gzdpfs3ts.agilecrm.com
Open in
urlscan Pro
2a00:1450:4001:801::2013
Malicious Activity!
Public Scan
Submission Tags: falconsandbox
Submission: On February 24 via api from US
Summary
TLS certificate: Issued by RapidSSL TLS DV RSA Mixed SHA256 2020... on October 29th 2020. Valid for: a year.
This is the only time gzdpfs3ts.agilecrm.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Facebook (Social Network)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
4 | 2a00:1450:400... 2a00:1450:4001:801::2013 | 15169 (GOOGLE) (GOOGLE) | |
3 | 52.217.64.6 52.217.64.6 | 16509 (AMAZON-02) (AMAZON-02) | |
1 3 | 94.242.61.15 94.242.61.15 | 43317 (FISHNET-AS) (FISHNET-AS) | |
1 | 2606:4700:20:... 2606:4700:20::681a:64 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 67.202.114.214 67.202.114.214 | 32748 (STEADFAST) (STEADFAST) | |
11 | 6 |
ASN15169 (GOOGLE, US)
gzdpfs3ts.agilecrm.com | |
stats2.agilecrm.com |
ASN16509 (AMAZON-02, US)
PTR: s3-1.amazonaws.com
s3.amazonaws.com |
ASN43317 (FISHNET-AS, RU)
PTR: server1.server-sz.com
daleteteo.online |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
agilecrm.com
gzdpfs3ts.agilecrm.com stats2.agilecrm.com |
20 KB |
3 |
daleteteo.online
1 redirects
daleteteo.online |
500 KB |
3 |
amazonaws.com
s3.amazonaws.com |
820 KB |
1 |
amung.us
whos.amung.us |
30 B |
1 |
geojs.io
get.geojs.io |
1 KB |
11 | 5 |
Domain | Requested by | |
---|---|---|
3 | daleteteo.online |
1 redirects
gzdpfs3ts.agilecrm.com
|
3 | s3.amazonaws.com |
gzdpfs3ts.agilecrm.com
|
3 | gzdpfs3ts.agilecrm.com |
gzdpfs3ts.agilecrm.com
|
1 | stats2.agilecrm.com |
gzdpfs3ts.agilecrm.com
|
1 | whos.amung.us |
gzdpfs3ts.agilecrm.com
|
1 | get.geojs.io |
gzdpfs3ts.agilecrm.com
|
11 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.agilecrm.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.agilecrm.com RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1 |
2020-10-29 - 2021-11-29 |
a year | crt.sh |
s3.amazonaws.com DigiCert Baltimore CA-2 G2 |
2020-08-04 - 2021-08-09 |
a year | crt.sh |
daleteteo.online cPanel, Inc. Certification Authority |
2021-02-04 - 2021-05-05 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2020-07-09 - 2021-07-09 |
a year | crt.sh |
whos.amung.us Sectigo RSA Domain Validation Secure Server CA |
2020-05-21 - 2022-05-21 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://gzdpfs3ts.agilecrm.com/landing/6054526174953472
Frame ID: DD20B6B45138562880B79C8989A82804
Requests: 13 HTTP requests in this frame
Screenshot
Detected technologies
Google App Engine (Web Servers) ExpandDetected patterns
- headers server /Google Frontend/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Powered by Agile
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 4- https://daleteteo.online/yilaine/location HTTP 301
- https://daleteteo.online/yilaine/location/
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
6054526174953472
gzdpfs3ts.agilecrm.com/landing/ |
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
skeleton.min.css
s3.amazonaws.com/agilecrm/pagebuilder/live/build/css/ |
328 KB 329 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
daleteteo.online/yilaine/ |
718 KB 500 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
elements.min.js
s3.amazonaws.com/agilecrm/pagebuilder/beta/build/js/ |
452 KB 453 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
agile-min.js
gzdpfs3ts.agilecrm.com/stats/min/ |
63 KB 18 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
/
daleteteo.online/yilaine/location/ Redirect Chain
|
1 KB 522 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
geo.json
get.geojs.io/v1/ip/ |
350 B 1 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
whos.amung.us/pingjs/ |
30 B 30 B |
Image
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
51 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
addstats
stats2.agilecrm.com/ |
0 83 B |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
agile-webrules-min.js
s3.amazonaws.com/agilecrm/web-rules-static/ |
38 KB 39 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
web-rules
gzdpfs3ts.agilecrm.com/core/js/api/ |
30 B 149 B |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Facebook (Social Network)220 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| sh boolean| IS_MOBILE number| limit_bot string| object string| type string| OUTPUT object| ___ object| params number| tt undefined| to_object string| a function| checking function| creatingInput function| searchingForms function| $ function| jQuery object| jQuery11110801713359695434 function| onDomReady function| augment object| Holder function| Bloodhound object| Select2 function| _agile_synch_form_v3 function| agile_propertyJSON undefined| agile_json_timer function| agile_json function| agile_getPipelines function| agile_getMilestones function| agile_getMilestones_by_pipeline function| agile_trackPageview function| agile_trackingDomain function| agile_createCase function| agile_enable_console_logging function| agile_track_form_action function| agile_track_webrule object| agile_guid function| agile_read_cookie function| show_cookie_banner function| add_cookie function| hide_banner function| decline_cookie function| agile_create_cookie_callback function| agile_create_cookie function| agile_create_cookie_helper function| agile_createCookieInAllAgileSubdomains function| agile_delete_cookie function| agile_store_data function| agile_read_data function| agile_erase_data function| agile_islocalStorageHasSpace function| encode_cookie function| escape_html function| escape_json_values function| unescape_html function| _agile_synch_form_v4 function| prepareDateTypeValue function| agileDateValueValidate function| agile_setEmail function| agile_getEmail function| agile_addNote function| agile_getNotes function| appendFutureYears function| agile_removeCommonTags function| agile_cookieTags function| agile_cookieScore function| agile_cookieCampaigns function| agile_updateCookieCampaigns function| agile_formCallback function| _agile_load_form_fields function| getParameterByName function| agile_setUtmParams function| agile_getUtmParams function| _agile_check_function_caller_is_console function| agile_find_closest_element function| agile_addCampaign function| agile_getCampaigns function| agile_getCampaignlogs function| agile_getWorkflows function| agile_unsubscribeCampaign object| agile_session function| agile_setProperty function| agile_getProperty function| agile_removeProperty function| agile_addDeal function| agile_getDeals function| agile_updateDeal function| agile_addTask function| agile_getTasks function| _agile_synch_form_v2 function| _agile_is_js_serving_from_cloudfront function| agile_webRules function| _agile_execute_web_rules function| _agile_require_js function| loadAgileCRMForm function| showAgileCRMForm function| agileOnloadFunction function| agileOnLoadEventListener function| agile_createContact function| agile_deleteContact function| agile_getContact function| agile_updateContact function| agile_createCompany function| agile_getUtmParamsAsProperties function| _agile_synch_form_v5 function| _agile_getUtmParamsForV5 function| _agile_form_serialize function| _agile_sendRequest object| _agileXMLHttpFactories function| _agile_createXMLHTTPObject function| _agile_requestData function| agile_allowedDomains function| agile_getAllUsers function| agile_addTag function| agile_removeTag function| agile_getTags function| _agile_synch_form object| _agile function| agile_addScore function| agile_subtractScore function| agile_getScore function| agile_setAccount function| agile_setEmailFromUrl function| _agile_set_whitelist function| agile_validations function| validateEmail function| validatePhonenumber function| validateCaptcha function| agileGCaptchaOnSuccess function| validTagsString function| utmHiddenField function| deleteAgileHiddenFields function| agileUtmOnLoadFormFunction object| agile_id object| Agile_API string| guid function| json7904953715504222 string| IS_AGILE_WEB_RULE_EXECUTED function| _agile_execute_action function| _agileCheckForBusinessHours function| _agileIsCurrentDayFallsInRange function| _agileGetLocalDateTime function| _agileIsCurrentTimeFallsInBetween function| _agile_call_webrules function| calling_webrules function| _agile_dialpad function| agileTwilioSendDTMF function| _agile_call_hangup function| add_hangup_element function| _agile_close_modal function| _agile_hide_close_button function| _agile_close_modal_v2 function| _agile_check_condition function| agile_web_rule_contains_lhs function| agile_web_rules_contains_lhs function| _agile_add_web_rule_cookie function| agile_get_cookie_index function| _agile_get_new_rule function| _agile_webrule_get_cookie function| _agile_webrule_cookie function| _agile_webrules function| _agile_execute_webrules function| _agile_execute_webrule function| _agile_exit_intent function| _agile_exit_intent_ie function| _agile_exit_intent_firefox function| _agile_load_fields function| _agile_save_form function| _agile_save_form_v2 function| _agile_help_element function| _agile_checkField function| _agile_closeQuery function| _agile_disableErrorField function| _agile_invalidEmail function| _agile_show_modal function| _agile_draw_modal function| _agile_show_noty function| _agile_get_shopify_cart function| _agile_show_site_bar function| createIframeWithContent function| _agile_convert_json function| load_head_js function| load_jquery_lib function| load_handlebars_lib function| load_noty_lib function| load_simple_modal_lib function| load_modernizr_lib function| _agile_is_browser function| _agile_is_mobile_browser function| _agile_web_rules_have_position function| _agile_sort_web_rules_by_position function| _agile_remove_cdata_tags function| _agile_is_whitelabel_enabled function| convert_obj_toArray function| _agile_showAllDynamicBlockElements function| _agile_add_target_to_all_anchor_tags function| _agileExecuteTagActionsAtOnce function| _agile_when object| _agileBusinessDaysRange undefined| dialpad_ele undefined| globalconnection object| _agile_rules undefined| _agile_mouseY boolean| _agile_exit_intent_shown undefined| _agile_contact object| _agile_web_rules string| _agile_email undefined| _agile_shopify_cart undefined| BUTTON_ELEMENT object| _agile_tag_web_rule_actions undefined| _agile_SM function| json457905040053203654 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
gzdpfs3ts.agilecrm.com/ | Name: j58jktpm5l5eo41jl037a5bjcg-agile-crm-session_start_time Value: 58 |
|
gzdpfs3ts.agilecrm.com/ | Name: j58jktpm5l5eo41jl037a5bjcg-agile-crm-session_id Value: 191deb1a-2063-c038-1c98-e94858d95ebd |
|
gzdpfs3ts.agilecrm.com/ | Name: j58jktpm5l5eo41jl037a5bjcg-agile-crm-guid Value: 14e84564-acc3-bb44-8b70-46fdc696a7ed |
|
gzdpfs3ts.agilecrm.com/ | Name: JSESSIONID Value: fJg1C6ugQ7P9CKcf_sC4Sg |
5 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
daleteteo.online
get.geojs.io
gzdpfs3ts.agilecrm.com
s3.amazonaws.com
stats2.agilecrm.com
whos.amung.us
2606:4700:20::681a:64
2a00:1450:4001:801::2013
52.217.64.6
67.202.114.214
94.242.61.15
0daba41c5c86b3cc242e8160d2e8a0103f64d87aacee5bfc26fd5d74ca2a0992
1230532f79456753fb73f559ece9b95c17cfb36325dc313a3eda5ac22dfd9a2b
2c9f88eacb50dc4cc1b7fd9da4382e911a019a271706871a72dec556a27274e8
52672a8ecda55423e30966d4da88416e6c7e5275f38e2c0b621f65ddf3a67c2d
7281941fed81ed9caf5728727e05da4a94b442c36796e1a5b1d6106f242ed11f
ca14b8c2361edaee0359696254370edee5ee3b042d572ca8978b86582081230c
ce0b3cc4048b5dd27f352533ac47cbdef8f4bb9a5170a7fa6d2a917428946599
d84b0983887bd326595d23e190e367146a3d498a301d2176e1b605a810d4675c
e260b9c304598205a322374408f2e2718acab63e585af74e41fb69179d3b4337
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ed65b5428ab2a5530280232bc6b31854e63395734447a8ba651848af52d1a609
f2c330711831453f9df0d4b03f7b43357587ce1ecf7ef71642e0aa2a5d9236f1