urlscan.io logo urlscan.io
SecurityTrails logo

mailchrimp.com Open in urlscan Pro
45.153.35.20  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://mailchrimp.com/
Submission: On July 26 via manual from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 2 countries across 3 domains to perform 12 HTTP transactions. The main IP is 45.153.35.20, located in Germany and belongs to SKYLINK, NL. The main domain is mailchrimp.com.
This is the only time mailchrimp.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Mailchimp (Online)

Domain & IP information

IP Address AS Autonomous System
1 45.153.35.20 44592 (SKYLINK)
3 96.16.147.118 16625 (AKAMAI-AS)
1 2a00:1450:400... 15169 (GOOGLE)
1 143.204.96.118 16509 (AMAZON-02)
12 5
Apex Domain
Subdomains		 Transfer
4 mailchimp.com
login.mailchimp.com — Cisco Umbrella Rank: 60334
cdn-images.mailchimp.com — Cisco Umbrella Rank: 4763
1 MB
1 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 303
29 KB
1 mailchrimp.com
mailchrimp.com
2 KB
12 3
Domain Requested by
3 login.mailchimp.com mailchrimp.com
login.mailchimp.com
1 cdn-images.mailchimp.com mailchrimp.com
1 ajax.googleapis.com mailchrimp.com
1 mailchrimp.com
12 4

This site contains links to these domains. Also see Links.

Domain
mailchimp.com
login.mailchimp.com
www.intuit.com
Subject Issuer Validity Valid
*.mailchimp.com
GeoTrust RSA CA 2018		 2022-05-21 -
2023-05-24		 a year crt.sh
upload.video.google.com
GTS CA 1C3		 2022-07-04 -
2022-09-26		 3 months crt.sh
cdn-images.mailchimp.com
Amazon		 2022-07-06 -
2023-08-03		 a year crt.sh

This page contains 1 frames:

Primary Page: http://mailchrimp.com/
Frame ID: 58C2EB0B362465FA1FB41CD25AD72311
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Login | Mailchimp

Detected technologies

Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

42 %
HTTPS

25 %
IPv6

3
Domains

4
Subdomains

5
IPs

2
Countries

1126 kB
Transfer

1603 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
mailchrimp.com/ 		5 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://mailchrimp.com/
Protocol
HTTP/1.1
Server
45.153.35.20 , Germany, ASN44592 (SKYLINK, NL),
Reverse DNS
Software
LiteSpeed /
Resource Hash
d838eff2b7400a2a61884d006d564dd06eb205622d9ea4531f2a0ac5018fcec4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
connection
Keep-Alive
content-encoding
gzip
content-length
2125
content-type
text/html
date
Tue, 26 Jul 2022 17:35:59 GMT
etag
"159c-62cdf769-144096d;gz"
last-modified
Tue, 12 Jul 2022 22:36:25 GMT
server
LiteSpeed
vary
Accept-Encoding
typefaces.css
login.mailchimp.com/release/1.1.142e38af056e934022b8eed5641f142cfe7b32830/css/less/ 		1 KB
788 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://login.mailchimp.com/release/1.1.142e38af056e934022b8eed5641f142cfe7b32830/css/less/typefaces.css
Requested by
Host: mailchrimp.com
URL: http://mailchrimp.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
96.16.147.118 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a96-16-147-118.deploy.static.akamaitechnologies.com
Software
UploadServer /
Resource Hash
2147ab77ec8a560a9888326b39099e7dfb29e50ee2d47bbaae2c1ef4a9f52fe0

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://mailchrimp.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Tue, 26 Jul 2022 17:35:59 GMT
content-encoding
gzip
x-guploader-uploadid
ADPycdvOPZBDvcWPpr9zYN40_8X7J8IxNjY0EvBfDEfd7C_effIOL7ePll8OEWSM7L7thgLKeetjycVVjlzpqtKHOj9r
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
301
last-modified
Mon, 11 Jul 2022 22:46:40 GMT
server
UploadServer
etag
"11eb8981f5b443a62ddd72529875c2c5"
vary
Accept-Encoding
x-goog-hash
crc32c=YRF2dw==, md5=EeuJgfW0Q6Yt3XJSmHXCxQ==
x-goog-generation
1657579600179950
cache-control
public, max-age=3600
x-goog-stored-content-length
1451
accept-ranges
bytes
content-type
text/css
expires
Mon, 11 Jul 2022 23:49:28 GMT
application.css
login.mailchimp.com/release/1.1.142e38af056e934022b8eed5641f142cfe7b32830/css/less/ 		512 KB
91 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://login.mailchimp.com/release/1.1.142e38af056e934022b8eed5641f142cfe7b32830/css/less/application.css
Requested by
Host: mailchrimp.com
URL: http://mailchrimp.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
96.16.147.118 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a96-16-147-118.deploy.static.akamaitechnologies.com
Software
UploadServer /
Resource Hash
0169154333992ae56f1a0f414780adc98f46eb7edd12586c2f257d191aa165ba

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://mailchrimp.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Tue, 26 Jul 2022 17:35:59 GMT
content-encoding
gzip
x-guploader-uploadid
ADPycdt3wum12YvxDQ96zJG5I98btl2e52oxDdQek03S8DZbMp5IDHsJwc5eeHDeln7zSbYRkQCPFF2B8CHnEU1lQfwP
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
92314
last-modified
Mon, 11 Jul 2022 22:46:40 GMT
server
UploadServer
etag
"84480ab95de0971fc06583bfc7a8bfda"
vary
Accept-Encoding
x-goog-hash
crc32c=gSv4Jw==, md5=hEgKuV3glx/AZYO/x6i/2g==
x-goog-generation
1657579600101491
cache-control
public, max-age=3600
x-goog-stored-content-length
524401
accept-ranges
bytes
content-type
text/css
expires
Mon, 11 Jul 2022 23:49:28 GMT
mc-freddie-dark.svg
login.mailchimp.com/release/1.1.142e38af056e934022b8eed5641f142cfe7b32830/images/brand_assets/logos/ 		3 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://login.mailchimp.com/release/1.1.142e38af056e934022b8eed5641f142cfe7b32830/images/brand_assets/logos/mc-freddie-dark.svg
Requested by
Host: mailchrimp.com
URL: http://mailchrimp.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
96.16.147.118 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a96-16-147-118.deploy.static.akamaitechnologies.com
Software
UploadServer /
Resource Hash
2cdec7dee74593d9ff03e2d7f60fc182e81dae616e09ef3b247d8af61d51301d

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://mailchrimp.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Tue, 26 Jul 2022 17:35:59 GMT
content-encoding
gzip
x-guploader-uploadid
ADPycds63TLn3pMyuJjA9GNkhXEha_Fl5XaEA_QqFbHvkIHPSNIwOYDCinKush5EaDE1EPPx3uZNiS2ArfJHfrqzhWu_
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
1568
last-modified
Mon, 11 Jul 2022 22:47:17 GMT
server
UploadServer
etag
"241b3f86a18d07f459eefef03792ca7a"
vary
Accept-Encoding
x-goog-hash
crc32c=gRkmSQ==, md5=JBs/hqGNB/RZ7v7wN5LKeg==
x-goog-generation
1657579637891589
cache-control
public, max-age=3600
x-goog-stored-content-length
3200
accept-ranges
bytes
content-type
image/svg+xml
expires
Mon, 11 Jul 2022 23:49:28 GMT
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.0.1/ 		82 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/2.0.1/jquery.min.js
Requested by
Host: mailchrimp.com
URL: http://mailchrimp.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4e1354fc542b617c58cbba3aeb5116a528cf08bb1299f5dc7f3bc77a3b902b68
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://mailchrimp.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Mon, 25 Jul 2022 17:46:33 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
85766
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
29443
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 19:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 25 Jul 2023 17:46:33 GMT
phpza0iJx.jpeg
cdn-images.mailchimp.com/billboards/ 		1000 KB
1000 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn-images.mailchimp.com/billboards/phpza0iJx.jpeg
Requested by
Host: mailchrimp.com
URL: http://mailchrimp.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
143.204.96.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-96-118.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
abf6f63522df5aad0b53ca6937a671060f58ccafacae80b1e2d8fab6ad936fc8

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://mailchrimp.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Tue, 26 Jul 2022 04:13:03 GMT
Via
1.1 fa5a3d5abd34c6fac657b045a4dcbdc4.cloudfront.net (CloudFront)
Last-Modified
Mon, 21 Mar 2022 16:44:10 GMT
Server
AmazonS3
Age
48178
ETag
"243c5b6f3e0192dcfa1b0310d2db2c6e"
X-Cache
Hit from cloudfront
x-amz-version-id
pNuJcGI_c9E9O7BmVd67qF5vzl6wK61K
Connection
keep-alive
X-Amz-Cf-Pop
FRA50-C1
Accept-Ranges
bytes
Content-Type
image/jpeg
Content-Length
1023843
X-Amz-Cf-Id
brzbtWvr3wed7QXmR1msIggMdYGRQcobk1La8BVKfOjsq9ICIRPE4Q==
Means-Light-Web.woff2
login.mailchimp.com/release/1.1.142e38af056e934022b8eed5641f142cfe7b32830/css/fonts/means/ 		0
0
Graphik-Regular-Web.woff2
login.mailchimp.com/release/1.1.142e38af056e934022b8eed5641f142cfe7b32830/css/fonts/graphik/ 		0
0
Graphik-Medium-Web.woff2
login.mailchimp.com/release/1.1.142e38af056e934022b8eed5641f142cfe7b32830/css/fonts/graphik/ 		0
0
Means-Light-Web.woff
login.mailchimp.com/release/1.1.142e38af056e934022b8eed5641f142cfe7b32830/css/fonts/means/ 		0
0
Graphik-Medium-Web.woff
login.mailchimp.com/release/1.1.142e38af056e934022b8eed5641f142cfe7b32830/css/fonts/graphik/ 		0
0
Graphik-Regular-Web.woff
login.mailchimp.com/release/1.1.142e38af056e934022b8eed5641f142cfe7b32830/css/fonts/graphik/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
login.mailchimp.com
URL
https://login.mailchimp.com/release/1.1.142e38af056e934022b8eed5641f142cfe7b32830/css/fonts/means/Means-Light-Web.woff2
Domain
login.mailchimp.com
URL
https://login.mailchimp.com/release/1.1.142e38af056e934022b8eed5641f142cfe7b32830/css/fonts/graphik/Graphik-Regular-Web.woff2
Domain
login.mailchimp.com
URL
https://login.mailchimp.com/release/1.1.142e38af056e934022b8eed5641f142cfe7b32830/css/fonts/graphik/Graphik-Medium-Web.woff2
Domain
login.mailchimp.com
URL
https://login.mailchimp.com/release/1.1.142e38af056e934022b8eed5641f142cfe7b32830/css/fonts/means/Means-Light-Web.woff
Domain
login.mailchimp.com
URL
https://login.mailchimp.com/release/1.1.142e38af056e934022b8eed5641f142cfe7b32830/css/fonts/graphik/Graphik-Medium-Web.woff
Domain
login.mailchimp.com
URL
https://login.mailchimp.com/release/1.1.142e38af056e934022b8eed5641f142cfe7b32830/css/fonts/graphik/Graphik-Regular-Web.woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Mailchimp (Online)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch object| navigation function| $ function| jQuery

0 Cookies

12 Console Messages

Source Level URL
Text
javascript error URL: http://mailchrimp.com/
Message:
Access to font at 'https://login.mailchimp.com/release/1.1.142e38af056e934022b8eed5641f142cfe7b32830/css/fonts/means/Means-Light-Web.woff2' from origin 'http://mailchrimp.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://login.mailchimp.com/release/1.1.142e38af056e934022b8eed5641f142cfe7b32830/css/fonts/means/Means-Light-Web.woff2
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: http://mailchrimp.com/
Message:
Access to font at 'https://login.mailchimp.com/release/1.1.142e38af056e934022b8eed5641f142cfe7b32830/css/fonts/graphik/Graphik-Medium-Web.woff2' from origin 'http://mailchrimp.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://login.mailchimp.com/release/1.1.142e38af056e934022b8eed5641f142cfe7b32830/css/fonts/graphik/Graphik-Medium-Web.woff2
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: http://mailchrimp.com/
Message:
Access to font at 'https://login.mailchimp.com/release/1.1.142e38af056e934022b8eed5641f142cfe7b32830/css/fonts/graphik/Graphik-Regular-Web.woff2' from origin 'http://mailchrimp.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://login.mailchimp.com/release/1.1.142e38af056e934022b8eed5641f142cfe7b32830/css/fonts/graphik/Graphik-Regular-Web.woff2
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: http://mailchrimp.com/
Message:
Access to font at 'https://login.mailchimp.com/release/1.1.142e38af056e934022b8eed5641f142cfe7b32830/css/fonts/means/Means-Light-Web.woff' from origin 'http://mailchrimp.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://login.mailchimp.com/release/1.1.142e38af056e934022b8eed5641f142cfe7b32830/css/fonts/means/Means-Light-Web.woff
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: http://mailchrimp.com/
Message:
Access to font at 'https://login.mailchimp.com/release/1.1.142e38af056e934022b8eed5641f142cfe7b32830/css/fonts/graphik/Graphik-Medium-Web.woff' from origin 'http://mailchrimp.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://login.mailchimp.com/release/1.1.142e38af056e934022b8eed5641f142cfe7b32830/css/fonts/graphik/Graphik-Medium-Web.woff
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: http://mailchrimp.com/
Message:
Access to font at 'https://login.mailchimp.com/release/1.1.142e38af056e934022b8eed5641f142cfe7b32830/css/fonts/graphik/Graphik-Regular-Web.woff' from origin 'http://mailchrimp.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://login.mailchimp.com/release/1.1.142e38af056e934022b8eed5641f142cfe7b32830/css/fonts/graphik/Graphik-Regular-Web.woff
Message:
Failed to load resource: net::ERR_FAILED