app.getguru.com
Open in
urlscan Pro
143.204.244.88
Malicious Activity!
Public Scan
Submission: On September 08 via manual from IN — Scanned from DE
Summary
TLS certificate: Issued by Amazon on January 14th 2021. Valid for: a year.
This is the only time app.getguru.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Sharepoint (Online)Live information
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
5 | 143.204.244.88 143.204.244.88 | 16509 (AMAZON-02) (AMAZON-02) | |
3 | 104.16.19.94 104.16.19.94 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 143.204.244.8 143.204.244.8 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 104.17.211.204 104.17.211.204 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 104.17.230.204 104.17.230.204 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 104.18.21.191 104.18.21.191 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 104.17.70.176 104.17.70.176 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 35.164.97.62 35.164.97.62 | 16509 (AMAZON-02) (AMAZON-02) | |
2 | 104.19.154.83 104.19.154.83 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 172.217.169.72 172.217.169.72 | 15169 (GOOGLE) (GOOGLE) | |
1 | 143.204.244.122 143.204.244.122 | 16509 (AMAZON-02) (AMAZON-02) | |
2 | 104.16.123.175 104.16.123.175 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 142.250.178.19 142.250.178.19 | 15169 (GOOGLE) (GOOGLE) | |
1 | 52.12.223.187 52.12.223.187 | 16509 (AMAZON-02) (AMAZON-02) | |
24 | 15 |
ASN16509 (AMAZON-02, US)
PTR: server-143-204-244-88.cph50.r.cloudfront.net
app.getguru.com |
ASN16509 (AMAZON-02, US)
PTR: server-143-204-244-8.cph50.r.cloudfront.net
content.api.getguru.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-35-164-97-62.us-west-2.compute.amazonaws.com
api.getguru.com |
ASN15169 (GOOGLE, US)
PTR: lhr48s09-in-f8.1e100.net
www.googletagmanager.com |
ASN16509 (AMAZON-02, US)
PTR: server-143-204-244-122.cph50.r.cloudfront.net
cdn.pendo.io |
ASN16509 (AMAZON-02, US)
PTR: ec2-52-12-223-187.us-west-2.compute.amazonaws.com
tracking.getguru.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
getguru.com
app.getguru.com content.api.getguru.com api.getguru.com tracking.getguru.com |
203 KB |
3 |
pendo.io
cdn.pendo.io data.pendo.io |
133 KB |
3 |
cloudflare.com
cdnjs.cloudflare.com |
6 KB |
2 |
unpkg.com
unpkg.com |
14 KB |
2 |
hubspot.com
track.hubspot.com forms.hubspot.com |
2 KB |
1 |
googletagmanager.com
www.googletagmanager.com |
53 KB |
1 |
hs-analytics.net
js.hs-analytics.net |
20 KB |
1 |
hs-banner.com
js.hs-banner.com |
16 KB |
1 |
hsleadflows.net
js.hsleadflows.net |
87 KB |
1 |
hs-scripts.com
js.hs-scripts.com |
948 B |
24 | 10 |
Domain | Requested by | |
---|---|---|
5 | app.getguru.com |
app.getguru.com
|
3 | cdnjs.cloudflare.com |
app.getguru.com
|
2 | data.pendo.io |
cdn.pendo.io
|
2 | unpkg.com |
www.googletagmanager.com
|
2 | api.getguru.com |
app.getguru.com
|
1 | tracking.getguru.com |
app.getguru.com
|
1 | cdn.pendo.io |
app.getguru.com
|
1 | www.googletagmanager.com |
app.getguru.com
|
1 | forms.hubspot.com |
js.hsleadflows.net
|
1 | track.hubspot.com | |
1 | js.hs-analytics.net |
js.hs-scripts.com
|
1 | js.hs-banner.com |
js.hs-scripts.com
|
1 | js.hsleadflows.net |
js.hs-scripts.com
|
1 | js.hs-scripts.com |
app.getguru.com
|
1 | content.api.getguru.com |
app.getguru.com
|
24 | 15 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.getguru.com |
t.co |
getguru.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.getguru.com Amazon |
2021-01-14 - 2022-02-12 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2020-10-21 - 2021-10-20 |
a year | crt.sh |
*.api.getguru.com Amazon |
2020-11-15 - 2021-12-14 |
a year | crt.sh |
hubspot.com Cloudflare Inc ECC CA-3 |
2021-06-26 - 2022-06-25 |
a year | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2021-08-16 - 2021-11-08 |
3 months | crt.sh |
cdn.pendo.io Amazon |
2021-08-29 - 2022-09-27 |
a year | crt.sh |
data.pendo.io GTS CA 1D4 |
2021-07-22 - 2021-10-21 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://app.getguru.com/card/ceEek8ei/SharePoint
Frame ID: 9F97B7838417B088CD65726ACECCC2D4
Requests: 26 HTTP requests in this frame
Screenshot
Page Title
SharePoint | GuruDetected technologies
Google Tag Manager (Tag Managers) ExpandDetected patterns
- googletagmanager\.com/gtm\.js
HubSpot Analytics (Analytics) Expand
Detected patterns
- js\.hs-analytics\.net/analytics
Page Statistics
3 Outgoing links
These are links going to different origins than the main page.
Title: Learn more
Search URL Search Domain Scan URL
Title: View PDF Document
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
24 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
SharePoint
app.getguru.com/card/ceEek8ei/ |
13 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
normalize.css
app.getguru.com/public-card/css/ |
6 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
proximanova.css
app.getguru.com/public-card/css/fonts/ |
243 KB 184 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
styles.css
app.getguru.com/public-card/css/ |
13 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
prism.min.css
cdnjs.cloudflare.com/ajax/libs/prism/1.17.1/themes/ |
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
c2c457e6-1e62-402a-877a-5c51ede17248
content.api.getguru.com/files/view/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
prism-core.min.js
cdnjs.cloudflare.com/ajax/libs/prism/1.17.1/components/ |
6 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
prism-autoloader.min.js
cdnjs.cloudflare.com/ajax/libs/prism/1.17.1/plugins/autoloader/ |
4 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
publicCard.js
app.getguru.com/public-card/ |
13 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
4744974.js
js.hs-scripts.com/ |
1 KB 948 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
leadflows.js
js.hsleadflows.net/ |
537 KB 87 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
4744974.js
js.hs-banner.com/ |
61 KB 16 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
4744974.js
js.hs-analytics.net/analytics/1631137800000/ |
62 KB 20 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
56adf957-a550-4809-a944-a60e6a48f3cd
api.getguru.com/public-card-view/ |
0 0 |
Preflight
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
56adf957-a550-4809-a944-a60e6a48f3cd
api.getguru.com/public-card-view/ |
3 B 572 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
__ptq.gif
track.hubspot.com/ |
45 B 788 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
json
forms.hubspot.com/lead-flows-config/v1/config/ |
167 B 1 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gtm.js
www.googletagmanager.com/ |
146 KB 53 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pendo.js
cdn.pendo.io/agent/static/0ea97ad5-529d-48a4-4665-35966b68c7a6/ |
420 KB 131 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
18 KB 18 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
23 KB 23 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
23 KB 23 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.min.js
unpkg.com/analytics@0.6.7/dist/ |
39 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
0ea97ad5-529d-48a4-4665-35966b68c7a6
data.pendo.io/data/guide.js/ |
3 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
0ea97ad5-529d-48a4-4665-35966b68c7a6
data.pendo.io/data/ptm.gif/ |
42 B 115 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cookie-utils.min.js
unpkg.com/@analytics/cookie-utils@0.2.3/dist/@analytics/ |
608 B 489 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
webtrack
tracking.getguru.com/ |
3 B 183 B |
Ping
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Sharepoint (Online)56 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect boolean| originAgentCluster object| _self object| Prism function| loadGoogleTagManager function| loadPendo function| loadLoggedOutScripts object| _hsp object| globalRoot undefined| hns function| bindToWindowOnError function| defineProperties object| leadflows object| hubspot function| OutpostErrorReporter boolean| popupPoliceActive object| _hsq undefined| hns2 undefined| jade undefined| I18n undefined| hubspot_mailcheck undefined| Pikaday undefined| reqwest undefined| exports undefined| define boolean| LEAD_FLOWS_RAN boolean| COMMON_SETUP_RAN object| _paq function| sanitizeKey boolean| _hstc_loaded boolean| _hspb_loaded boolean| _hstc_ran string| __hsUserToken number| expireDateTime boolean| _hspb_ran boolean| LEAD_FLOW_DOCUMENT_READY_RAN object| dataLayer object| pendo object| google_tag_manager object| c object| _analytics object| regeneratorRuntime object| analyticsUtilCookie string| host object| isQa string| domain string| anonCookieKey string| anonAJSKey string| userAJSKey string| userCookieKey string| trackingUrl number| yearTime function| anonIDPlugin function| awsPlugin function| sendData object| Analytics6 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.getguru.com/card/ceEek8ei | Name: ajs_anonymous_id Value: f98ae703-48a3-46e2-97b5-74d1f140b5b6 |
|
app.getguru.com/card/ceEek8ei | Name: __anon_id Value: %22f98ae703-48a3-46e2-97b5-74d1f140b5b6%22 |
|
.getguru.com/ | Name: __hstc Value: 192390133.31f6054e7eafe00c5e9233ad954325b0.1631137842972.1631137842972.1631137842972.1 |
|
.getguru.com/ | Name: hubspotutk Value: 31f6054e7eafe00c5e9233ad954325b0 |
|
.getguru.com/ | Name: __hssrc Value: 1 |
|
.getguru.com/ | Name: __hssc Value: 192390133.1.1631137842972 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=63072000; includeSubDomains; preload |
X-Content-Type-Options | nosniff |
X-Frame-Options | DENY |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
api.getguru.com
app.getguru.com
cdn.pendo.io
cdnjs.cloudflare.com
content.api.getguru.com
data.pendo.io
forms.hubspot.com
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
js.hsleadflows.net
track.hubspot.com
tracking.getguru.com
unpkg.com
www.googletagmanager.com
104.16.123.175
104.16.19.94
104.17.211.204
104.17.230.204
104.17.70.176
104.18.21.191
104.19.154.83
142.250.178.19
143.204.244.122
143.204.244.8
143.204.244.88
172.217.169.72
35.164.97.62
52.12.223.187
0c584c18f5b81646c6006dd3d1d133bfd1aff6e786c7793ccfe408293fec7e85
257c1be96ae69f4b01c2c69bdb6d78605f59175819fb007d0bf245bf48444c4a
281046051b532d60294e33791bd78179fd8de8f38ab0686b09eac1027c4c1cbd
2b524afd73477ae931ce8334b371bf69ea832b122805ecca49680d2ce3d37a1b
3859a89d2d8a366a92379602d7ca9196c163bd5e7c76f39a33a85e24719ef8e9
3e3d6c209ca04fe8e43afe930330851ad75ea7f22fd06cf30379ef9e4043577d
3fc6af6c4cea27d7dfa68728efe5dfdae2d02d6b0f6af11f722d5eea61fe9cd9
4924700f4ce32227fad7d408960038f29ceca91896d9db0df53e197d20c48fe4
63e06e766db00448d88db1f4a9c25198bb91045a5777454ac65e9785d4b88600
67d249135c01d1a0edbd9a8e01d4c701f6f7806b4c808b0915c2e632c45cb28b
803460f04b0ca35b7a04cbf8cbbf5af6923b9663728b4613147e545a4a91a95b
86df1acba6533d97ee8b1601f7d239a11a422ec0aaec3a362e31182f06def97f
918bddac2406b4ce8ae52bc4eb761a34ab4b5d280d90adf768987307b26cac64
967210999d7cbaed0cf76a1455decd2dd9eccacf4bc9efb2a11a66c350eb0bb9
ac07d49cf3f54f209bb64903854fcdca1181b9b50dd92825b7cad8ff1b627ef6
af81203081f4615272d40fac09c6e334fcdb7919765ec7cf4d560308b89b8cf6
baa8465523b5c04d33681b57955b2279eee0e1906ba47f22d7ed5acfe24c146f
c557dc339096c64f41cbfeee35c1750c69ed56ea0862b329e09bea09abc89b3e
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
cb7723d2b3fec88ad5f70163043929a20c70391b1ad31b3fac279e438fd42e2d
d5343b9a9c667a328bd11798a1d4950326c2e48189873d45b2d515c56aad2cd6
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
eae09c9bf5aaec8f44fd47a423e6b62a4326f3632dc5457bc1f171f7c2c82767
ed518261972445f0ec39ea427d6d083ed69fffbc5e601d2b8f12cc659ef1d87e
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efba865eeda9f0da5f701a538f0e23b0c7909f3d2fca1ef87f9768d1c5a343f4