-staging.com/wp-admin/sbkba/sbbkonak/
Frame ID: 1A97A6632AE9A0AABFA70B6D9919249D
Requests: 26 HTTP requests in this frame
Frame:
https://gulf-coast-web.websitepro-staging.com/wp-admin/sbkba/sbbkonak/index_files/aframe.html
Frame ID: B77A379430C54DDD0BB268DD7A6FEAE9
Requests: 2 HTTP requests in this frame
Frame:
https://gulf-coast-web.websitepro-staging.com/wp-admin/sbkba/sbbkonak/index_files/saved_resource(1).html
Frame ID: 5220EDDC70DDF819D277FF5852AE7B6A
Requests: 1 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
30 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
ferrocarriles-federales-suizos.web.app/ |
959 B 1005 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
gulf-coast-web.websitepro-staging.com/wp-admin/sbkba/sbbkonak/ Frame 1A97 |
39 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
base.min.css
gulf-coast-web.websitepro-staging.com/wp-admin/sbkba/sbbkonak/index_files/ Frame 1A97 |
51 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
head.min.js
gulf-coast-web.websitepro-staging.com/wp-admin/sbkba/sbbkonak/index_files/ Frame 1A97 |
53 KB 18 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
otBannerSdk.js
gulf-coast-web.websitepro-staging.com/wp-admin/sbkba/sbbkonak/index_files/ Frame 1A97 |
363 KB 88 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
otTCF.js
gulf-coast-web.websitepro-staging.com/wp-admin/sbkba/sbbkonak/index_files/ Frame 1A97 |
72 KB 16 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
12.min.js
gulf-coast-web.websitepro-staging.com/wp-admin/sbkba/sbbkonak/index_files/ Frame 1A97 |
11 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2.min.js
gulf-coast-web.websitepro-staging.com/wp-admin/sbkba/sbbkonak/index_files/ Frame 1A97 |
45 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lux.js
gulf-coast-web.websitepro-staging.com/wp-admin/sbkba/sbbkonak/index_files/ Frame 1A97 |
22 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gpt.js
gulf-coast-web.websitepro-staging.com/wp-admin/sbkba/sbbkonak/index_files/ Frame 1A97 |
85 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pubads_impl_2022071401.js
gulf-coast-web.websitepro-staging.com/wp-admin/sbkba/sbbkonak/index_files/ Frame 1A97 |
381 KB 131 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
f.txt
gulf-coast-web.websitepro-staging.com/wp-admin/sbkba/sbbkonak/index_files/ Frame 1A97 |
107 B 306 B |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
f(1).txt
gulf-coast-web.websitepro-staging.com/wp-admin/sbkba/sbbkonak/index_files/ Frame 1A97 |
210 B 409 B |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
0.min.js
gulf-coast-web.websitepro-staging.com/wp-admin/sbkba/sbbkonak/index_files/ Frame 1A97 |
70 KB 23 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
header.min.css
gulf-coast-web.websitepro-staging.com/wp-admin/sbkba/sbbkonak/index_files/ Frame 1A97 |
62 KB 10 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
images
encrypted-tbn0.gstatic.com/ Frame 1A97 |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
button-anmelden-mit-swisspass.png
i.ibb.co/rvJSbmd/ Frame 1A97 |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
button-anmelden-mit-swissid.png
i.ibb.co/GFpD5vY/ Frame 1A97 |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
197560.png
cdn-icons-png.flaticon.com/512/197/ Frame 1A97 |
16 KB 16 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
197374.png
cdn-icons-png.flaticon.com/512/197/ Frame 1A97 |
19 KB 19 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
197571.png
cdn-icons-png.flaticon.com/512/197/ Frame 1A97 |
11 KB 12 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
coleiras-e-guias.php
gulf-coast-web.websitepro-staging.com/coleiras-e-guias/ Frame 1A97 |
254 B 478 B |
XHR
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
aframe.html
gulf-coast-web.websitepro-staging.com/wp-admin/sbkba/sbbkonak/index_files/ Frame B77A |
856 B 752 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
saved_resource(1).html
gulf-coast-web.websitepro-staging.com/wp-admin/sbkba/sbbkonak/index_files/ Frame 5220 |
149 B 348 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
SBBWeb-Thin.woff2
cdn.app.sbb.ch/fonts/v1_6_subset/ Frame 1A97 |
14 KB 15 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
SBBWeb-Roman.woff2
cdn.app.sbb.ch/fonts/v1_6_subset/ Frame 1A97 |
14 KB 14 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
SBBWeb-Bold.woff2
cdn.app.sbb.ch/fonts/v1_6_subset/ Frame 1A97 |
14 KB 15 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pubads_impl_2022071201.js
securepubads.g.doubleclick.net/gpt/ Frame 1A97 |
376 KB 129 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sodar
gulf-coast-web.websitepro-staging.com/wp-admin/sbkba/sbbkonak/index_files/ Frame B77A |
0 196 B |
Image
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
O2EXVJ9reAOeEPhto8Sl+IzdPyrC7+1YIZSrxcVlr9I=
examples.propertytax4less.com/ Frame 1A97 |
0 146 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Schweizerische Bundesbahnen (Transportation)12 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 boolean| credentialless string| h object| a object| j function| m object| k number| g number| f string| c string| b function| n0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31556926; includeSubDomains; preload |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn-icons-png.flaticon.com
cdn.app.sbb.ch
encrypted-tbn0.gstatic.com
examples.propertytax4less.com
ferrocarriles-federales-suizos.web.app
gulf-coast-web.websitepro-staging.com
i.ibb.co
securepubads.g.doubleclick.net
104.154.100.138
162.19.58.161
2620:0:890::100
2a00:1450:4001:80b::2002
2a00:1450:4001:80e::200e
2a02:26f0:f500:38c::312e
3.127.130.128
45.90.57.160
0d075f82e2b4f4fa762101ae95488a425d2df9f40c5b7e120954509c635879bf
16d2af8dfe6bff63fd76dc7434e09f1c98de85b1aa8d35ab98b473bae3c1f97d
16f3edd6edf6442997554cb9714ff22292e79c866746b959f1584fc9603a2e1d
1e01bf738bc665f149b0793af461a43f4330ecf99dd068e2b7abd038c46ef417
204f21ee0e2782f28ecaf89880622779d9e581217cbb7fe80858d6614321bd35
2935f6cbdebc3fdf2a3807e29d6cb7c47ae93ab1b509f9c8fec2f61bd524abd0
31e3f3b8d157033e12a242a2e2fbbf3c9d0b3d7dd3b57a50d8ffb0c0182f4374
3cc833064e351d0160a6ccf6b8604253aa68c76e9783258f9fa810fcbf1c97c5
43e3aeb3dab72706d6e3a315dce4f4e3af17c85c35966aaa26ff8850ce4ddde9
442f8504927c54cdfd132124b08fe51c84bdf36ce82cf4c8b61c0e79b24ad138
4e15712871dd70782e401a035c555c121ea187e88a6b0e8c30b6f43d0cf1072a
57ff8cee5f79f79b415d76d23ecfb07914e0444e26a94ea235ba19877d52c39f
616dce16792af8ea570e75c38e5f7c7cc8d12f7d014206a2730ef52e1c767af5
896a174a3d1e91ab91897a39794b92bd0a8596ac5badf5e9f20da2afb5b1138c
8d2779a4b048d712db5240442a113677131f11674ea0a5fc3f10d7eb9c3f9ea0
966a89b8080879ba41c6b9f15c5efb58182c33a0d2d1e08748beb554b28b4997
9716b689c64d0366f1a86573b15b50f25b5ed54e2eff6021bee345cb6f6f2e1e
97f9b10039b05e1af4a3c9b778fc72ba44cf68a376e4ec1d55f2558f16cf3e50
9963b950fdfca9e352a466453b67e0c172c0e33598ed18b8e825498bdc24817f
9ead1bc194a3a01035de7f65160c91b32604d2c788b35a914543c34ef451cd3a
a2a5d769e44b3734e395054347a17ed912ee5fbca0dc5fb606274075665e5afe
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a4c6d5f6d1e9b525ec39f17e3910b69cd3be21c697c2fb7a10e6a8c069f8c946
bd640fb21af72b1ef707112f2b83238f8a6bec2a585fdc40da41c9346eecb4bd
d54c676681d2c4e3b931e77908b1345441a0cf6e8f2339d4d3a56c1083aab7e6
d5a335190307402516082d0274bde12fa482d20ce04da3a36f79296b244509e4
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f069a80a8f0838dc76f55359c8599ee04d3c66004c6513de7cbf382df4bb59e2
f2a0dd07bcea2dea98365680bd73b62b2e13fa6a41d32b4ee046913e99b7f01e