smz.uvk.mybluehost.me Open in urlscan Pro
5.100.156.145  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request sign.php Show response smz.uvk.mybluehost.me//wp-content/CH/SuissePass/api/aa/d/	23 KB 5 KB	295ms 210ms	Document text/html	5.100.156.145 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://smz.uvk.mybluehost.me//wp-content/CH/SuissePass/api/aa/d/sign.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 5.100.156.145 London, United Kingdom, ASN2635 (AUTOMATTIC, US), Reverse DNS 5.100.156-145.publicdomainregistry.com Software nginx / Resource Hash 9be262f55ed4fb0f1b6ddbc07909de52da5b2e61b62490b44ec3488aaf3a9643 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=86400 content-encoding br content-type text/html; charset=utf-8 date Thu, 10 Oct 2024 21:20:10 GMT server nginx strict-transport-security max-age=31536000 vary Accept-Encoding x-ac 3.lhr _atomic_ams MISS
GET H2	200	sso.min-20200819.css smz.uvk.mybluehost.me//wp-content/CH/SuissePass/api/aa/d/Login%20_%20SwissPass_files/	180 KB 24 KB	36ms 35ms	Stylesheet text/css	5.100.156.145 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://smz.uvk.mybluehost.me//wp-content/CH/SuissePass/api/aa/d/Login%20_%20SwissPass_files/sso.min-20200819.css Requested by Host: smz.uvk.mybluehost.me URL: https://smz.uvk.mybluehost.me//wp-content/CH/SuissePass/api/aa/d/sign.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 5.100.156.145 London, United Kingdom, ASN2635 (AUTOMATTIC, US), Reverse DNS 5.100.156-145.publicdomainregistry.com Software nginx / Resource Hash da86a8f910323e36049f6fee7c877d53f9f5020f2031efdfabaec371476e1b5a Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://smz.uvk.mybluehost.me//wp-content/CH/SuissePass/api/aa/d/sign.php Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 content-encoding br etag W/"66412372-2ce5a" access-control-allow-methods GET, HEAD expires Fri, 10 Oct 2025 18:40:42 GMT access-control-allow-origin * alt-svc h3=":443"; ma=86400 date Thu, 10 Oct 2024 21:20:10 GMT x-ac 3.lhr _atomic_ams HIT content-type text/css last-modified Sun, 12 May 2024 20:15:46 GMT server nginx vary Accept-Encoding
GET H2	200	jq.js Show response smz.uvk.mybluehost.me//wp-content/CH/SuissePass/api/aa/d/assets/js/	361 KB 34 KB	36ms 35ms	Script application/javascript	5.100.156.145 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://smz.uvk.mybluehost.me//wp-content/CH/SuissePass/api/aa/d/assets/js/jq.js Requested by Host: smz.uvk.mybluehost.me URL: https://smz.uvk.mybluehost.me//wp-content/CH/SuissePass/api/aa/d/sign.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 5.100.156.145 London, United Kingdom, ASN2635 (AUTOMATTIC, US), Reverse DNS 5.100.156-145.publicdomainregistry.com Software nginx / Resource Hash d9b25f5ed5a4e51c2cb6f07f77e130a24632ecbedffa430888fff41cda8ad009 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://smz.uvk.mybluehost.me//wp-content/CH/SuissePass/api/aa/d/sign.php Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 content-encoding br etag W/"66412372-5a2d8" access-control-allow-methods GET, HEAD expires Fri, 10 Oct 2025 18:40:42 GMT access-control-allow-origin * alt-svc h3=":443"; ma=86400 date Thu, 10 Oct 2024 21:20:10 GMT x-ac 3.lhr _atomic_ams HIT content-type application/javascript last-modified Sun, 12 May 2024 20:15:46 GMT server nginx vary Accept-Encoding
GET H2	200	logo_text_de-20200819.svg smz.uvk.mybluehost.me//wp-content/CH/SuissePass/api/aa/d/	137 KB 16 KB	36ms 35ms	Image image/svg+xml	5.100.156.145 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://smz.uvk.mybluehost.me//wp-content/CH/SuissePass/api/aa/d/logo_text_de-20200819.svg Requested by Host: smz.uvk.mybluehost.me URL: https://smz.uvk.mybluehost.me//wp-content/CH/SuissePass/api/aa/d/sign.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 5.100.156.145 London, United Kingdom, ASN2635 (AUTOMATTIC, US), Reverse DNS 5.100.156-145.publicdomainregistry.com Software nginx / Resource Hash c337d42ed7979c6be0282900bd957dd9d112a430dc7761463d655eb8f0d9bc07 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://smz.uvk.mybluehost.me//wp-content/CH/SuissePass/api/aa/d/sign.php Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 content-encoding br etag W/"66412372-222c3" access-control-allow-methods GET, HEAD expires Fri, 10 Oct 2025 18:40:42 GMT access-control-allow-origin * alt-svc h3=":443"; ma=86400 date Thu, 10 Oct 2024 21:20:10 GMT x-ac 3.lhr _atomic_ams HIT content-type image/svg+xml last-modified Sun, 12 May 2024 20:15:46 GMT server nginx vary Accept-Encoding
GET H2	200	logo-20200819.svg smz.uvk.mybluehost.me//wp-content/CH/SuissePass/api/aa/d/	7 KB 3 KB	40ms 40ms	Image image/svg+xml	5.100.156.145 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://smz.uvk.mybluehost.me//wp-content/CH/SuissePass/api/aa/d/logo-20200819.svg Requested by Host: smz.uvk.mybluehost.me URL: https://smz.uvk.mybluehost.me//wp-content/CH/SuissePass/api/aa/d/sign.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 5.100.156.145 London, United Kingdom, ASN2635 (AUTOMATTIC, US), Reverse DNS 5.100.156-145.publicdomainregistry.com Software nginx / Resource Hash deeee170c3759a6ed35c0c05c5b935d0e7638f1c0c5677166918ecff6edb1909 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://smz.uvk.mybluehost.me//wp-content/CH/SuissePass/api/aa/d/sign.php Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 content-encoding br etag W/"66412372-1cce" access-control-allow-methods GET, HEAD expires Fri, 10 Oct 2025 18:40:42 GMT access-control-allow-origin * alt-svc h3=":443"; ma=86400 date Thu, 10 Oct 2024 21:20:10 GMT x-ac 3.lhr _atomic_ams HIT content-type image/svg+xml last-modified Sun, 12 May 2024 20:15:46 GMT server nginx vary Accept-Encoding
GET H2	200	loader-20200819.png smz.uvk.mybluehost.me//wp-content/CH/SuissePass/api/aa/d/Login%20_%20SwissPass_files/	272 B 588 B	54ms 54ms	Image image/png	5.100.156.145 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://smz.uvk.mybluehost.me//wp-content/CH/SuissePass/api/aa/d/Login%20_%20SwissPass_files/loader-20200819.png Requested by Host: smz.uvk.mybluehost.me URL: https://smz.uvk.mybluehost.me//wp-content/CH/SuissePass/api/aa/d/sign.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 5.100.156.145 London, United Kingdom, ASN2635 (AUTOMATTIC, US), Reverse DNS 5.100.156-145.publicdomainregistry.com Software nginx / Resource Hash f766c7457c6ec463eaa85778aa47261344f1772e0b7cf1987ad212f889f472f5 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://smz.uvk.mybluehost.me//wp-content/CH/SuissePass/api/aa/d/sign.php Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 etag "66412372-110" access-control-allow-methods GET, HEAD expires Fri, 10 Oct 2025 18:40:42 GMT accept-ranges bytes access-control-allow-origin * alt-svc h3=":443"; ma=86400 content-length 272 date Thu, 10 Oct 2024 21:20:10 GMT x-ac 3.lhr _atomic_ams HIT content-type image/png last-modified Sun, 12 May 2024 20:15:46 GMT server nginx
GET H2	200	SBBWeb-Light.woff2 cdn.app.sbb.ch/fonts/v1_6_subset/	14 KB 14 KB	200ms 90ms	Font application/font-woff2	52.29.45.235 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.app.sbb.ch/fonts/v1_6_subset/SBBWeb-Light.woff2 Requested by Host: smz.uvk.mybluehost.me URL: https://smz.uvk.mybluehost.me//wp-content/CH/SuissePass/api/aa/d/Login%20_%20SwissPass_files/sso.min-20200819.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.29.45.235 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-29-45-235.eu-central-1.compute.amazonaws.com Software nginx/1.27.2 / Resource Hash 5c7f0e173844556da7ca5eb8936fa3dab1c00206960920a49a1eea9cde2bfaaf Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://smz.uvk.mybluehost.me Referer https://smz.uvk.mybluehost.me/ Response headers access-control-allow-headers Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With cache-control max-age=31536000, public, private content-encoding br etag W/"66f505dc-3784" access-control-allow-credentials true access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS expires Fri, 10 Oct 2025 21:20:10 GMT access-control-allow-origin * date Thu, 10 Oct 2024 21:20:10 GMT content-type application/font-woff2 last-modified Thu, 26 Sep 2024 06:57:32 GMT server nginx/1.27.2 vary Accept-Encoding
POST		receive_token telegrambotcheck.duckdns.org/	0 0
GET H2	200	login_bg.jpg resources.swisspass.ch/content/dam/swisspass/co-branding/swiss_ch/	196 KB 197 KB	258ms 112ms	Image image/jpeg	2a06:98c1:3200::90:82 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://resources.swisspass.ch/content/dam/swisspass/co-branding/swiss_ch/login_bg.jpg Requested by Host: smz.uvk.mybluehost.me URL: https://smz.uvk.mybluehost.me//wp-content/CH/SuissePass/api/aa/d/sign.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3200::90:82 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 58a037c0bde953b48561826f3df16031f7ddfce33c4018619d3f39c6af6eec1b Security Headers Name Value Strict-Transport-Security max-age=16070400; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://smz.uvk.mybluehost.me/ Response headers cf-bgj h2pri etag W/"310e5-6242452a3b6f4" age 6926 cf-cache-status HIT x-content-type-options nosniff expires Fri, 11 Oct 2024 01:20:10 GMT x-url /content/dam/swisspass/co-branding/swiss_ch/login_bg.jpg x-varnish 479199928 x-cache MISS date Thu, 10 Oct 2024 21:20:10 GMT content-type image/jpeg last-modified Thu, 10 Oct 2024 19:24:44 GMT vary Accept-Encoding x-frame-options SAMEORIGIN strict-transport-security max-age=16070400; includeSubDomains cache-control public, max-age=14400 referrer-policy same-origin cf-ray 8d09a723ec8099ee-CDG accept-ranges bytes content-length 200933 x-plattform cprod x-xss-protection 1; mode=block server cloudflare
GET H3	200	icomoon.woff2 smz.uvk.mybluehost.me//wp-content/CH/SuissePass/api/aa/d/	7 KB 7 KB	37ms 37ms	Font application/font-woff2	5.100.156.145 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://smz.uvk.mybluehost.me//wp-content/CH/SuissePass/api/aa/d/icomoon.woff2 Requested by Host: smz.uvk.mybluehost.me URL: https://smz.uvk.mybluehost.me//wp-content/CH/SuissePass/api/aa/d/sign.php Protocol H3 Security QUIC, , AES_128_GCM Server 5.100.156.145 London, United Kingdom, ASN2635 (AUTOMATTIC, US), Reverse DNS 5.100.156-145.publicdomainregistry.com Software nginx / Resource Hash 78a4a776506b173ae79fd021d0e9003c7d653ca204ea1d69bea4d553f92f787d Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://smz.uvk.mybluehost.me Referer https://smz.uvk.mybluehost.me//wp-content/CH/SuissePass/api/aa/d/sign.php Response headers strict-transport-security max-age=31536000 cache-control max-age=31536000 etag "66412372-1a14" access-control-allow-methods GET, HEAD expires Fri, 10 Oct 2025 18:40:43 GMT accept-ranges bytes access-control-allow-origin * alt-svc h3=":443"; ma=86400 content-length 6676 date Thu, 10 Oct 2024 21:20:10 GMT x-ac 3.lhr _atomic_ams HIT content-type application/font-woff2 last-modified Sun, 12 May 2024 20:15:46 GMT server nginx
GET H3	200	favicon.ico smz.uvk.mybluehost.me//wp-content/CH/SuissePass/api/aa/d/Login%20_%20SwissPass_files/	1 KB 378 B	168ms 168ms	Other image/x-icon	5.100.156.145 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://smz.uvk.mybluehost.me//wp-content/CH/SuissePass/api/aa/d/Login%20_%20SwissPass_files/favicon.ico?v=20140709-1126 Protocol H3 Security QUIC, , AES_128_GCM Server 5.100.156.145 London, United Kingdom, ASN2635 (AUTOMATTIC, US), Reverse DNS 5.100.156-145.publicdomainregistry.com Software nginx / Resource Hash 7c1925da382279a72f94990d0a1456f78918619f35780ea0905e4ae0db684677 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://smz.uvk.mybluehost.me//wp-content/CH/SuissePass/api/aa/d/sign.php Response headers strict-transport-security max-age=31536000 content-encoding br etag W/"66412372-47e" alt-svc h3=":443"; ma=86400 date Thu, 10 Oct 2024 21:20:11 GMT x-ac 3.lhr _atomic_ams MISS content-type image/x-icon last-modified Sun, 12 May 2024 20:15:46 GMT server nginx vary Accept-Encoding

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

telegrambotcheck.duckdns.org

URL

https://telegrambotcheck.duckdns.org:1001/receive_token?referrer=sarfita

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Schweizerische Bundesbahnen (Transportation)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

string| token string| tokens string| protocol string| url object| data function| validateForm

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.swisspass.ch/	1970-01-21 00:09:57	Name: __cf_bm Value: QAtiQqTaEy0CrWtTJCOm7uOeD2DdQCWEwcBIVEuJ9l4-1728595210-1.0.1.1-GqQvArn5z8UKQg6AM7lvvNFHN.gPDhhlDxRceGIvmwP.K4Qs83.6tMrf8PsqExLvDyWkH47_nMdQj0UUHIrh0Q

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	warning	URL: https://smz.uvk.mybluehost.me//wp-content/CH/SuissePass/api/aa/d/sign.php Message: [DOM] Found 2 elements with non-unique id #login_button: (More info: https://goo.gl/9p2vKq) %o %o
recommendation	verbose	URL: https://smz.uvk.mybluehost.me//wp-content/CH/SuissePass/api/aa/d/sign.php Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
network	error	URL: https://telegrambotcheck.duckdns.org:1001/receive_token?referrer=sarfita Message: Failed to load resource: net::ERR_CONNECTION_REFUSED

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.app.sbb.ch
resources.swisspass.ch
smz.uvk.mybluehost.me
telegrambotcheck.duckdns.org
telegrambotcheck.duckdns.org
2a06:98c1:3200::90:82
5.100.156.145
52.29.45.235
58a037c0bde953b48561826f3df16031f7ddfce33c4018619d3f39c6af6eec1b
5c7f0e173844556da7ca5eb8936fa3dab1c00206960920a49a1eea9cde2bfaaf
78a4a776506b173ae79fd021d0e9003c7d653ca204ea1d69bea4d553f92f787d
7c1925da382279a72f94990d0a1456f78918619f35780ea0905e4ae0db684677
9be262f55ed4fb0f1b6ddbc07909de52da5b2e61b62490b44ec3488aaf3a9643
c337d42ed7979c6be0282900bd957dd9d112a430dc7761463d655eb8f0d9bc07
d9b25f5ed5a4e51c2cb6f07f77e130a24632ecbedffa430888fff41cda8ad009
da86a8f910323e36049f6fee7c877d53f9f5020f2031efdfabaec371476e1b5a
deeee170c3759a6ed35c0c05c5b935d0e7638f1c0c5677166918ecff6edb1909
f766c7457c6ec463eaa85778aa47261344f1772e0b7cf1987ad212f889f472f5