nvh41lbp3o.onrocket.site Open in urlscan Pro
2606:4700::6813:9a5c Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://nvh41lbp3o.onrocket.site/swc/index.php
Effective URL:
https://nvh41lbp3o.onrocket.site/swc/sw/username/?country.x=DE&locale.x=en_DE
Submission: On May 14 via automatic, source phishtank (May 14th 2022, 8:10:03 am UTC) — Scanned from DE

Summary HTTP 13 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 13 HTTP transactions. The main IP is 2606:4700::6813:9a5c, located in United States and belongs to CLOUDFLARENET, US. The main domain is nvh41lbp3o.onrocket.site.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on June 28th 2021. Valid for: a year.

This is the only time nvh41lbp3o.onrocket.site was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Swisscom (Telecommunication)

Domain & IP information

	IP Address		AS Autonomous System
2 15	2606:4700::68... 2606:4700::6813:9a5c		13335 (CLOUDFLAR...) (CLOUDFLARENET)
13	1

15 2606:4700::6813:9a5c (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

nvh41lbp3o.onrocket.site	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
15	onrocket.site 2 redirects nvh41lbp3o.onrocket.site	299 KB
13	1

	Domain	Requested by
15	nvh41lbp3o.onrocket.site	2 redirects nvh41lbp3o.onrocket.site
13	1

This site contains links to these domains. Also see Links.

Domain
www.swisscom.ch

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-06-28` - `2022-06-27`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://nvh41lbp3o.onrocket.site/swc/sw/username/?country.x=DE&locale.x=en_DE
Frame ID: 5190B91F2F956CDFFFB605F4E98B6CF0
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Swisscom Login

Page URL History Show full URLs

https://nvh41lbp3o.onrocket.site/swc/index.php HTTP 302
https://nvh41lbp3o.onrocket.site/swc/sw/index.php?login_form=True&session_Id=2e70ce28f60744fa4675c46f53e93c1c HTTP 302
https://nvh41lbp3o.onrocket.site/swc/sw/username/?country.x=DE&locale.x=en_DE Page URL

Page Statistics

13
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

298 kB
Transfer

888 kB
Size

0
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://www.swisscom.ch/en/residential.html

Search URL Search Domain Scan URL

URL: https://www.swisscom.ch/en/residential/help/data-and-bills/the-swisscom-login.html
Title: About Swisscom Login

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://nvh41lbp3o.onrocket.site/swc/index.php HTTP 302
https://nvh41lbp3o.onrocket.site/swc/sw/index.php?login_form=True&session_Id=2e70ce28f60744fa4675c46f53e93c1c HTTP 302
https://nvh41lbp3o.onrocket.site/swc/sw/username/?country.x=DE&locale.x=en_DE Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3

200

Primary Request / Show response
nvh41lbp3o.onrocket.site/swc/sw/username/
Redirect Chain

https://nvh41lbp3o.onrocket.site/swc/index.php
https://nvh41lbp3o.onrocket.site/swc/sw/index.php?login_form=True&session_Id=2e70ce28f60744fa4675c46f53e93c1c
https://nvh41lbp3o.onrocket.site/swc/sw/username/?country.x=DE&locale.x=en_DE

9 KB
3 KB

22ms
22ms

Document
text/html

2606:4700::6813:9a5c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://nvh41lbp3o.onrocket.site/swc/sw/username/?country.x=DE&locale.x=en_DE
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6813:9a5c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2c4ee633071be703cfe0c93e9a5ee5e1bb306612cfd7108bc75e74c6050ba6b8

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 84293
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: public, max-age=0, s-maxage=2592000
cf-cache-status: HIT
cf-ray: 70b2279fdb92995a-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Sat, 14 May 2022 08:09:59 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
last-modified: Fri, 13 May 2022 07:25:12 GMT
server: cloudflare
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: public, max-age=0, s-maxage=2592000
cf-cache-status: MISS
cf-ray: 70b2279efa30914d-FRA
content-type: text/html; charset=UTF-8
date: Sat, 14 May 2022 08:09:59 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
location: username/?country.x=DE&locale.x=en_DE
server: cloudflare
vary: Accept-Encoding

GET
H3 200 commons.css
nvh41lbp3o.onrocket.site/swc/sw/username/Swisscom%20Login_files/ 351 KB
45 KB 33ms
32ms Stylesheet
text/css 2606:4700::6813:9a5c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://nvh41lbp3o.onrocket.site/swc/sw/username/Swisscom%20Login_files/commons.css

Requested by

Host: nvh41lbp3o.onrocket.site
URL: https://nvh41lbp3o.onrocket.site/swc/sw/username/?country.x=DE&locale.x=en_DE

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6813:9a5c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5ad15e30f915778a7f512d442dd2e6aad992f1e0aa44dbcd3b3a19ba7002f324

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nvh41lbp3o.onrocket.site/swc/sw/username/?country.x=DE&locale.x=en_DE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sat, 14 May 2022 08:09:59 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 85161
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Thu, 12 May 2022 23:37:58 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=10886400; includeSubDomains; preload
content-type: text/css
vary: Accept-Encoding
cache-control: max-age=31536000
cf-ray: 70b227a01c14995a-FRA
expires: Fri, 12 May 2023 23:38:08 GMT

GET
H3 200 username.css
nvh41lbp3o.onrocket.site/swc/sw/username/Swisscom%20Login_files/ 158 B
418 B 48ms
48ms Stylesheet
text/css 2606:4700::6813:9a5c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://nvh41lbp3o.onrocket.site/swc/sw/username/Swisscom%20Login_files/username.css

Requested by

Host: nvh41lbp3o.onrocket.site
URL: https://nvh41lbp3o.onrocket.site/swc/sw/username/?country.x=DE&locale.x=en_DE

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6813:9a5c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

181efe0cebe2516277ecfbb3b5cea7d52991abe0bfacfce521a9134ed18b2a44

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nvh41lbp3o.onrocket.site/swc/sw/username/?country.x=DE&locale.x=en_DE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sat, 14 May 2022 08:09:59 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 85161
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Thu, 12 May 2022 23:37:58 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=10886400; includeSubDomains; preload
content-type: text/css
vary: Accept-Encoding
cache-control: max-age=31536000
cf-ray: 70b227a01c15995a-FRA
expires: Fri, 12 May 2023 23:38:08 GMT

GET
H3 200 myswisscom_logo.png
nvh41lbp3o.onrocket.site/swc/sw/username/Swisscom%20Login_files/ 558 B
970 B 21ms
20ms Image
image/webp 2606:4700::6813:9a5c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://nvh41lbp3o.onrocket.site/swc/sw/username/Swisscom%20Login_files/myswisscom_logo.png

Requested by

Host: nvh41lbp3o.onrocket.site
URL: https://nvh41lbp3o.onrocket.site/swc/sw/username/?country.x=DE&locale.x=en_DE

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6813:9a5c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

35c29437c9de0d2f385547551567e34bb1e72f0f830ef2a80b45ab94350ccd6e

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nvh41lbp3o.onrocket.site/swc/sw/username/?country.x=DE&locale.x=en_DE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sat, 14 May 2022 08:09:59 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 85161
cf-polished: origFmt=png, origSize=7184
content-disposition: inline; filename="myswisscom_logo.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 558
x-xss-protection: 1; mode=block
expires: Sat, 13 May 2023 06:12:28 GMT
last-modified: Thu, 12 May 2022 23:37:58 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=10886400; includeSubDomains; preload
content-type: image/webp
vary: Accept
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 70b227a01c1e995a-FRA
cf-bgj: imgq:85,h2pri

GET
H3 200 webcomponents.js.download Show response
nvh41lbp3o.onrocket.site/swc/sw/username/Swisscom%20Login_files/ 2 KB
1 KB 21ms
20ms Script
application/javascript 2606:4700::6813:9a5c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://nvh41lbp3o.onrocket.site/swc/sw/username/Swisscom%20Login_files/webcomponents.js.download
Requested by: Host: nvh41lbp3o.onrocket.site
URL: https://nvh41lbp3o.onrocket.site/swc/sw/username/?country.x=DE&locale.x=en_DE
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6813:9a5c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3b3d4c57d3694575c88a29fb1c9faad1a6e361778ba705dbe017e699fbe4a79d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nvh41lbp3o.onrocket.site/swc/sw/username/?country.x=DE&locale.x=en_DE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sat, 14 May 2022 08:09:59 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 12 May 2022 23:37:58 GMT
server: cloudflare
age: 85161
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=0, s-maxage=2592000
cf-ray: 70b227a01c17995a-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 commons.bundle.js.download Show response
nvh41lbp3o.onrocket.site/swc/sw/username/Swisscom%20Login_files/ 386 KB
110 KB 47ms
47ms Script
application/javascript 2606:4700::6813:9a5c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://nvh41lbp3o.onrocket.site/swc/sw/username/Swisscom%20Login_files/commons.bundle.js.download
Requested by: Host: nvh41lbp3o.onrocket.site
URL: https://nvh41lbp3o.onrocket.site/swc/sw/username/?country.x=DE&locale.x=en_DE
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6813:9a5c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 08d8a06eb05c8ba1646900a85884481ab3cb3989c8a036e64dbe8736c36b816f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nvh41lbp3o.onrocket.site/swc/sw/username/?country.x=DE&locale.x=en_DE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sat, 14 May 2022 08:09:59 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 12 May 2022 23:37:58 GMT
server: cloudflare
age: 85161
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=0, s-maxage=2592000
cf-ray: 70b227a01c19995a-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 login-layout.bundle.js.download Show response
nvh41lbp3o.onrocket.site/swc/sw/username/Swisscom%20Login_files/ 4 KB
2 KB 62ms
61ms Script
application/javascript 2606:4700::6813:9a5c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://nvh41lbp3o.onrocket.site/swc/sw/username/Swisscom%20Login_files/login-layout.bundle.js.download
Requested by: Host: nvh41lbp3o.onrocket.site
URL: https://nvh41lbp3o.onrocket.site/swc/sw/username/?country.x=DE&locale.x=en_DE
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6813:9a5c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 231fefe41695871b5d409e94c22520bafb7ba46d37071ab956ba73f9ad0f1905

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nvh41lbp3o.onrocket.site/swc/sw/username/?country.x=DE&locale.x=en_DE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sat, 14 May 2022 08:09:59 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 12 May 2022 23:37:58 GMT
server: cloudflare
age: 85161
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=0, s-maxage=2592000
cf-ray: 70b227a01c1b995a-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 username.bundle.js.download Show response
nvh41lbp3o.onrocket.site/swc/sw/username/Swisscom%20Login_files/ 3 KB
1 KB 62ms
62ms Script
application/javascript 2606:4700::6813:9a5c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://nvh41lbp3o.onrocket.site/swc/sw/username/Swisscom%20Login_files/username.bundle.js.download
Requested by: Host: nvh41lbp3o.onrocket.site
URL: https://nvh41lbp3o.onrocket.site/swc/sw/username/?country.x=DE&locale.x=en_DE
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6813:9a5c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aca8bd3a20d742239bfb4e7a87eaa878f69c9446550f50324b594c71de4a486f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nvh41lbp3o.onrocket.site/swc/sw/username/?country.x=DE&locale.x=en_DE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sat, 14 May 2022 08:09:59 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 12 May 2022 23:37:58 GMT
server: cloudflare
age: 85161
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=0, s-maxage=2592000
cf-ray: 70b227a01c1d995a-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 404 webcomponents.lgd0guuk.js
nvh41lbp3o.onrocket.site/swc/sw/username/Swisscom%20Login_files/webcomponents/ 0
0 120ms
120ms Script
text/html 2606:4700::6813:9a5c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://nvh41lbp3o.onrocket.site/swc/sw/username/Swisscom%20Login_files/webcomponents/webcomponents.lgd0guuk.js

Requested by

Host: nvh41lbp3o.onrocket.site
URL: https://nvh41lbp3o.onrocket.site/swc/sw/username/Swisscom%20Login_files/webcomponents.js.download

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6813:9a5c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://nvh41lbp3o.onrocket.site/swc/sw/username/?country.x=DE&locale.x=en_DE
Origin: https://nvh41lbp3o.onrocket.site
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sat, 14 May 2022 08:09:59 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
server: cloudflare
link: <https://nvh41lbp3o.onrocket.site/wp-json/>; rel="https://api.w.org/"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
strict-transport-security: max-age=10886400; includeSubDomains; preload
cf-ray: 70b227a07ca6995a-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block

GET
H3 200 lifeform-spritesheet.png
nvh41lbp3o.onrocket.site/swc/sw/username/ 1 KB
1 KB 29ms
29ms Image
image/png 2606:4700::6813:9a5c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nvh41lbp3o.onrocket.site/swc/sw/username/lifeform-spritesheet.png
Requested by: Host: nvh41lbp3o.onrocket.site
URL: https://nvh41lbp3o.onrocket.site/swc/sw/username/Swisscom%20Login_files/commons.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6813:9a5c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nvh41lbp3o.onrocket.site/swc/sw/username/Swisscom%20Login_files/commons.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

cf-edge-cache: no-cache
date: Sat, 14 May 2022 08:09:59 GMT
cf-cache-status: HIT
last-modified: Friday, 13-May-2022 09:15:23 GMT
server: cloudflare
age: 81929
cf-polished: status=cannot_optimize
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
cache-control: private, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
cf-ray: 70b227a07caf995a-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: imgq:85,h2pri

GET
H3 200 TheSansB_400_.woff2
nvh41lbp3o.onrocket.site/swc/sw/username/ 50 KB
50 KB 22ms
21ms Font
font/woff2 2606:4700::6813:9a5c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://nvh41lbp3o.onrocket.site/swc/sw/username/TheSansB_400_.woff2

Requested by

Host: nvh41lbp3o.onrocket.site
URL: https://nvh41lbp3o.onrocket.site/swc/sw/username/Swisscom%20Login_files/commons.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6813:9a5c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f0cc4ee9dc83925f474ab0b5ed3a5395038c979e157d4bae8e67225f1b0922d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://nvh41lbp3o.onrocket.site/swc/sw/username/Swisscom%20Login_files/commons.css
Origin: https://nvh41lbp3o.onrocket.site
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sat, 14 May 2022 08:09:59 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 84182
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 50708
x-xss-protection: 1; mode=block
last-modified: Thu, 12 May 2022 23:37:58 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=10886400; includeSubDomains; preload
content-type: font/woff2
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 70b227a08cb1995a-FRA
expires: Fri, 12 May 2023 23:38:09 GMT

GET
H3 200 sdx-icons.woff2
nvh41lbp3o.onrocket.site/swc/sw/username/ 29 KB
29 KB 20ms
20ms Font
font/woff2 2606:4700::6813:9a5c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://nvh41lbp3o.onrocket.site/swc/sw/username/sdx-icons.woff2

Requested by

Host: nvh41lbp3o.onrocket.site
URL: https://nvh41lbp3o.onrocket.site/swc/sw/username/Swisscom%20Login_files/commons.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6813:9a5c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a8ff2577aaef54f873ee27c6bf4592be5970d95dddb0c2885bcfd2e87969de43

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://nvh41lbp3o.onrocket.site/swc/sw/username/Swisscom%20Login_files/commons.css
Origin: https://nvh41lbp3o.onrocket.site
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sat, 14 May 2022 08:09:59 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 84182
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 29376
x-xss-protection: 1; mode=block
last-modified: Thu, 12 May 2022 23:37:58 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=10886400; includeSubDomains; preload
content-type: font/woff2
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 70b227a08cb3995a-FRA
expires: Fri, 12 May 2023 23:38:09 GMT

GET
H3 200 TheSansB_300_.woff2
nvh41lbp3o.onrocket.site/swc/sw/username/ 55 KB
55 KB 29ms
29ms Font
font/woff2 2606:4700::6813:9a5c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://nvh41lbp3o.onrocket.site/swc/sw/username/TheSansB_300_.woff2

Requested by

Host: nvh41lbp3o.onrocket.site
URL: https://nvh41lbp3o.onrocket.site/swc/sw/username/Swisscom%20Login_files/commons.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6813:9a5c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a6bab48f290efd74478d95eab8bc0610cc32ffa78dc5adbb8fbc34f30ce8d930

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://nvh41lbp3o.onrocket.site/swc/sw/username/Swisscom%20Login_files/commons.css
Origin: https://nvh41lbp3o.onrocket.site
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sat, 14 May 2022 08:09:59 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 84182
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 55864
x-xss-protection: 1; mode=block
last-modified: Thu, 12 May 2022 23:37:58 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=10886400; includeSubDomains; preload
content-type: font/woff2
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 70b227a08cb4995a-FRA
expires: Fri, 12 May 2023 23:38:09 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Swisscom (Telecommunication)

42 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://nvh41lbp3o.onrocket.site/swc/sw/username/Swisscom%20Login_files/webcomponents/webcomponents.lgd0guuk.js Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

nvh41lbp3o.onrocket.site
2606:4700::6813:9a5c
08d8a06eb05c8ba1646900a85884481ab3cb3989c8a036e64dbe8736c36b816f
181efe0cebe2516277ecfbb3b5cea7d52991abe0bfacfce521a9134ed18b2a44
231fefe41695871b5d409e94c22520bafb7ba46d37071ab956ba73f9ad0f1905
2c4ee633071be703cfe0c93e9a5ee5e1bb306612cfd7108bc75e74c6050ba6b8
35c29437c9de0d2f385547551567e34bb1e72f0f830ef2a80b45ab94350ccd6e
3b3d4c57d3694575c88a29fb1c9faad1a6e361778ba705dbe017e699fbe4a79d
5ad15e30f915778a7f512d442dd2e6aad992f1e0aa44dbcd3b3a19ba7002f324
a6bab48f290efd74478d95eab8bc0610cc32ffa78dc5adbb8fbc34f30ce8d930
a8ff2577aaef54f873ee27c6bf4592be5970d95dddb0c2885bcfd2e87969de43
aca8bd3a20d742239bfb4e7a87eaa878f69c9446550f50324b594c71de4a486f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f0cc4ee9dc83925f474ab0b5ed3a5395038c979e157d4bae8e67225f1b0922d8

nvh41lbp3o.onrocket.site Open in urlscan Pro 2606:4700::6813:9a5c Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

13 Requests

100 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

298 kBTransfer

888 kBSize

0 Cookies

2 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

42 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

nvh41lbp3o.onrocket.site Open in urlscan Pro
2606:4700::6813:9a5c Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

298 kB
Transfer

888 kB
Size

0
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!