sbb-update-login-servicenow.codeanyapp.com
Open in
urlscan Pro
45.55.112.74
Malicious Activity!
Public Scan
Effective URL: https://sbb-update-login-servicenow.codeanyapp.com/login/
Submission: On March 26 via manual from CH — Scanned from CH
Summary
TLS certificate: Issued by R3 on January 17th 2024. Valid for: 3 months.
This is the only time sbb-update-login-servicenow.codeanyapp.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Schweizerische Bundesbahnen (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 35.160.225.6 35.160.225.6 | 16509 (AMAZON-02) (AMAZON-02) | |
20 | 45.55.112.74 45.55.112.74 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
1 2 | 65.9.68.209 65.9.68.209 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 188.114.97.9 188.114.97.9 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
22 | 3 |
ASN16509 (AMAZON-02, US)
PTR: ec2-35-160-225-6.us-west-2.compute.amazonaws.com
scnv.io |
ASN14061 (DIGITALOCEAN-ASN, US)
sbb-update-login-servicenow.codeanyapp.com |
ASN16509 (AMAZON-02, US)
PTR: server-65-9-68-209.fra56.r.cloudfront.net
logs1407.xiti.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
20 |
codeanyapp.com
sbb-update-login-servicenow.codeanyapp.com |
350 KB |
2 |
xiti.com
1 redirects
logs1407.xiti.com — Cisco Umbrella Rank: 73932 |
1 KB |
1 |
userstatics.com
userstatics.com — Cisco Umbrella Rank: 232719 |
648 B |
1 |
scnv.io
1 redirects
scnv.io — Cisco Umbrella Rank: 839485 |
878 B |
22 | 4 |
Domain | Requested by | |
---|---|---|
20 | sbb-update-login-servicenow.codeanyapp.com |
sbb-update-login-servicenow.codeanyapp.com
|
2 | logs1407.xiti.com |
1 redirects
sbb-update-login-servicenow.codeanyapp.com
|
1 | userstatics.com |
sbb-update-login-servicenow.codeanyapp.com
|
1 | scnv.io | 1 redirects |
22 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
codeanyapp.com R3 |
2024-01-17 - 2024-04-16 |
3 months | crt.sh |
userstatics.com E1 |
2024-01-29 - 2024-04-28 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://sbb-update-login-servicenow.codeanyapp.com/login/
Frame ID: E58585EB975981CA228262EA1A708855
Requests: 22 HTTP requests in this frame
Screenshot
Page Title
Anmeldung | SwissPassPage URL History Show full URLs
-
https://scnv.io/---M
HTTP 301
https://sbb-update-login-servicenow.codeanyapp.com/login/ Page URL
Detected technologies
Modernizr (JavaScript Libraries) ExpandDetected patterns
- ([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js
OneTrust (Cookie compliance) Expand
Detected patterns
- otSDKStub\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://scnv.io/---M
HTTP 301
https://sbb-update-login-servicenow.codeanyapp.com/login/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 17- https://logs1407.xiti.com/event?s=611076 HTTP 307
- https://logs1407.xiti.com/event?s=611076&Rdt=On
22 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
sbb-update-login-servicenow.codeanyapp.com/login/ Redirect Chain
|
25 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sso.min-20200819.css
sbb-update-login-servicenow.codeanyapp.com/login/css/ |
180 KB 23 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
modernizr-20200819.js
sbb-update-login-servicenow.codeanyapp.com/login/js/ |
8 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
otSDKStub.js
sbb-update-login-servicenow.codeanyapp.com/login/js/ |
21 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
launch-6cc731e967aa.min.js
sbb-update-login-servicenow.codeanyapp.com/login/js/ |
124 KB 38 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo_text_de-20200819.svg
sbb-update-login-servicenow.codeanyapp.com/login/images/ |
137 KB 137 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo-20200819.svg
sbb-update-login-servicenow.codeanyapp.com/login/images/ |
7 KB 7 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
loader-20200819.png
sbb-update-login-servicenow.codeanyapp.com/login/images/ |
272 B 418 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-20200819.js
sbb-update-login-servicenow.codeanyapp.com/login/js/ |
95 KB 33 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vendor.min-20200819.js
sbb-update-login-servicenow.codeanyapp.com/login/js/ |
176 KB 52 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
swisspass.min-20200819.js
sbb-update-login-servicenow.codeanyapp.com/login/js/ |
97 KB 25 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
SBBWeb-Light.woff2
sbb-update-login-servicenow.codeanyapp.com/login/fonts/ |
14 KB 14 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
e91f4b90-f9aa-4ace-891b-96dd07595d9f-test.json
sbb-update-login-servicenow.codeanyapp.com/login/js/otSDKStub.js/consent/e91f4b90-f9aa-4ace-891b-96dd07595d9f-test/ |
425 B 514 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
loader-20200819.png
sbb-update-login-servicenow.codeanyapp.com/login/images/ |
272 B 418 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login_bg.jpg
sbb-update-login-servicenow.codeanyapp.com/login/resources/img/ |
339 B 339 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icomoon.woff2
sbb-update-login-servicenow.codeanyapp.com/fonts/icomoon/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icomoon.ttf
sbb-update-login-servicenow.codeanyapp.com/fonts/icomoon/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
co-branding
sbb-update-login-servicenow.codeanyapp.com/idp/ |
322 B 411 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
event
logs1407.xiti.com/ Redirect Chain
|
0 348 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icomoon.woff
sbb-update-login-servicenow.codeanyapp.com/fonts/icomoon/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
sbb-update-login-servicenow.codeanyapp.com/login/ |
1 KB 1 KB |
Other
image/vnd.microsoft.icon |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
script.js
userstatics.com/get/ |
133 B 648 B |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Schweizerische Bundesbahnen (Transportation)33 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onpagereveal object| digitalDataLayer object| html5 object| Modernizr object| OneTrustStub object| digitalData object| dataLayerEvent function| OptanonWrapper function| validateForm function| closeModal function| $ function| jQuery object| _satellite boolean| __satelliteLoaded object| jQuery112009290157952707787 function| A11yDialog function| iFrameResize function| Cleave function| OevcResourceLoader object| dp object| oevc object| webtrends boolean| isMobile function| validate object| options object| attrs object| allowedProviders object| rememberMe boolean| providerAllowsRememberMe object| _pac object| pdl object| _paqueue object| pa5 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
sbb-update-login-servicenow.codeanyapp.com/login | Name: PHPREFS Value: full |
|
scnv.io/ | Name: sessionid Value: yqwzyu0u352w56phreich6xzwamucdn8 |
|
.codeanyapp.com/ | Name: pa_privacy Value: %22optin%22 |
|
.codeanyapp.com/ | Name: _pctx Value: %7Bu%7DN4IgrgzgpgThIC4B2YA2qA05owMoBcBDfSREQpAeyRCwgEt8oBJAE0RXSwH18yBbAJwB3AGYBGKPwBsAH1RgAHACZBAZmXSQAXyA |
|
.xiti.com/ | Name: atid Value: 8464921F-53DA-4A5E-AF2E-3E442B1D5878 |
10 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
logs1407.xiti.com
sbb-update-login-servicenow.codeanyapp.com
scnv.io
userstatics.com
188.114.97.9
35.160.225.6
45.55.112.74
65.9.68.209
1f6e67bc886cbf171ee9cb58e9985ddbf7e636315cec4f2034625a758d1f5b45
233ddeda2a0fbeee053d13f25669fe187bdef4fe708aacfadddd560905d209f1
288a3014f2d027986c323853f11ba24d76ce5bf6b4e4284d66768b103722e1f0
2b2485b0669a2f73c4846e82eb5a37421358591a8ac8ba21d8149bfb88adcbfb
5c7f0e173844556da7ca5eb8936fa3dab1c00206960920a49a1eea9cde2bfaaf
6d72fa0f78c80b1874d3ee4aadf43d973edc442a65fef83d37e684ac559893b7
7a9fa521a58ee93001981f3a7db498c589233d8cc616e8d09af0119388a865bc
7c1925da382279a72f94990d0a1456f78918619f35780ea0905e4ae0db684677
9c50211b34ab0377f3b35c243c98e402315127bfa5b51e147cb22c702174ca60
b2bd09619741b468fc0cbd1f8c5725ec3f434afbb0b8dc4d23660b58dd8414fc
c337d42ed7979c6be0282900bd957dd9d112a430dc7761463d655eb8f0d9bc07
c365cf63e0edecc072b99e919e45604dfbca32ec0a19dac39275c9c67d334caf
cff7649eef1729a6d81040d471722a0332bd380b9e92761be8d0c337ec013da4
deeee170c3759a6ed35c0c05c5b935d0e7638f1c0c5677166918ecff6edb1909
df9690fea031319de38a437cb6d393026c4aae70642ed394c4254ed64f035b26
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f053f049a78c3afbce0d34f57d0bea4a24f7964d0e1e45197a35c06124b5e357
f766c7457c6ec463eaa85778aa47261344f1772e0b7cf1987ad212f889f472f5