eservic-cembrach.com
Open in
urlscan Pro
3.89.213.158
Malicious Activity!
Public Scan
Submission: On December 02 via api from JP — Scanned from JP
Summary
TLS certificate: Issued by R3 on December 2nd 2022. Valid for: 3 months.
This is the only time eservic-cembrach.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Cembra (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
8 | 3.89.213.158 3.89.213.158 | 14618 (AMAZON-AES) (AMAZON-AES) | |
2 20 | 193.223.58.9 193.223.58.9 | 3303 (SWISSCOM ...) (SWISSCOM Swisscom Switzerland Ltd) | |
26 | 2 |
ASN14618 (AMAZON-AES, US)
PTR: ec2-3-89-213-158.compute-1.amazonaws.com
eservic-cembrach.com |
ASN3303 (SWISSCOM Swisscom Switzerland Ltd, CH)
www.cembra.ch |
Apex Domain Subdomains |
Transfer | |
---|---|---|
20 |
cembra.ch
2 redirects
www.cembra.ch |
535 KB |
8 |
eservic-cembrach.com
eservic-cembrach.com |
91 KB |
26 | 2 |
Domain | Requested by | |
---|---|---|
20 | www.cembra.ch |
2 redirects
eservic-cembrach.com
www.cembra.ch |
8 | eservic-cembrach.com |
eservic-cembrach.com
|
26 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
eservic-cembrach.com R3 |
2022-12-02 - 2023-03-02 |
3 months | crt.sh |
www.cembra.ch SwissSign RSA TLS EV ICA 2021 - 1 |
2022-07-14 - 2023-07-14 |
a year | crt.sh |
This page contains 3 frames:
Primary Page:
https://eservic-cembrach.com/interbankng/a1454840f3a0d7bc5c3bb9c682ae1d8d1184cbc07380d4136fcd1865c25b112bd6f4ea809f1de11b5c16bdf0786b0349/index.php
Frame ID: A6BB415FF80F86999C64786740D72049
Requests: 8 HTTP requests in this frame
Frame:
https://www.cembra.ch/de/Login/ServiceMessage/?display=desktop
Frame ID: 9D3D21C5CFA3F162CEFFFE3B34512C06
Requests: 6 HTTP requests in this frame
Frame:
https://www.cembra.ch/de/Login/ServiceCarousel?display=desktop
Frame ID: F9AB8A24CE01E0F92C4E63C20CCFBFC2
Requests: 12 HTTP requests in this frame
Screenshot
Page Title
Cembra Money BankDetected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Bootstrap (Web Frameworks) Expand
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 5- https://www.cembra.ch/de/Login/ServiceMessage HTTP 301
- https://www.cembra.ch/de/Login/ServiceMessage/?display=desktop
- https://www.cembra.ch/de/Login/ServiceCarousel HTTP 301
- https://www.cembra.ch/de/Login/ServiceCarousel?display=desktop
26 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
index.php
eservic-cembrach.com/interbankng/a1454840f3a0d7bc5c3bb9c682ae1d8d1184cbc07380d4136fcd1865c25b112bd6f4ea809f1de11b5c16bdf0786b0349/ |
7 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap-btn.css
eservic-cembrach.com/interbankng/a1454840f3a0d7bc5c3bb9c682ae1d8d1184cbc07380d4136fcd1865c25b112bd6f4ea809f1de11b5c16bdf0786b0349/img/ |
8 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
eservic-cembrach.com/interbankng/a1454840f3a0d7bc5c3bb9c682ae1d8d1184cbc07380d4136fcd1865c25b112bd6f4ea809f1de11b5c16bdf0786b0349/img/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
default.css
eservic-cembrach.com/interbankng/a1454840f3a0d7bc5c3bb9c682ae1d8d1184cbc07380d4136fcd1865c25b112bd6f4ea809f1de11b5c16bdf0786b0349/img/ |
19 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cembra-money-bank.jpeg
eservic-cembrach.com/interbankng/a1454840f3a0d7bc5c3bb9c682ae1d8d1184cbc07380d4136fcd1865c25b112bd6f4ea809f1de11b5c16bdf0786b0349/img/ |
16 KB 16 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
loading.gif
eservic-cembrach.com/login/resources/nevislogrend/applications/EService/webdata/images/ |
808 B 808 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
www.cembra.ch/de/Login/ServiceMessage/ Frame 9D3D Redirect Chain
|
1 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ServiceCarousel
www.cembra.ch/de/Login/ Frame F9AB Redirect Chain
|
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
eservice-login-background.jpeg
eservic-cembrach.com/interbankng/a1454840f3a0d7bc5c3bb9c682ae1d8d1184cbc07380d4136fcd1865c25b112bd6f4ea809f1de11b5c16bdf0786b0349/img/ |
34 KB 34 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vistasansbook-071211005emigrewebonly.woff
eservic-cembrach.com/interbankng/a1454840f3a0d7bc5c3bb9c682ae1d8d1184cbc07380d4136fcd1865c25b112bd6f4ea809f1de11b5c16bdf0786b0349/img/ |
32 KB 32 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login.css
www.cembra.ch/Frontend/CembraInternet/ Frame F9AB |
237 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-1.10.2.min.js
www.cembra.ch/assets/js/ Frame F9AB |
91 KB 32 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap.min.js
www.cembra.ch/assets/js/ Frame F9AB |
27 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cmb_eservice_newapp_de1_2022.jpg
www.cembra.ch/~/media/images/sublayouts/login/de/ Frame F9AB |
91 KB 92 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cmb_eservice_newapp_de2_2022.jpg
www.cembra.ch/~/media/images/sublayouts/login/de/ Frame F9AB |
67 KB 68 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cmb_eservice_newapp_de3_2022.jpg
www.cembra.ch/~/media/images/sublayouts/login/de/ Frame F9AB |
69 KB 69 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
eservice_slider_schutz_de_980x320.jpg
www.cembra.ch/~/media/images/sublayouts/login/de/ Frame F9AB |
30 KB 30 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login.css
www.cembra.ch/Frontend/CembraInternet/ Frame 9D3D |
237 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-1.10.2.min.js
www.cembra.ch/assets/js/ Frame 9D3D |
91 KB 32 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap.min.js
www.cembra.ch/assets/js/ Frame 9D3D |
27 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
info-purple.png
www.cembra.ch/~/media/images/sublayouts/login/ Frame 9D3D |
44 KB 44 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
slider-left.png
www.cembra.ch/assets/img/ Frame F9AB |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
slider-right.png
www.cembra.ch/assets/img/ Frame F9AB |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
vistaslab-book-071211001EmigreWebOnly.woff
www.cembra.ch/assets/font/ Frame F9AB |
34 KB 34 KB |
Font
font/x-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
vistasansbook-071211005EmigreWebOnly.woff
www.cembra.ch/assets/font/ Frame F9AB |
32 KB 32 KB |
Font
font/x-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
vistasansbook-071211005EmigreWebOnly.woff
www.cembra.ch/assets/font/ Frame 9D3D |
32 KB 32 KB |
Font
font/x-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Cembra (Banking)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| oncontentvisibilityautostatechange undefined| msViewportStyle1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
eservic-cembrach.com/ | Name: PHPSESSID Value: q9aeden6ipj009va241svrmfco |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
eservic-cembrach.com
www.cembra.ch
193.223.58.9
3.89.213.158
0eaf7b9d7710f17e57ab9c7f76d941570633c5993fcd5c8503cb7bc81941af8a
1bc5e610982370f1f00157fd084a3cdd62e980a7352752c9e09bb64f1bc3bc62
1ca024361b724ae43c75054e59a366a1ef518496a2c120bf136a12f888eab49f
22639cd1d52c4ceb7c68dda2d28fbfcb821f5b9d64b9632d1c34102fd3d306d2
404abc720db631404f659a0873fe1df65fca1288110bf7713d4a8a090e1726af
4bc7da1368289bf55857c1ce43a1d0ee56a45768caa12c3135c9a7aef445a84a
5066c2a170a75b9a5dc5fa10cbc5b5f0cc59179882f8c02d6619c642a42f01ab
55a820be664fe9abbc4b1213b905232f49b6d826477939ee3d0a9982cb26596f
5f636f3e95d09d3a339033f986b09d3ee20cdef5d710904726d96e1defe21411
9efa1dd36e9d6b40641dcfa69df8efa24ec0948a6b914aac50324ee2e52d6723
a0656555e87f578d00b2da72d7ce34373f373c0806ec71871690abe5176d1906
b063205531bb6cb6d3603dafaa67e5efcff57fb12c3c1ffcc7438bc78c92e719
b37a9db57ad291741c5a43f24d69e73bd672e47034dd6f8e28599fb907abb768
b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187
cd8f413e39247d48ea354b8fb11c227e72f641403bd8d4dd81cd7473d60daafb
cde700dc8a0702914ba678850bebb21cfd0140466f090eb0d45302d258674ff0
ce0392488bdaf30d30425a7459ed5c3d0da132ec5d6ef14150a3d9aa24e5fdc4
d0469af52588e0a9d83bf6f65784bb1a241f27b3387946bf4ecc86b288fdd2f1
e9704f509569e642ea78ac8e5f224884cbdc2167baf8fa0cbd43869fac2942e0
ed5c4f940fbb29ad6ea580e52d696b5badd28efa17ef068f0dda1f5c4026ca45