app.sendgrid.com.login.5446.funkymarys.de
Open in
urlscan Pro
192.119.64.25
Malicious Activity!
Public Scan
Effective URL: http://app.sendgrid.com.login.5446.funkymarys.de/en/5/2cb6e21cb6f2e127f3182cdab7d31399/70655aeaf64c6f926ab8ecfba3922fb3/4901394a69faf7aa1d1d4573d...
Submission: On June 15 via manual from US
Summary
This is the only time app.sendgrid.com.login.5446.funkymarys.de was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Sendgrid (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 167.89.118.35 167.89.118.35 | 11377 (SENDGRID) (SENDGRID) | |
1 18 | 192.119.64.25 192.119.64.25 | 54290 (HOSTWINDS) (HOSTWINDS) | |
1 | 2600:9000:215... 2600:9000:215d:8600:19:a248:21c0:21 | 16509 (AMAZON-02) (AMAZON-02) | |
1 1 | 151.139.236.32 151.139.236.32 | 33438 (HIGHWINDS2) (HIGHWINDS2) | |
1 | 2a00:d01:ff:9... 2a00:d01:ff:905:94:228:142:45 | 41887 (PROLOCATI...) (PROLOCATION Transit policy pref 100) | |
1 | 104.111.237.220 104.111.237.220 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
2 | 2a04:4e42:1b:... 2a04:4e42:1b::621 | 54113 (FASTLY) (FASTLY) | |
1 | 52.216.178.163 52.216.178.163 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 34.96.67.224 34.96.67.224 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2.17.191.240 2.17.191.240 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
2 | 34.237.183.110 34.237.183.110 | 14618 (AMAZON-AES) (AMAZON-AES) | |
27 | 9 |
ASN11377 (SENDGRID, US)
PTR: o16789118x35.outbound-mail.sendgrid.net
u13097642.ct.sendgrid.net |
ASN54290 (HOSTWINDS, US)
PTR: hwsrv-729802.hostwindsdns.com
app.sendgrid.com.login.5448.funky-marys.de | |
app.sendgrid.com.login.5446.funkymarys.de |
ASN16509 (AMAZON-02, US)
d1tjxxwiv1dd3b.cloudfront.net |
ASN41887 (PROLOCATION Transit policy pref 100, NL)
www.ehawk.net |
ASN16625 (AKAMAI-AS, US)
PTR: a104-111-237-220.deploy.static.akamaitechnologies.com
static.zuora.com |
ASN16509 (AMAZON-02, US)
PTR: s3-1-w.amazonaws.com
uiux.s3.amazonaws.com |
ASN15169 (GOOGLE, US)
PTR: 224.67.96.34.bc.googleusercontent.com
cdn.siftscience.com |
ASN16625 (AKAMAI-AS, US)
PTR: a2-17-191-240.deploy.static.akamaitechnologies.com
a72168671.cdn.optimizely.com |
ASN14618 (AMAZON-AES, US)
PTR: ec2-34-237-183-110.compute-1.amazonaws.com
logx.optimizely.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
17 |
funkymarys.de
app.sendgrid.com.login.5446.funkymarys.de |
983 KB |
3 |
optimizely.com
a72168671.cdn.optimizely.com logx.optimizely.com |
770 B |
2 |
polyfill.io
cdn.polyfill.io |
400 B |
1 |
siftscience.com
cdn.siftscience.com |
20 KB |
1 |
amazonaws.com
uiux.s3.amazonaws.com |
4 KB |
1 |
zuora.com
static.zuora.com |
6 KB |
1 |
ehawk.net
www.ehawk.net |
14 KB |
1 |
netdna-ssl.com
1 redirects
talon-ehawk.netdna-ssl.com |
157 B |
1 |
cloudfront.net
d1tjxxwiv1dd3b.cloudfront.net |
4 KB |
1 |
funky-marys.de
1 redirects
app.sendgrid.com.login.5448.funky-marys.de |
426 B |
1 |
sendgrid.net
1 redirects
u13097642.ct.sendgrid.net |
385 B |
27 | 11 |
Domain | Requested by | |
---|---|---|
17 | app.sendgrid.com.login.5446.funkymarys.de |
app.sendgrid.com.login.5446.funkymarys.de
|
2 | logx.optimizely.com |
app.sendgrid.com.login.5446.funkymarys.de
|
2 | cdn.polyfill.io |
app.sendgrid.com.login.5446.funkymarys.de
|
1 | a72168671.cdn.optimizely.com |
app.sendgrid.com.login.5446.funkymarys.de
|
1 | cdn.siftscience.com |
app.sendgrid.com.login.5446.funkymarys.de
|
1 | uiux.s3.amazonaws.com |
app.sendgrid.com.login.5446.funkymarys.de
|
1 | static.zuora.com |
app.sendgrid.com.login.5446.funkymarys.de
|
1 | www.ehawk.net |
app.sendgrid.com.login.5446.funkymarys.de
|
1 | talon-ehawk.netdna-ssl.com | 1 redirects |
1 | d1tjxxwiv1dd3b.cloudfront.net |
app.sendgrid.com.login.5446.funkymarys.de
|
1 | app.sendgrid.com.login.5448.funky-marys.de | 1 redirects |
1 | u13097642.ct.sendgrid.net | 1 redirects |
27 | 12 |
This site contains links to these domains. Also see Links.
Domain |
---|
sendgrid.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.cloudfront.net DigiCert Global CA G2 |
2020-05-26 - 2021-04-21 |
a year | crt.sh |
*.ehawk.net Sectigo RSA Domain Validation Secure Server CA |
2020-01-13 - 2021-01-13 |
a year | crt.sh |
www.zuora.com COMODO RSA Domain Validation Secure Server CA |
2018-10-12 - 2021-01-13 |
2 years | crt.sh |
f3.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3 |
2020-06-08 - 2021-04-17 |
10 months | crt.sh |
*.s3.amazonaws.com DigiCert Baltimore CA-2 G2 |
2019-11-09 - 2021-03-12 |
a year | crt.sh |
*.siftscience.com DigiCert SHA2 Secure Server CA |
2019-01-03 - 2021-03-26 |
2 years | crt.sh |
*.cdn.optimizely.com GeoTrust RSA CA 2018 |
2020-03-05 - 2021-06-04 |
a year | crt.sh |
logx.optimizely.com DigiCert SHA2 High Assurance Server CA |
2018-10-01 - 2020-10-05 |
2 years | crt.sh |
This page contains 2 frames:
Primary Page:
http://app.sendgrid.com.login.5446.funkymarys.de/en/5/2cb6e21cb6f2e127f3182cdab7d31399/70655aeaf64c6f926ab8ecfba3922fb3/4901394a69faf7aa1d1d4573d12a91ee
Frame ID: FD80A8F2D619C9E62B81489215CCCF83
Requests: 26 HTTP requests in this frame
Frame:
https://a72168671.cdn.optimizely.com/client_storage/a72168671.html
Frame ID: F6727DBD46546EA683427B9F6F343448
Requests: 1 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://u13097642.ct.sendgrid.net/ls/click?upn=EvFr-2B18WinD08hmpH0D7yihQuhF-2BhKuO61kxhGjIa2FYRkohH-2BZbnaAKP...
HTTP 302
http://app.sendgrid.com.login.5448.funky-marys.de/c4ca4238a0b923820dcc509a6f75849b/d086195abb3acc216d285cf9ce94f9e9/2cb6e21cb6... HTTP 302
http://app.sendgrid.com.login.5446.funkymarys.de/en/5/2cb6e21cb6f2e127f3182cdab7d31399/70655aeaf64c6f926ab8ecfba3922fb3/49013... Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- headers server /php\/?([\d.]+)?/i
CentOS (Operating Systems) Expand
Detected patterns
- headers server /CentOS/i
OpenSSL (Web Server Extensions) Expand
Detected patterns
- headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i
Apache (Web Servers) Expand
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Sign up now!
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://u13097642.ct.sendgrid.net/ls/click?upn=EvFr-2B18WinD08hmpH0D7yihQuhF-2BhKuO61kxhGjIa2FYRkohH-2BZbnaAKPJxhkwZR3dQdHBDXpYZCQlbqtfhL6asimfZ0FZQJdPt1bULIPE9TbSyU8aMNUSwYYQFWzhlXsZZUKlboGHDk-2BWWNzOSTrJMZMTBpzSwKKabutuU0VLNF5gOtBkOEB6FNaWF2sPm6fI6yUkhQyJL9vojfJSu2aqlfcSqpe5OiNmBjKxJvKGXYdRtcKECwu-2FcMwNFWFaWbjQ5k_YT-2BgtM2gIoe0GzKRNjnJV28CuMg-2Fg7sgVy2XFUAstQOSd83TP0LlYOozLdAihKGJIxch-2B7yjnl5-2F8IFPwaDial0q6z5Lq2-2F2euBQjfifEdlbXxrDho6NP2cdH01c9dTioKAxdT4fgUVM6qg-2BjOMtarA6V-2Bp-2FyFKMvYX343ULxULwkVHixf70DpUPPpzXBiHSdj47xcO2N1TlRPOrFgAEXw-3D-3D
HTTP 302
http://app.sendgrid.com.login.5448.funky-marys.de/c4ca4238a0b923820dcc509a6f75849b/d086195abb3acc216d285cf9ce94f9e9/2cb6e21cb6f2e127f3182cdab7d31399/ffc5e01f578535fd6f95f889cb31939d HTTP 302
http://app.sendgrid.com.login.5446.funkymarys.de/en/5/2cb6e21cb6f2e127f3182cdab7d31399/70655aeaf64c6f926ab8ecfba3922fb3/4901394a69faf7aa1d1d4573d12a91ee Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 6- https://talon-ehawk.netdna-ssl.com/EHawkTalon.js HTTP 301
- https://www.ehawk.net/talon-cdn/EHawkTalon.js
27 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
4901394a69faf7aa1d1d4573d12a91ee
app.sendgrid.com.login.5446.funkymarys.de/en/5/2cb6e21cb6f2e127f3182cdab7d31399/70655aeaf64c6f926ab8ecfba3922fb3/ Redirect Chain
|
50 KB 50 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tiara.css
d1tjxxwiv1dd3b.cloudfront.net/ |
23 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
72168671.js
app.sendgrid.com.login.5446.funkymarys.de/SendGrid/com/src/ |
371 KB 372 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
api_config.js
app.sendgrid.com.login.5446.funkymarys.de/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
108.e0ff89b5ed61aa692324.css
app.sendgrid.com.login.5446.funkymarys.de/SendGrid/com/src/ |
157 KB 157 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
12.a3c87866979216143f24.css
app.sendgrid.com.login.5446.funkymarys.de/SendGrid/com/src/ |
388 KB 389 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
container.css
app.sendgrid.com.login.5446.funkymarys.de/SendGrid/com/src/ |
15 KB 16 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
EHawkTalon.js
www.ehawk.net/talon-cdn/ Redirect Chain
|
43 KB 14 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ckeditor.js
app.sendgrid.com.login.5446.funkymarys.de/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
zuora-min.js
static.zuora.com/Resources/libs/hosted/1.3.0/ |
16 KB 6 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
polyfill.min.js
cdn.polyfill.io/v2/ |
222 B 200 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sg-twilio-lockup.svg
uiux.s3.amazonaws.com/logo/ |
4 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
runtime.90bee01e22454a5f6de0.js
app.sendgrid.com.login.5446.funkymarys.de/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
vendors~main.8dbed9e02b0fb25fdd9a.js
app.sendgrid.com.login.5446.funkymarys.de/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.3fc4efc9e81871874e68.js
app.sendgrid.com.login.5446.funkymarys.de/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
s.js
cdn.siftscience.com/ |
61 KB 20 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
api_config.js
app.sendgrid.com.login.5446.funkymarys.de/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ckeditor.js
app.sendgrid.com.login.5446.funkymarys.de/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
a72168671.html
a72168671.cdn.optimizely.com/client_storage/ Frame F672 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
polyfill.min.js
cdn.polyfill.io/v2/ |
222 B 200 B |
Other
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
runtime.90bee01e22454a5f6de0.js
app.sendgrid.com.login.5446.funkymarys.de/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
colfax-regular.05f3d250.woff2
app.sendgrid.com.login.5446.funkymarys.de/dist/static/media/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
colfax-regular.95413010.woff
app.sendgrid.com.login.5446.funkymarys.de/dist/static/media/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
vendors~main.8dbed9e02b0fb25fdd9a.js
app.sendgrid.com.login.5446.funkymarys.de/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.3fc4efc9e81871874e68.js
app.sendgrid.com.login.5446.funkymarys.de/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
events
logx.optimizely.com/v1/ |
0 385 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
events
logx.optimizely.com/v1/ |
0 385 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Sendgrid (Online)33 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate object| trackedEvents function| track undefined| _ object| optimizely object| dataLayer object| referrer string| hostname object| theBody function| initNewRelic function| initGTM string| publicPath string| route boolean| inBlackList object| urlBlacklist boolean| OnlyBlacklist boolean| blackListInit function| eHawkTalon function| EHTalon function| Fingerprint object| script string| __z_version string| ifrmId boolean| threedRedirected object| ZLOG object| ZXD object| Z object| ZFB object| _sift function| __siftFlashCB undefined| Sift object| PluginDetect1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.funkymarys.de/ | Name: optimizelyEndUserId Value: oeu1592229598474r0.3290213636115251 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
a72168671.cdn.optimizely.com
app.sendgrid.com.login.5446.funkymarys.de
app.sendgrid.com.login.5448.funky-marys.de
cdn.polyfill.io
cdn.siftscience.com
d1tjxxwiv1dd3b.cloudfront.net
logx.optimizely.com
static.zuora.com
talon-ehawk.netdna-ssl.com
u13097642.ct.sendgrid.net
uiux.s3.amazonaws.com
www.ehawk.net
104.111.237.220
151.139.236.32
167.89.118.35
192.119.64.25
2.17.191.240
2600:9000:215d:8600:19:a248:21c0:21
2a00:d01:ff:905:94:228:142:45
2a04:4e42:1b::621
34.237.183.110
34.96.67.224
52.216.178.163
1a2a572f006b242096d76275e8c9edb114f9aa65cbd67fd1c4d57053da83932f
29eb73b66f7f12c0e8cb17b131dffa962bf9d992d24406a6ced52315c33a1f3a
67ebd998fb16c0f51f2725b55ada5d28982e4943f5b50c3c141b78b96317fdfc
7921df86278b7fa9be0cbd78d9990071763ec4e9e88aaff2c3d466723090b8ae
929e88471afd8a6882e29779d1f4175111d92b6180baa86265db6bb90c9f18cd
9c039230a469d0d57cfc3866662782543561dae3ce6cb54ea02a9df6d4d6a67e
ad513eaf2eb2f74e2d6e618c02037e7e842952dd55cbb870ba3d3b060a712f9a
b29a07e2825e8ec2610a36eea52d9c1657f4e5101d9ef4a6082b93eb7277e871
cae897bdde94867960ad284a56b1631296eaceddf5710a2857127ca0aa2777d3
ce6c8a655514b0de3173c43f4175e9f37ca8e59956ee1a1e3e0218aee2735671
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f7dff0321d998ec9f035b23e16c81bf72f44af5c6c06167ebd5374a426fae1ed