app-sengrid.com Open in urlscan Pro
172.67.166.207 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://u32500224.ct.sendgrid.net/ls/click?upn=u001.emrai8U9WJ8Twfi5rQ0RC2PaWQtSVNPjxUyJ6-2FAVJa81-2F9rI3WMUFlhEflymmkT2rBH6_kh-2B...
Effective URL:
https://app-sengrid.com/login
Submission: On September 23 via manual (September 23rd 2024, 3:48:13 pm UTC) from CA — Scanned from CA

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 6 domains to perform 9 HTTP transactions. The main IP is 172.67.166.207, located in United States and belongs to CLOUDFLARENET, US. The main domain is app-sengrid.com.
TLS certificate: Issued by WE1 on September 16th 2024. Valid for: 3 months.

This is the only time app-sengrid.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Sendgrid (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	167.89.115.58 167.89.115.58	11377 (SENDGRID) (SENDGRID)
1 1	104.17.112.233 104.17.112.233	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	172.67.157.230 172.67.157.230	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 9	172.67.166.207 172.67.166.207	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 2	2606:4700::68... 2606:4700::6811:f6cb	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.18.161.117 104.18.161.117	13335 (CLOUDFLAR...) (CLOUDFLARENET)
9	3

1 167.89.115.58 (Herndon, United States) 1 redirects

ASN11377 (SENDGRID, US)
PTR: o16789115x58.outbound-mail.sendgrid.net

u32500224.ct.sendgrid.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.112.233 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

tinyurl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.157.230 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

gateway-sendgrid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 172.67.166.207 (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

app-sengrid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6811:f6cb (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

unpkg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.161.117 (None, )

ASN13335 (CLOUDFLARENET, US)

cdn.prod.website-files.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	app-sengrid.com 2 redirects app-sengrid.com	47 KB
2	unpkg.com 1 redirects unpkg.com — Cisco Umbrella Rank: 803	21 KB
1	website-files.com cdn.prod.website-files.com — Cisco Umbrella Rank: 6224	18 KB
1	gateway-sendgrid.com 1 redirects gateway-sendgrid.com	424 B
1	tinyurl.com 1 redirects tinyurl.com — Cisco Umbrella Rank: 19040	761 B
1	sendgrid.net 1 redirects u32500224.ct.sendgrid.net	231 B
9	6

	Domain	Requested by
9	app-sengrid.com	2 redirects app-sengrid.com
2	unpkg.com	1 redirects app-sengrid.com
1	cdn.prod.website-files.com	app-sengrid.com
1	gateway-sendgrid.com	1 redirects
1	tinyurl.com	1 redirects
1	u32500224.ct.sendgrid.net	1 redirects
9	6

This site contains no links.

Subject Issuer	Validity	Valid
app-sengrid.com WE1	`2024-09-16` - `2024-12-15`	3 months	crt.sh
prod.website-files.com WE1	`2024-08-23` - `2024-11-21`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://app-sengrid.com/login
Frame ID: 96A7EB7C2F6F63A4C6EE158339A5E447
Requests: 7 HTTP requests in this frame

Frame: https://app-sengrid.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/ec4b873d446c/main.js
Frame ID: 0CBC515844A537D93C65C353206EF642
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Recovery | Login

Page URL History Show full URLs

https://u32500224.ct.sendgrid.net/ls/click?upn=u001.emrai8U9WJ8Twfi5rQ0RC2PaWQtSVNPjxUyJ6-2FAVJa81-2F9rI3WMUFl... HTTP 302
https://tinyurl.com/bddxe993 HTTP 301
http://gateway-sendgrid.com/ HTTP 307
https://gateway-sendgrid.com/ HTTP 301
https://app-sengrid.com/ HTTP 303
https://app-sengrid.com/login Page URL

Page Statistics

9
Requests

78 %
HTTPS

17 %
IPv6

6
Domains

6
Subdomains

3
IPs

2
Countries

85 kB
Transfer

163 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://u32500224.ct.sendgrid.net/ls/click?upn=u001.emrai8U9WJ8Twfi5rQ0RC2PaWQtSVNPjxUyJ6-2FAVJa81-2F9rI3WMUFlhEflymmkT2rBH6_kh-2BkvUQ70fULTiohBTD3D2LIy-2Fjr7uzqeh29o-2FV8ZRVpp-2FeG3SifP5R9ZM4nylnd89Z5qk1GoYg1p2POWUiV7HjqMewwj4ZHV84jstsQmDEBKegql6AjttNoDcngbUkGMZDFOlehdUPKUbvdhZ6ASSQyMIundCIPjT7uouuyo1CT519FJWQsUBSq7EuUXQ8J3Y5owRvMT9OApkwhVb6d8Q-3D-3D HTTP 302
https://tinyurl.com/bddxe993 HTTP 301
http://gateway-sendgrid.com/ HTTP 307
https://gateway-sendgrid.com/ HTTP 301
https://app-sengrid.com/ HTTP 303
https://app-sengrid.com/login Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2

https://unpkg.com/htmx.org@1.9.12 HTTP 302
https://unpkg.com/htmx.org@1.9.12/dist/htmx.min.js

Request Chain 5

https://app-sengrid.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
https://app-sengrid.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/ec4b873d446c/main.js

9 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3

200

Primary Request login Show response
app-sengrid.com/
Redirect Chain

https://u32500224.ct.sendgrid.net/ls/click?upn=u001.emrai8U9WJ8Twfi5rQ0RC2PaWQtSVNPjxUyJ6-2FAVJa81-2F9rI3WMUFlhEflymmkT2rBH6_kh-2BkvUQ70fULTiohBTD3D2LIy-2Fjr7uzqeh29o-2FV8ZRVpp-2FeG3SifP5R9ZM4nylnd...
https://tinyurl.com/bddxe993
http://gateway-sendgrid.com/
https://gateway-sendgrid.com/
https://app-sengrid.com/
https://app-sengrid.com/login

3 KB
2 KB

94ms
89ms

Document
text/html

172.67.166.207
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://app-sengrid.com/login
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.166.207 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7003b8de8942e8b21f823d40dd277587711902317e603044e01cf70b9e4a788e

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cf-cache-status: DYNAMIC
cf-ray: 8c7bad2b7e2cab54-YYZ
content-encoding: br
content-type: text/html
date: Mon, 23 Sep 2024 15:47:59 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vvxr4Xy1UvX93Ym0rqr7M7vIxT8Q4mN7r4zF2C%2F7eHxgyAqaytkv8dYkd%2BY0Z2uu%2FSHpbkIt8n5eoLrIr03hsCp4iK7JL0fLLSLkCS1nhvWjna81Q1Wmnt75u7Ax%2BdaBeVI%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"

Redirect headers

cf-cache-status: DYNAMIC
cf-ray: 8c7bad2a8d3bab54-YYZ
content-length: 0
date: Mon, 23 Sep 2024 15:47:59 GMT
location: /login
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QrmNeu6JL6DuGNqLjtIqA0a7bHxLYAc9hdRhos7YpY%2FL85E4OnAu5O2VPPTwo2kNhSrnVETHOcY3xifNr7gzomrkTjBLlN1uvxfKnTKIwk1f3i%2FaOPJNbV0ckJy6EF4bhWc%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H3 200 speculation
app-sengrid.com/cdn-cgi/ 128 B
542 B 166ms
124ms Other
application/speculationrules+json 172.67.166.207
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://app-sengrid.com/cdn-cgi/speculation
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.166.207 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://app-sengrid.com
Referer: https://app-sengrid.com/login

Response headers

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FK7Jz5b%2F8J2foRTpOgdjP8nYlDdsDJTOppxys5%2B9bbf9x%2BPxTQwYM4OnSp7g90f2%2FhOdK47Mliy2ArTGKXYOG3YZChI40TyxjXuwGQpWPBhHNqesEVbErr2xgWDSPKIh5Bw%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8c7bad2d0f8cab54-YYZ
access-control-allow-origin: https://app-sengrid.com
content-length: 128
date: Mon, 23 Sep 2024 15:48:00 GMT
content-type: application/speculationrules+json
vary: Origin, Accept-Encoding
server: cloudflare

GET
H3 200 style.css
app-sengrid.com/assets/ 24 KB
6 KB 151ms
94ms Stylesheet
text/css 172.67.166.207
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://app-sengrid.com/assets/style.css
Requested by: Host: app-sengrid.com
URL: https://app-sengrid.com/login
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.166.207 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 29d0825d48648637c1ef4b44f2c49beb52244a32363c209c492aeca04ec634e3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://app-sengrid.com/login

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 5610
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b35HFzhWzrcmdDPdun1JzmbX8d81BgI3xpBcRMyw7wlZcnL02NrvCzbTqhs1JhA1vu5dCF3xWSaFFl%2BMR3ReyfJBh1jFWCW5UpIjQaedx1tlxKGOn5WJvZ0rWf69C4GVLG8%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8c7bad2d2fa8ab54-YYZ
date: Mon, 23 Sep 2024 15:48:00 GMT
content-type: text/css; charset=utf-8
last-modified: Mon, 23 Sep 2024 14:14:30 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2

200

htmx.min.js Show response
unpkg.com/htmx.org@1.9.12/dist/
Redirect Chain

https://unpkg.com/htmx.org@1.9.12
https://unpkg.com/htmx.org@1.9.12/dist/htmx.min.js

47 KB
21 KB

37ms
31ms

Script
application/javascript

2606:4700::6811:f6cb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://unpkg.com/htmx.org@1.9.12/dist/htmx.min.js

Requested by

Host: app-sengrid.com
URL: https://app-sengrid.com/login

Protocol

Server

2606:4700::6811:f6cb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

449317ade7881e949510db614991e195c3a099c4c791c24dacec55f9f4a2a452

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://app-sengrid.com/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: "bbe5-dcReH3mvDeiP4kaSm5UCvCZgJDY"
age: 4494889
x-content-type-options: nosniff
date: Mon, 23 Sep 2024 15:48:00 GMT
content-type: application/javascript; charset=utf-8
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
fly-request-id: 01J49TDSA5K8PY90BFW52R3J60-yul
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
via: 1.1 fly.io
cf-ray: 8c7bad30ebbda2c8-YUL
access-control-allow-origin: *
server: cloudflare

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000
location: /htmx.org@1.9.12/dist/htmx.min.js
content-encoding: br
cf-cache-status: HIT
age: 4494818
x-content-type-options: nosniff
via: 1.1 fly.io
cf-ray: 8c7bad302b27a2c8-YUL
access-control-allow-origin: *
date: Mon, 23 Sep 2024 15:48:00 GMT
content-type: text/plain; charset=utf-8
vary: Accept, Accept-Encoding
fly-request-id: 01J49TFZ38C1ZEXHT1TG22AQDD-yul
server: cloudflare

GET
H3 200 60ccab95f49dcc67b29a6061_5e8db592a1b1cc4a668e23d7_SG_Twilio_Lockup_Social.png
cdn.prod.website-files.com/60a4d4a53dd0c3f45579ac64/ 18 KB
18 KB 579ms
76ms Image
image/png 104.18.161.117
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.prod.website-files.com/60a4d4a53dd0c3f45579ac64/60ccab95f49dcc67b29a6061_5e8db592a1b1cc4a668e23d7_SG_Twilio_Lockup_Social.png
Requested by: Host: app-sengrid.com
URL: https://app-sengrid.com/login
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.161.117 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fa5b049d3a337233123b839272aa1d7788a599213234bb4f0a170c5ecdd9a7f4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://app-sengrid.com/

Response headers

cf-cache-status: HIT
etag: "56f3cfd2f6b0c62422980170d57fac64"
x-amz-version-id: qToqhkuN_lmGuAFbCctIciVGM1QnHz_5
age: 8387
date: Mon, 23 Sep 2024 15:48:00 GMT
content-type: image/png
last-modified: Fri, 18 Jun 2021 14:20:06 GMT
vary: Accept-Encoding
x-amz-id-2: lWrbyhSLLeSLwfoae6osgujHApYhyKWDrRg1pjoLKtH+NSmY6dWAzRoHPuQBdqhyS5uQbO5bS55w9YFfr/e41YjyE96hcy4w
cache-control: max-age=84600, must-revalidate
x-amz-request-id: 4B5CJ5N2MAY8R8Z2
cf-ray: 8c7bad2ffc6fab4b-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18146
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H3 200 TwilioSansText-Regular.woff2
app-sengrid.com/assets/ 32 KB
32 KB 63ms
62ms Font
font/woff2 172.67.166.207
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://app-sengrid.com/assets/TwilioSansText-Regular.woff2
Requested by: Host: app-sengrid.com
URL: https://app-sengrid.com/assets/style.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.166.207 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d59ffdf024460962a63c162271cf50836ad1eb02f1422d4e6d7a9ea3431e1d0a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://app-sengrid.com
Referer: https://app-sengrid.com/assets/style.css

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: HIT
age: 5610
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rQhdySxSknDq68UmGvfpLcYpxQhvYtREOXzg3E3LSvXTSkdFKdIvGH98Q33qjVcjnXgEAb2rDJfxoYUNfb5Y%2FWeIqQkcc%2FEJtBqdS170Z1FP4r7OzS0V0c1pZHn2Sw3HViM%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8c7bad339f23ab54-YYZ
accept-ranges: bytes
content-length: 32384
date: Mon, 23 Sep 2024 15:48:01 GMT
content-type: font/woff2
last-modified: Mon, 23 Sep 2024 14:14:31 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3

200

main.js Show response
app-sengrid.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/ec4b873d446c/ Frame 0CBC
Redirect Chain

https://app-sengrid.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
https://app-sengrid.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/ec4b873d446c/main.js?

8 KB
4 KB

145ms
96ms

Script
application/javascript

172.67.166.207
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app-sengrid.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/ec4b873d446c/main.js?

Protocol

Server

172.67.166.207 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9c4237ee1a3f48c9845f5d1c594dbdf828152ff0724211a19aadec739d452317

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eK6xzs65bs8ht2Ww8R3BmQVEH1tJTY2Jk1HeXw9I5gss74RlJc83Rqeqx84QA1oV2N9tsEYrS3kyIkrCe0z7xrOYhd6t50pB6dPA1Z2yMACwtPbBBLjFXYoW893hsXe%2FiQ0%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
cf-ray: 8c7bad371a74ab54-YYZ
date: Mon, 23 Sep 2024 15:48:01 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare

Redirect headers

cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
location: /cdn-cgi/challenge-platform/h/g/scripts/jsd/ec4b873d446c/main.js?
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xZOO8p41EilOTO2fm%2FAY2xCn8fdyr1%2FrLYgM9W0zMgP6FIxIkb61N8SHYAWA8QiYws%2FVGMabypS0MAH4WmdKrv1hj54u7m2tHMAMqrymyz0ffAV2AsxKNAGmibsxyjQJFaA%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8c7bad33ef80ab54-YYZ
access-control-allow-origin: *
content-length: 0
date: Mon, 23 Sep 2024 15:48:01 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 favicon.ico
app-sengrid.com/assets/ 33 KB
1 KB 194ms
81ms Other
image/vnd.microsoft.icon 172.67.166.207
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://app-sengrid.com/assets/favicon.ico
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.166.207 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b3ee04c486f15b29f2f4a67dac5d8b00ede1a8d4d868dcf2c8bf6ebaade8e821

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://app-sengrid.com/login

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 5529
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZJTJjXc%2BpbHSpGblnAd401V4gs2aKYB71dxLeCKSxs2v%2BPBltw8La4rS4wnvY%2B6t2uVhWiW9kuLFUoePijauvGvTuNENyPe6Qm9%2BhtUJMKcfpdrnQ%2Fn53nJsn5XOpmh%2FLSY%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8c7bad36ba28ab54-YYZ
date: Mon, 23 Sep 2024 15:48:01 GMT
content-type: image/vnd.microsoft.icon
last-modified: Mon, 23 Sep 2024 14:15:52 GMT
vary: Accept-Encoding
server: cloudflare

POST
H3 200 8c7bad2b7e2cab54 Show response
app-sengrid.com/cdn-cgi/challenge-platform/h/g/jsd/r/ Frame 0CBC 0
906 B 279ms
213ms XHR
text/plain 172.67.166.207
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://app-sengrid.com/cdn-cgi/challenge-platform/h/g/jsd/r/8c7bad2b7e2cab54
Requested by: Host: app-sengrid.com
URL: https://app-sengrid.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.166.207 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/json
Referer

Response headers

cf-ray: 8c7bad3c0f77ab54-YYZ
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-length: 0
date: Mon, 23 Sep 2024 15:48:02 GMT
content-type: text/plain; charset=UTF-8
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bcaFytW3X9N85Qnp4kJ6hCg%2FCkAilXTh01GqLimBeTu%2BgjN7v5aUg%2BksPcxNMWq5KvFkaVJCcEjW3kA0DRIVRbapoIYv%2FvQe5k3FrIpooi%2Fsc98cKcVwzg35M3Sk%2FxTHook%3D"}],"group":"cf-nel","max_age":604800}

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Sendgrid (Online)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| htmx

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.tinyurl.com/	1970-01-20 23:45:08	Name: __cf_bm Value: RM5RmpyYKP9aM15j4vjvEISXHvCOTt6NKD6JQTciaMU-1727106477-1.0.1.1-CtuKl.95t6QXRa65pwMAcqJVf7JB3zDiUZQ73ZN5LkTvg.MsUqjExOngN1lKwainpneKlpPEJaWZMyqmcJQFOw
app-sengrid.com/	1970-01-20 23:55:11	Name: session Value: MTcyNzEwNjQ3OXxEWDhFQVFMX2dBQUJFQUVRQUFCQV80QUFBUVp6ZEhKcGJtY01CQUFDYVdRR2MzUnlhVzVuRENZQUpHUmhabUl4WmpKbExUazBabUV0TkRNek9TMDVPREkwTFRnMU4yWmxPRFk0T1dJd09RPT18KQ3A46l03QTwUXA3APOkWWb1p70ziiF1YrTYO3gQIy0=
.app-sengrid.com/	1970-01-21 08:30:42	Name: cf_clearance Value: lc7mmv88PyNSEF4_fdkA55nwSglKFMYw2yvmNE2Y_XI-1727106482-1.2.1.1-ImrphpW6Xdg4YCUf5FgP5cSD_Jv.ZFWJW2AHCOlzLMoyzBLYbD8Q7J5KWL9VWIczNF2LQEOkrCpY0YZ5JLmTWrhcIOwzXQKHrAhHuC.HpsMHzah0rzMIGTeo6MjulMGgRWAspayF4Fi8rc4QGz7r0p829yDblWKmuwNuyDvtVP293FT4wlZ8uXurRoEsA5.es4aH.iZLhNLadpr6LlVusCCAGTFrwJHJyYaFUTXcuRpfSftjQPyQyepYNWyyH3yjej1.os3.LsYVCVikcC6AMrVaODSRkH_Xp3S72WUc0Oyhr5X8ae.hSerGiECmXxcON.WU4sgAdrSui5ZmX5wQsAHDWSzCOT15TtgDd.RhSGy1RFy58wNxpsEQHAbHnfqX

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://app-sengrid.com/login Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

app-sengrid.com
cdn.prod.website-files.com
gateway-sendgrid.com
tinyurl.com
u32500224.ct.sendgrid.net
unpkg.com
104.17.112.233
104.18.161.117
167.89.115.58
172.67.157.230
172.67.166.207
2606:4700::6811:f6cb
11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d
29d0825d48648637c1ef4b44f2c49beb52244a32363c209c492aeca04ec634e3
449317ade7881e949510db614991e195c3a099c4c791c24dacec55f9f4a2a452
7003b8de8942e8b21f823d40dd277587711902317e603044e01cf70b9e4a788e
9c4237ee1a3f48c9845f5d1c594dbdf828152ff0724211a19aadec739d452317
b3ee04c486f15b29f2f4a67dac5d8b00ede1a8d4d868dcf2c8bf6ebaade8e821
d59ffdf024460962a63c162271cf50836ad1eb02f1422d4e6d7a9ea3431e1d0a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fa5b049d3a337233123b839272aa1d7788a599213234bb4f0a170c5ecdd9a7f4

app-sengrid.com Open in urlscan Pro 172.67.166.207 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

9 Requests

78 %HTTPS

17 %IPv6

6 Domains

6 Subdomains

3 IPs

2 Countries

85 kBTransfer

163 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

3 Cookies

1 Console Messages

Indicators

app-sengrid.com Open in urlscan Pro
172.67.166.207 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

78 %
HTTPS

17 %
IPv6

6
Domains

6
Subdomains

3
IPs

2
Countries

85 kB
Transfer

163 kB
Size

3
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!