manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com Open in urlscan Pro
198.199.109.95 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.childnepal.org/wp
Effective URL:
https://manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com/SPPFXpWGlxbN/Smanage/f/signin.php
Submission: On August 03 via api (August 3rd 2024, 11:12:02 am UTC) from PL — Scanned from CH

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 5 domains to perform 11 HTTP transactions. The main IP is 198.199.109.95, located in San Francisco, United States and belongs to DIGITALOCEAN-ASN, US. The main domain is manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com.
TLS certificate: Issued by E5 on July 15th 2024. Valid for: 3 months.

This is the only time manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Schweizerische Bundesbahnen (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
2 2	192.250.229.92 192.250.229.92	209341 (WHG-FRA) (WHG-FRA)
2	52.239.221.36 52.239.221.36	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
3 9	198.199.109.95 198.199.109.95	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	18.157.148.72 18.157.148.72	() ()
11	4

2 192.250.229.92 (United Kingdom) 2 redirects

ASN209341 (WHG-FRA, GB)
PTR: s3181.fra1.stableserver.net

www.childnepal.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.239.221.36 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

sslpostch.blob.core.windows.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 198.199.109.95 (San Francisco, United States) 3 redirects

ASN14061 (DIGITALOCEAN-ASN, US)
PTR: codeanyproxy.com

manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.157.148.72 (None, )

ASN- ()

cdn.app.sbb.ch	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	codeanyapp.com 3 redirects manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com	181 KB
2	windows.net sslpostch.blob.core.windows.net	2 KB
2	childnepal.org 2 redirects www.childnepal.org	1 KB
1	sbb.ch cdn.app.sbb.ch Failed	19 KB
0	swisspass.ch Failed resources.swisspass.ch Failed
11	5

	Domain	Requested by
9	manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com	3 redirects manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com
2	sslpostch.blob.core.windows.net
2	www.childnepal.org	2 redirects
1	cdn.app.sbb.ch	manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com
0	resources.swisspass.ch Failed	manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com
11	5

This site contains no links.

Subject Issuer	Validity	Valid
*.blob.core.windows.net Microsoft RSA TLS CA 01	`2023-09-27` - `2024-09-27`	a year	crt.sh
codeanyapp.com E5	`2024-07-15` - `2024-10-13`	3 months	crt.sh
*.app.sbb.ch Amazon RSA 2048 M02	`2024-07-16` - `2025-08-14`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com/SPPFXpWGlxbN/Smanage/f/signin.php
Frame ID: 89DCD514E7F494F388E916DEFD605729
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

SwissPass

Page URL History Show full URLs

https://www.childnepal.org/wp HTTP 301
https://www.childnepal.org/wp/ HTTP 302
https://sslpostch.blob.core.windows.net/sbb/sbb-online.html Page URL
https://manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com/SPPFXpWGlxbN/Smanage HTTP 301
https://manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com/SPPFXpWGlxbN/Smanage/ HTTP 302
https://manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com/SPPFXpWGlxbN/Smanage/f/index.php?id=2afeb2e8744b4ac6a741b057b5b569242afeb2e8... HTTP 302
https://manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com/SPPFXpWGlxbN/Smanage/f/signin.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

11
Requests

82 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

4
IPs

2
Countries

200 kB
Transfer

367 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.childnepal.org/wp HTTP 301
https://www.childnepal.org/wp/ HTTP 302
https://sslpostch.blob.core.windows.net/sbb/sbb-online.html Page URL
https://manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com/SPPFXpWGlxbN/Smanage HTTP 301
https://manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com/SPPFXpWGlxbN/Smanage/ HTTP 302
https://manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com/SPPFXpWGlxbN/Smanage/f/index.php?id=2afeb2e8744b4ac6a741b057b5b569242afeb2e8744b4ac6a741b057b5b56924&act=2afeb2e8744b4ac6a741b057b5b569242afeb2e8744b4ac6a741b057b5b56924 HTTP 302
https://manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com/SPPFXpWGlxbN/Smanage/f/signin.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://www.childnepal.org/wp HTTP 301
https://www.childnepal.org/wp/ HTTP 302
https://sslpostch.blob.core.windows.net/sbb/sbb-online.html

11 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	sbb-online.html Show response sslpostch.blob.core.windows.net/sbb/ Redirect Chain https://www.childnepal.org/wp https://www.childnepal.org/wp/ https://sslpostch.blob.core.windows.net/sbb/sbb-online.html	648 B 1 KB	489ms 119ms	Document text/html	52.239.221.36 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://sslpostch.blob.core.windows.net/sbb/sbb-online.html Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 52.239.221.36 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash `caac1ccfffb987ae3b944565c4c375e1a58beb676e4bf82cee59db79ff6a4faf` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Response headers Content-Length 648 Content-MD5 3+PYHIFBlrPkHEZjiKGeow== Content-Type text/html Date Sat, 03 Aug 2024 11:11:57 GMT ETag 0x8DCB1BB289F0FDD Last-Modified Wed, 31 Jul 2024 23:47:37 GMT Server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-blob-type BlockBlob x-ms-lease-status unlocked x-ms-request-id 9714cbf1-801e-00ed-7495-e555fb000000 x-ms-version 2009-09-19 Redirect headers cache-control no-cache, no-store, must-revalidate, max-age=0 content-length 0 content-type text/html; charset=UTF-8 date Sat, 03 Aug 2024 11:11:57 GMT location https://sslpostch.blob.core.windows.net/sbb/sbb-online.html server LiteSpeed vary User-Agent,User-Agent
GET H2	200	Primary Request signin.php Show response manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com/SPPFXpWGlxbN/Smanage/f/ Redirect Chain https://manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com/SPPFXpWGlxbN/Smanage https://manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com/SPPFXpWGlxbN/Smanage/ https://manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com/SPPFXpWGlxbN/Smanage/f/index.php?id=2afeb2e8744b4ac6a741b057b5b569242afeb2e8744b4ac6a741b057b5b56924&act=2afeb2e8744b4ac6a741b057b5b5692... https://manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com/SPPFXpWGlxbN/Smanage/f/signin.php	18 KB 5 KB	323ms 322ms	Document text/html	198.199.109.95 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com/SPPFXpWGlxbN/Smanage/f/signin.php Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 198.199.109.95 San Francisco, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS codeanyproxy.com Software openresty / Resource Hash `2ec440268944bf1318d5a03d4ffa70f96d8812557b512cd868d56b39e663dc33` Request headers Referer https://sslpostch.blob.core.windows.net/sbb/sbb-online.html Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Response headers cache-control no-store, no-cache, must-revalidate content-encoding gzip content-length 4591 content-type text/html; charset=UTF-8 date Sat, 03 Aug 2024 10:23:12 GMT expires Thu, 19 Nov 1981 08:52:00 GMT pragma no-cache server openresty vary Accept-Encoding Redirect headers cache-control no-store, no-cache, must-revalidate content-length 0 content-type text/html; charset=UTF-8 date Sat, 03 Aug 2024 10:23:12 GMT expires Thu, 19 Nov 1981 08:52:00 GMT location signin.php pragma no-cache server openresty
GET H/1.1	400 One of the request inputs is out of range.	favicon.ico sslpostch.blob.core.windows.net/	226 B 485 B	118ms 117ms	Other application/xml	52.239.221.36 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://sslpostch.blob.core.windows.net/favicon.ico Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 52.239.221.36 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Blob Service Version 1.0 Microsoft-HTTPAPI/2.0 / Resource Hash Request headers Referer https://sslpostch.blob.core.windows.net/sbb/sbb-online.html User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Response headers x-ms-request-id 9714ccce-801e-00ed-4695-e555fb000000 Date Sat, 03 Aug 2024 11:11:57 GMT Server Blob Service Version 1.0 Microsoft-HTTPAPI/2.0 Content-Length 226 Content-Type application/xml
GET H2	200	sso.min-20200819.css manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com/SPPFXpWGlxbN/Smanage/f/Login%20_%20SwissPass_files/	180 KB 23 KB	693ms 689ms	Stylesheet text/css	198.199.109.95 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com/SPPFXpWGlxbN/Smanage/f/Login%20_%20SwissPass_files/sso.min-20200819.css Requested by Host: manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com URL: https://manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com/SPPFXpWGlxbN/Smanage/f/signin.php Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 198.199.109.95 San Francisco, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS codeanyproxy.com Software openresty / Resource Hash `da86a8f910323e36049f6fee7c877d53f9f5020f2031efdfabaec371476e1b5a` Request headers Referer https://manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com/SPPFXpWGlxbN/Smanage/f/signin.php User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Response headers date Sat, 03 Aug 2024 10:23:12 GMT content-encoding gzip last-modified Wed, 31 Jul 2024 23:29:16 GMT server openresty etag "2ce5a-61e93766f3ae5-gzip" vary Accept-Encoding content-type text/css accept-ranges bytes content-length 23708
GET H2	200	logo_text_de-20200819.svg manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com/SPPFXpWGlxbN/Smanage/f/	137 KB 137 KB	514ms 510ms	Image image/svg+xml	198.199.109.95 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com/SPPFXpWGlxbN/Smanage/f/logo_text_de-20200819.svg Requested by Host: manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com URL: https://manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com/SPPFXpWGlxbN/Smanage/f/signin.php Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 198.199.109.95 San Francisco, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS codeanyproxy.com Software openresty / Resource Hash `c337d42ed7979c6be0282900bd957dd9d112a430dc7761463d655eb8f0d9bc07` Request headers Referer https://manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com/SPPFXpWGlxbN/Smanage/f/signin.php User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Response headers date Sat, 03 Aug 2024 10:23:12 GMT last-modified Wed, 31 Jul 2024 23:29:16 GMT server openresty accept-ranges bytes etag "222c3-61e93766f4a85" content-length 139971 content-type image/svg+xml
GET H2	200	logo-20200819.svg manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com/SPPFXpWGlxbN/Smanage/f/	7 KB 7 KB	515ms 511ms	Image image/svg+xml	198.199.109.95 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com/SPPFXpWGlxbN/Smanage/f/logo-20200819.svg Requested by Host: manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com URL: https://manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com/SPPFXpWGlxbN/Smanage/f/signin.php Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 198.199.109.95 San Francisco, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS codeanyproxy.com Software openresty / Resource Hash `deeee170c3759a6ed35c0c05c5b935d0e7638f1c0c5677166918ecff6edb1909` Request headers Referer https://manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com/SPPFXpWGlxbN/Smanage/f/signin.php User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Response headers date Sat, 03 Aug 2024 10:23:12 GMT last-modified Wed, 31 Jul 2024 23:29:16 GMT server openresty accept-ranges bytes etag "1cce-61e93766f469d" content-length 7374 content-type image/svg+xml
GET H2	200	loader-20200819.png manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com/SPPFXpWGlxbN/Smanage/f/Login%20_%20SwissPass_files/	272 B 418 B	629ms 628ms	Image image/png	198.199.109.95 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com/SPPFXpWGlxbN/Smanage/f/Login%20_%20SwissPass_files/loader-20200819.png Requested by Host: manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com URL: https://manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com/SPPFXpWGlxbN/Smanage/f/signin.php Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 198.199.109.95 San Francisco, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS codeanyproxy.com Software openresty / Resource Hash `f766c7457c6ec463eaa85778aa47261344f1772e0b7cf1987ad212f889f472f5` Request headers Referer https://manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com/SPPFXpWGlxbN/Smanage/f/signin.php User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Response headers date Sat, 03 Aug 2024 10:23:13 GMT last-modified Wed, 31 Jul 2024 23:29:16 GMT server openresty accept-ranges bytes etag "110-61e93766f2b45" content-length 272 content-type image/png
GET		login_bg.jpg resources.swisspass.ch/content/dam/swisspass/co-branding/swiss_ch/	0 0

GET		SBBWeb-Light.woff2 cdn.app.sbb.ch/fonts/v1_6_subset/	0 0

GET H2	200	icomoon.woff2 manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com/SPPFXpWGlxbN/Smanage/f/	7 KB 7 KB	321ms 321ms	Font application/octet-stream	198.199.109.95 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com/SPPFXpWGlxbN/Smanage/f/icomoon.woff2 Requested by Host: manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com URL: https://manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com/SPPFXpWGlxbN/Smanage/f/signin.php Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 198.199.109.95 San Francisco, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS codeanyproxy.com Software openresty / Resource Hash `78a4a776506b173ae79fd021d0e9003c7d653ca204ea1d69bea4d553f92f787d` Request headers Referer https://manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com/SPPFXpWGlxbN/Smanage/f/signin.php Origin https://manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Response headers date Sat, 03 Aug 2024 10:23:13 GMT last-modified Wed, 31 Jul 2024 23:29:16 GMT server openresty accept-ranges bytes etag "1a14-61e93766f13d5" content-length 6676
GET H2	200	SBBWeb-Light.woff cdn.app.sbb.ch/fonts/v1_6_subset/	18 KB 19 KB	61ms 51ms	Font application/font-woff	18.157.148.72
General Check archive.org Show headers Download Go to Full URL https://cdn.app.sbb.ch/fonts/v1_6_subset/SBBWeb-Light.woff Requested by Host: manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com URL: https://manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com/SPPFXpWGlxbN/Smanage/f/Login%20_%20SwissPass_files/sso.min-20200819.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.157.148.72 -, , ASN (), Reverse DNS Software nginx/1.27.0 / Resource Hash `9bdf00f749af3b92a65178975ebf27dfebe2aa3429efacdffc5ef847e28a5990` Request headers Referer https://manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com/ Origin https://manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Response headers date Sat, 03 Aug 2024 11:12:01 GMT content-encoding br last-modified Wed, 31 Jan 2024 10:14:44 GMT server nginx/1.27.0 etag W/"65ba1d94-48c4" vary Accept-Encoding access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS content-type application/font-woff access-control-allow-origin * cache-control max-age=31536000, public, private access-control-allow-credentials true access-control-allow-headers Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With expires Sun, 03 Aug 2025 11:12:01 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: resources.swisspass.ch
URL: https://resources.swisspass.ch/content/dam/swisspass/co-branding/swiss_ch/login_bg.jpg

Domain: cdn.app.sbb.ch
URL: https://cdn.app.sbb.ch/fonts/v1_6_subset/SBBWeb-Light.woff2

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Schweizerische Bundesbahnen (Transportation)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| validateForm

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: m48b5o1hplnn7gc82ovk477sgk

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://sslpostch.blob.core.windows.net/favicon.ico Message: Failed to load resource: the server responded with a status of 400 (One of the request inputs is out of range.)
recommendation	warning	URL: https://manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com/SPPFXpWGlxbN/Smanage/f/signin.php Message: [DOM] Found 2 elements with non-unique id #login_button: (More info: https://goo.gl/9p2vKq) %o %o
recommendation	verbose	URL: https://manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com/SPPFXpWGlxbN/Smanage/f/signin.php Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.app.sbb.ch
manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com
resources.swisspass.ch
sslpostch.blob.core.windows.net
www.childnepal.org
cdn.app.sbb.ch
resources.swisspass.ch
18.157.148.72
192.250.229.92
198.199.109.95
52.239.221.36
2ec440268944bf1318d5a03d4ffa70f96d8812557b512cd868d56b39e663dc33
78a4a776506b173ae79fd021d0e9003c7d653ca204ea1d69bea4d553f92f787d
9bdf00f749af3b92a65178975ebf27dfebe2aa3429efacdffc5ef847e28a5990
c337d42ed7979c6be0282900bd957dd9d112a430dc7761463d655eb8f0d9bc07
caac1ccfffb987ae3b944565c4c375e1a58beb676e4bf82cee59db79ff6a4faf
da86a8f910323e36049f6fee7c877d53f9f5020f2031efdfabaec371476e1b5a
deeee170c3759a6ed35c0c05c5b935d0e7638f1c0c5677166918ecff6edb1909
f766c7457c6ec463eaa85778aa47261344f1772e0b7cf1987ad212f889f472f5

manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com Open in urlscan Pro 198.199.109.95 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

11 Requests

82 %HTTPS

0 %IPv6

5 Domains

5 Subdomains

4 IPs

2 Countries

200 kBTransfer

367 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

1 Cookies

3 Console Messages

Indicators

manage-sbb-onlinepass-sparkbuss880332.codeanyapp.com Open in urlscan Pro
198.199.109.95 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

82 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

4
IPs

2
Countries

200 kB
Transfer

367 kB
Size

1
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!