manage-ssb-online-sparkbuss880332.codeanyapp.com Open in urlscan Pro
45.55.112.74 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://sslpostch.blob.core.windows.net/sbb/sbb-online.html
Effective URL:
https://manage-ssb-online-sparkbuss880332.codeanyapp.com/local/manage/ch-anmeldung/home/login.php
Submission: On June 13 via automatic, source phishtank (June 13th 2024, 5:36:02 pm UTC) — Scanned from DE

Summary HTTP 11 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 11 HTTP transactions. The main IP is 45.55.112.74, located in San Francisco, United States and belongs to DIGITALOCEAN-ASN, US. The main domain is manage-ssb-online-sparkbuss880332.codeanyapp.com.
TLS certificate: Issued by R3 on April 19th 2024. Valid for: 3 months.

This is the only time manage-ssb-online-sparkbuss880332.codeanyapp.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Schweizerische Bundesbahnen (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
2	52.239.221.36 52.239.221.36	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 10	45.55.112.74 45.55.112.74	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
11	2

2 52.239.221.36 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

sslpostch.blob.core.windows.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 45.55.112.74 (San Francisco, United States) 1 redirects

ASN14061 (DIGITALOCEAN-ASN, US)

manage-ssb-online-sparkbuss880332.codeanyapp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	codeanyapp.com 1 redirects manage-ssb-online-sparkbuss880332.codeanyapp.com	376 KB
2	windows.net sslpostch.blob.core.windows.net	2 KB
11	2

	Domain	Requested by
10	manage-ssb-online-sparkbuss880332.codeanyapp.com	1 redirects manage-ssb-online-sparkbuss880332.codeanyapp.com
2	sslpostch.blob.core.windows.net
11	2

This site contains links to these domains. Also see Links.

Domain
www.swisspass.ch
login.swisspass.ch

Subject Issuer	Validity	Valid
*.blob.core.windows.net Microsoft RSA TLS CA 01	`2023-09-27` - `2024-09-27`	a year	crt.sh
codeanyapp.com R3	`2024-04-19` - `2024-07-18`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://manage-ssb-online-sparkbuss880332.codeanyapp.com/local/manage/ch-anmeldung/home/login.php
Frame ID: A793C69A7647C0677D10212908501CCC
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Swiss Pass

Page URL History Show full URLs

https://sslpostch.blob.core.windows.net/sbb/sbb-online.html Page URL
https://manage-ssb-online-sparkbuss880332.codeanyapp.com/local/manage/ch-anmeldung/home/ HTTP 302
https://manage-ssb-online-sparkbuss880332.codeanyapp.com/local/manage/ch-anmeldung/home/login.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

11
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

378 kB
Transfer

462 kB
Size

1
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://www.swisspass.ch/home?lang=de
Title: Zurück

Search URL Search Domain Scan URL

URL: https://login.swisspass.ch/home

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://sslpostch.blob.core.windows.net/sbb/sbb-online.html Page URL
https://manage-ssb-online-sparkbuss880332.codeanyapp.com/local/manage/ch-anmeldung/home/ HTTP 302
https://manage-ssb-online-sparkbuss880332.codeanyapp.com/local/manage/ch-anmeldung/home/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	sbb-online.html Show response sslpostch.blob.core.windows.net/sbb/	655 B 1 KB	412ms 109ms	Document text/html	52.239.221.36 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://sslpostch.blob.core.windows.net/sbb/sbb-online.html Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 52.239.221.36 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash `8585655c812adcc681df49885f847b416350870e0c6e9493cc6be2ceb4fb63d2` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers Content-Length 655 Content-MD5 ONuTrh/wVAo8tPJ92z3Buw== Content-Type text/html Date Thu, 13 Jun 2024 17:35:53 GMT ETag 0x8DC8A0A63189921 Last-Modified Tue, 11 Jun 2024 11:33:59 GMT Server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-blob-type BlockBlob x-ms-lease-status unlocked x-ms-request-id 6f174c4e-d01e-0082-50b8-bd5f08000000 x-ms-version 2009-09-19
GET H2	200	Primary Request login.php Show response manage-ssb-online-sparkbuss880332.codeanyapp.com/local/manage/ch-anmeldung/home/ Redirect Chain https://manage-ssb-online-sparkbuss880332.codeanyapp.com/local/manage/ch-anmeldung/home/ https://manage-ssb-online-sparkbuss880332.codeanyapp.com/local/manage/ch-anmeldung/home/login.php	17 KB 3 KB	484ms 483ms	Document text/html	45.55.112.74 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://manage-ssb-online-sparkbuss880332.codeanyapp.com/local/manage/ch-anmeldung/home/login.php Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 45.55.112.74 San Francisco, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software openresty / Resource Hash `ef81e4c69a7b30b9697a08da20453c10772bf95eec7fa46207f9d505498ff6e4` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer https://sslpostch.blob.core.windows.net/sbb/sbb-online.html Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers cache-control no-store, no-cache, must-revalidate content-encoding gzip content-length 3193 content-type text/html; charset=UTF-8 date Thu, 13 Jun 2024 16:49:44 GMT expires Thu, 19 Nov 1981 08:52:00 GMT pragma no-cache server openresty vary Accept-Encoding Redirect headers cache-control no-store, no-cache, must-revalidate content-length 134 content-type text/html; charset=UTF-8 date Thu, 13 Jun 2024 16:49:43 GMT expires Thu, 19 Nov 1981 08:52:00 GMT location login.php pragma no-cache server openresty
GET H/1.1	400 One of the request inputs is out of range.	favicon.ico sslpostch.blob.core.windows.net/	226 B 485 B	98ms 98ms	Other application/xml	52.239.221.36 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://sslpostch.blob.core.windows.net/favicon.ico Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 52.239.221.36 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Blob Service Version 1.0 Microsoft-HTTPAPI/2.0 / Resource Hash Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://sslpostch.blob.core.windows.net/sbb/sbb-online.html Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-request-id 6f174c81-d01e-0082-78b8-bd5f08000000 Date Thu, 13 Jun 2024 17:35:54 GMT Server Blob Service Version 1.0 Microsoft-HTTPAPI/2.0 Content-Length 226 Content-Type application/xml
GET H2	200	sso.min-20200819.css manage-ssb-online-sparkbuss880332.codeanyapp.com/local/manage/ch-anmeldung/home/filez/	81 KB 9 KB	442ms 441ms	Stylesheet text/css	45.55.112.74 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://manage-ssb-online-sparkbuss880332.codeanyapp.com/local/manage/ch-anmeldung/home/filez/sso.min-20200819.css Requested by Host: manage-ssb-online-sparkbuss880332.codeanyapp.com URL: https://manage-ssb-online-sparkbuss880332.codeanyapp.com/local/manage/ch-anmeldung/home/login.php Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 45.55.112.74 San Francisco, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software openresty / Resource Hash `c0494f89be7292d192faee79f6ac5f93e95ded69207b73ff4660bb203017bcbc` Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://manage-ssb-online-sparkbuss880332.codeanyapp.com/local/manage/ch-anmeldung/home/login.php Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 13 Jun 2024 16:49:44 GMT content-encoding gzip last-modified Wed, 09 Aug 2023 14:02:56 GMT server openresty etag "143f0-6027defb44400-gzip" vary Accept-Encoding content-type text/css accept-ranges bytes content-length 8784
GET H2	200	logo.png manage-ssb-online-sparkbuss880332.codeanyapp.com/local/manage/ch-anmeldung/home/filez/	548 B 695 B	397ms 397ms	Image image/png	45.55.112.74 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://manage-ssb-online-sparkbuss880332.codeanyapp.com/local/manage/ch-anmeldung/home/filez/logo.png Requested by Host: manage-ssb-online-sparkbuss880332.codeanyapp.com URL: https://manage-ssb-online-sparkbuss880332.codeanyapp.com/local/manage/ch-anmeldung/home/login.php Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 45.55.112.74 San Francisco, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software openresty / Resource Hash `f2f0d94a5141a75ef227f2699b6a43588741ede3edd2fe2d075a65b3d413b2f8` Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://manage-ssb-online-sparkbuss880332.codeanyapp.com/local/manage/ch-anmeldung/home/login.php Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 13 Jun 2024 16:49:44 GMT last-modified Wed, 09 Aug 2023 01:59:08 GMT server openresty accept-ranges bytes etag "224-60273d3319300" content-length 548 content-type image/png
GET H2	200	logo_text_de-20200819.svg manage-ssb-online-sparkbuss880332.codeanyapp.com/local/manage/ch-anmeldung/home/filez/	137 KB 137 KB	348ms 347ms	Image image/svg+xml	45.55.112.74 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://manage-ssb-online-sparkbuss880332.codeanyapp.com/local/manage/ch-anmeldung/home/filez/logo_text_de-20200819.svg Requested by Host: manage-ssb-online-sparkbuss880332.codeanyapp.com URL: https://manage-ssb-online-sparkbuss880332.codeanyapp.com/local/manage/ch-anmeldung/home/login.php Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 45.55.112.74 San Francisco, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software openresty / Resource Hash `c337d42ed7979c6be0282900bd957dd9d112a430dc7761463d655eb8f0d9bc07` Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://manage-ssb-online-sparkbuss880332.codeanyapp.com/local/manage/ch-anmeldung/home/login.php Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 13 Jun 2024 16:49:44 GMT last-modified Wed, 09 Aug 2023 01:59:08 GMT server openresty accept-ranges bytes etag "222c3-60273d3319300" content-length 139971 content-type image/svg+xml
GET H2	200	logo-20200819.svg manage-ssb-online-sparkbuss880332.codeanyapp.com/local/manage/ch-anmeldung/home/filez/	7 KB 7 KB	533ms 532ms	Image image/svg+xml	45.55.112.74 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://manage-ssb-online-sparkbuss880332.codeanyapp.com/local/manage/ch-anmeldung/home/filez/logo-20200819.svg Requested by Host: manage-ssb-online-sparkbuss880332.codeanyapp.com URL: https://manage-ssb-online-sparkbuss880332.codeanyapp.com/local/manage/ch-anmeldung/home/login.php Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 45.55.112.74 San Francisco, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software openresty / Resource Hash `deeee170c3759a6ed35c0c05c5b935d0e7638f1c0c5677166918ecff6edb1909` Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://manage-ssb-online-sparkbuss880332.codeanyapp.com/local/manage/ch-anmeldung/home/login.php Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 13 Jun 2024 16:49:44 GMT last-modified Wed, 09 Aug 2023 01:59:08 GMT server openresty accept-ranges bytes etag "1cce-60273d3319300" content-length 7374 content-type image/svg+xml
GET H2	200	login_bg.jpg manage-ssb-online-sparkbuss880332.codeanyapp.com/local/manage/ch-anmeldung/home/filez/	196 KB 197 KB	551ms 551ms	Image image/jpeg	45.55.112.74 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://manage-ssb-online-sparkbuss880332.codeanyapp.com/local/manage/ch-anmeldung/home/filez/login_bg.jpg Requested by Host: manage-ssb-online-sparkbuss880332.codeanyapp.com URL: https://manage-ssb-online-sparkbuss880332.codeanyapp.com/local/manage/ch-anmeldung/home/login.php Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 45.55.112.74 San Francisco, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software openresty / Resource Hash `58a037c0bde953b48561826f3df16031f7ddfce33c4018619d3f39c6af6eec1b` Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://manage-ssb-online-sparkbuss880332.codeanyapp.com/local/manage/ch-anmeldung/home/login.php Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 13 Jun 2024 16:49:44 GMT last-modified Wed, 09 Aug 2023 01:59:08 GMT server openresty accept-ranges bytes etag "310e5-60273d3319300" content-length 200933 content-type image/jpeg
GET H2	200	SBBWeb-Light.woff2 manage-ssb-online-sparkbuss880332.codeanyapp.com/local/manage/ch-anmeldung/home/filez/	14 KB 14 KB	746ms 745ms	Font application/octet-stream	45.55.112.74 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://manage-ssb-online-sparkbuss880332.codeanyapp.com/local/manage/ch-anmeldung/home/filez/SBBWeb-Light.woff2 Requested by Host: manage-ssb-online-sparkbuss880332.codeanyapp.com URL: https://manage-ssb-online-sparkbuss880332.codeanyapp.com/local/manage/ch-anmeldung/home/filez/sso.min-20200819.css Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 45.55.112.74 San Francisco, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software openresty / Resource Hash `5c7f0e173844556da7ca5eb8936fa3dab1c00206960920a49a1eea9cde2bfaaf` Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://manage-ssb-online-sparkbuss880332.codeanyapp.com/local/manage/ch-anmeldung/home/filez/sso.min-20200819.css Origin https://manage-ssb-online-sparkbuss880332.codeanyapp.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 13 Jun 2024 16:49:45 GMT last-modified Wed, 09 Aug 2023 01:59:08 GMT server openresty accept-ranges bytes etag "3784-60273d3319300" content-length 14212
GET H2	200	icomoon.woff2 manage-ssb-online-sparkbuss880332.codeanyapp.com/local/manage/ch-anmeldung/home/filez/	7 KB 7 KB	735ms 734ms	Font application/octet-stream	45.55.112.74 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://manage-ssb-online-sparkbuss880332.codeanyapp.com/local/manage/ch-anmeldung/home/filez/icomoon.woff2 Requested by Host: manage-ssb-online-sparkbuss880332.codeanyapp.com URL: https://manage-ssb-online-sparkbuss880332.codeanyapp.com/local/manage/ch-anmeldung/home/filez/sso.min-20200819.css Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 45.55.112.74 San Francisco, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software openresty / Resource Hash `45b8f30ef99295a0d738416e4e5af9fa2dd41619499622c2c57416580fc7197b` Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://manage-ssb-online-sparkbuss880332.codeanyapp.com/local/manage/ch-anmeldung/home/filez/sso.min-20200819.css Origin https://manage-ssb-online-sparkbuss880332.codeanyapp.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 13 Jun 2024 16:49:45 GMT last-modified Wed, 09 Aug 2023 01:59:08 GMT server openresty accept-ranges bytes etag "1b20-60273d3319300" content-length 6944
GET H2	200	favicon.ico manage-ssb-online-sparkbuss880332.codeanyapp.com/local/manage/ch-anmeldung/home/filez/	1 KB 1 KB	348ms 348ms	Other image/vnd.microsoft.icon	45.55.112.74 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://manage-ssb-online-sparkbuss880332.codeanyapp.com/local/manage/ch-anmeldung/home/filez/favicon.ico Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 45.55.112.74 San Francisco, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software openresty / Resource Hash `7c1925da382279a72f94990d0a1456f78918619f35780ea0905e4ae0db684677` Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://manage-ssb-online-sparkbuss880332.codeanyapp.com/local/manage/ch-anmeldung/home/login.php Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 13 Jun 2024 16:49:45 GMT last-modified Wed, 09 Aug 2023 01:59:08 GMT server openresty accept-ranges bytes etag "47e-60273d3319300" content-length 1150 content-type image/vnd.microsoft.icon

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Schweizerische Bundesbahnen (Transportation)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| event object| fence object| sharedStorage

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			manage-ssb-online-sparkbuss880332.codeanyapp.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 1v1shn6vk1concfi4mile73a66

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://sslpostch.blob.core.windows.net/favicon.ico Message: Failed to load resource: the server responded with a status of 400 (One of the request inputs is out of range.)
recommendation	warning	URL: https://manage-ssb-online-sparkbuss880332.codeanyapp.com/local/manage/ch-anmeldung/home/login.php Message: [DOM] Found 2 elements with non-unique id #login_button: (More info: https://goo.gl/9p2vKq) %o %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

manage-ssb-online-sparkbuss880332.codeanyapp.com
sslpostch.blob.core.windows.net
45.55.112.74
52.239.221.36
45b8f30ef99295a0d738416e4e5af9fa2dd41619499622c2c57416580fc7197b
58a037c0bde953b48561826f3df16031f7ddfce33c4018619d3f39c6af6eec1b
5c7f0e173844556da7ca5eb8936fa3dab1c00206960920a49a1eea9cde2bfaaf
7c1925da382279a72f94990d0a1456f78918619f35780ea0905e4ae0db684677
8585655c812adcc681df49885f847b416350870e0c6e9493cc6be2ceb4fb63d2
c0494f89be7292d192faee79f6ac5f93e95ded69207b73ff4660bb203017bcbc
c337d42ed7979c6be0282900bd957dd9d112a430dc7761463d655eb8f0d9bc07
deeee170c3759a6ed35c0c05c5b935d0e7638f1c0c5677166918ecff6edb1909
ef81e4c69a7b30b9697a08da20453c10772bf95eec7fa46207f9d505498ff6e4
f2f0d94a5141a75ef227f2699b6a43588741ede3edd2fe2d075a65b3d413b2f8

manage-ssb-online-sparkbuss880332.codeanyapp.com Open in urlscan Pro 45.55.112.74 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

11 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

378 kBTransfer

462 kBSize

1 Cookies

2 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

1 Cookies

2 Console Messages

Indicators

manage-ssb-online-sparkbuss880332.codeanyapp.com Open in urlscan Pro
45.55.112.74 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

378 kB
Transfer

462 kB
Size

1
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!