app.sendgrid.com.login.5449.feuerwehr-rannenberg.de
Open in
urlscan Pro
199.127.61.19
Malicious Activity!
Public Scan
Effective URL: http://app.sendgrid.com.login.5449.feuerwehr-rannenberg.de/en/5/30a93291043a406bd52ca3f7900d4d3c/b88c981effbb8e0d7766df42b8f5f92a/3553b64fe37c61bf04ad709ee...
Submission: On May 21 via api from BE
Summary
This is the only time app.sendgrid.com.login.5449.feuerwehr-rannenberg.de was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Sendgrid (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 18 | 199.127.61.19 199.127.61.19 | 23470 (RELIABLESITE) (RELIABLESITE) | |
1 | 2600:9000:204... 2600:9000:2047:8c00:19:a248:21c0:21 | 16509 (AMAZON-02) (AMAZON-02) | |
1 1 | 151.139.236.32 151.139.236.32 | 33438 (HIGHWINDS2) (HIGHWINDS2) | |
1 | 2a00:d01:ff:9... 2a00:d01:ff:905:94:228:142:45 | 41887 (PROLOCATI...) (PROLOCATION Transit policy pref 100) | |
1 | 104.111.237.220 104.111.237.220 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
2 | 2a04:4e42:3::621 2a04:4e42:3::621 | 54113 (FASTLY) (FASTLY) | |
1 | 52.216.98.11 52.216.98.11 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 34.96.67.224 34.96.67.224 | 15169 (GOOGLE) (GOOGLE) | |
1 | 23.45.99.37 23.45.99.37 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
2 | 34.200.62.85 34.200.62.85 | 14618 (AMAZON-AES) (AMAZON-AES) | |
27 | 9 |
ASN23470 (RELIABLESITE, US)
app.sendgrid.com.login.5448.feuerwehr-rannenberg.de | |
app.sendgrid.com.login.5449.feuerwehr-rannenberg.de |
ASN16509 (AMAZON-02, US)
d1tjxxwiv1dd3b.cloudfront.net |
ASN41887 (PROLOCATION Transit policy pref 100, NL)
www.ehawk.net |
ASN16625 (AKAMAI-AS, US)
PTR: a104-111-237-220.deploy.static.akamaitechnologies.com
static.zuora.com |
ASN16509 (AMAZON-02, US)
PTR: s3-1-w.amazonaws.com
uiux.s3.amazonaws.com |
ASN15169 (GOOGLE, US)
PTR: 224.67.96.34.bc.googleusercontent.com
cdn.siftscience.com |
ASN20940 (AKAMAI-ASN1, EU)
PTR: a23-45-99-37.deploy.static.akamaitechnologies.com
a72168671.cdn.optimizely.com |
ASN14618 (AMAZON-AES, US)
PTR: ec2-34-200-62-85.compute-1.amazonaws.com
logx.optimizely.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
18 |
feuerwehr-rannenberg.de
1 redirects
app.sendgrid.com.login.5448.feuerwehr-rannenberg.de app.sendgrid.com.login.5449.feuerwehr-rannenberg.de |
983 KB |
3 |
optimizely.com
a72168671.cdn.optimizely.com logx.optimizely.com |
790 B |
2 |
polyfill.io
cdn.polyfill.io |
866 B |
1 |
siftscience.com
cdn.siftscience.com |
20 KB |
1 |
amazonaws.com
uiux.s3.amazonaws.com |
4 KB |
1 |
zuora.com
static.zuora.com |
6 KB |
1 |
ehawk.net
www.ehawk.net |
14 KB |
1 |
netdna-ssl.com
1 redirects
talon-ehawk.netdna-ssl.com |
157 B |
1 |
cloudfront.net
d1tjxxwiv1dd3b.cloudfront.net |
4 KB |
27 | 9 |
Domain | Requested by | |
---|---|---|
17 | app.sendgrid.com.login.5449.feuerwehr-rannenberg.de |
app.sendgrid.com.login.5449.feuerwehr-rannenberg.de
|
2 | logx.optimizely.com |
app.sendgrid.com.login.5449.feuerwehr-rannenberg.de
|
2 | cdn.polyfill.io |
app.sendgrid.com.login.5449.feuerwehr-rannenberg.de
|
1 | a72168671.cdn.optimizely.com |
app.sendgrid.com.login.5449.feuerwehr-rannenberg.de
|
1 | cdn.siftscience.com |
app.sendgrid.com.login.5449.feuerwehr-rannenberg.de
|
1 | uiux.s3.amazonaws.com |
app.sendgrid.com.login.5449.feuerwehr-rannenberg.de
|
1 | static.zuora.com |
app.sendgrid.com.login.5449.feuerwehr-rannenberg.de
|
1 | www.ehawk.net |
app.sendgrid.com.login.5449.feuerwehr-rannenberg.de
|
1 | talon-ehawk.netdna-ssl.com | 1 redirects |
1 | d1tjxxwiv1dd3b.cloudfront.net |
app.sendgrid.com.login.5449.feuerwehr-rannenberg.de
|
1 | app.sendgrid.com.login.5448.feuerwehr-rannenberg.de | 1 redirects |
27 | 11 |
This site contains links to these domains. Also see Links.
Domain |
---|
sendgrid.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.cloudfront.net DigiCert Global CA G2 |
2019-07-17 - 2020-07-05 |
a year | crt.sh |
*.ehawk.net Sectigo RSA Domain Validation Secure Server CA |
2020-01-13 - 2021-01-13 |
a year | crt.sh |
www.zuora.com COMODO RSA Domain Validation Secure Server CA |
2018-10-12 - 2021-01-13 |
2 years | crt.sh |
f3.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3 |
2020-04-16 - 2021-04-17 |
a year | crt.sh |
*.s3.amazonaws.com DigiCert Baltimore CA-2 G2 |
2019-11-09 - 2021-03-12 |
a year | crt.sh |
*.siftscience.com DigiCert SHA2 Secure Server CA |
2019-01-03 - 2021-03-26 |
2 years | crt.sh |
*.cdn.optimizely.com GeoTrust RSA CA 2018 |
2020-03-05 - 2021-06-04 |
a year | crt.sh |
logx.optimizely.com DigiCert SHA2 High Assurance Server CA |
2018-10-01 - 2020-10-05 |
2 years | crt.sh |
This page contains 2 frames:
Primary Page:
http://app.sendgrid.com.login.5449.feuerwehr-rannenberg.de/en/5/30a93291043a406bd52ca3f7900d4d3c/b88c981effbb8e0d7766df42b8f5f92a/3553b64fe37c61bf04ad709ee9e5b1c2
Frame ID: BCF144CD0B5FA154F9961A6EE0CACEA9
Requests: 26 HTTP requests in this frame
Frame:
https://a72168671.cdn.optimizely.com/client_storage/a72168671.html
Frame ID: 7C4D8DD9FC42C7B7C7A032C746934637
Requests: 1 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://app.sendgrid.com.login.5448.feuerwehr-rannenberg.de/c4ca4238a0b923820dcc509a6f75849b/50bc5c0ca8042d44575811f105a53e8c/30a9329104...
HTTP 302
http://app.sendgrid.com.login.5449.feuerwehr-rannenberg.de/en/5/30a93291043a406bd52ca3f7900d4d3c/b88c981effbb8e0d7766df42b8f5f92a/3553b... Page URL
Detected technologies
CentOS (Operating Systems) ExpandDetected patterns
- headers server /CentOS/i
Apache (Web Servers) Expand
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Sign up now!
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://app.sendgrid.com.login.5448.feuerwehr-rannenberg.de/c4ca4238a0b923820dcc509a6f75849b/50bc5c0ca8042d44575811f105a53e8c/30a93291043a406bd52ca3f7900d4d3c/ffc5e01f578535fd6f95f889cb31939d
HTTP 302
http://app.sendgrid.com.login.5449.feuerwehr-rannenberg.de/en/5/30a93291043a406bd52ca3f7900d4d3c/b88c981effbb8e0d7766df42b8f5f92a/3553b64fe37c61bf04ad709ee9e5b1c2 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 6- https://talon-ehawk.netdna-ssl.com/EHawkTalon.js HTTP 301
- https://www.ehawk.net/talon-cdn/EHawkTalon.js
27 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
3553b64fe37c61bf04ad709ee9e5b1c2
app.sendgrid.com.login.5449.feuerwehr-rannenberg.de/en/5/30a93291043a406bd52ca3f7900d4d3c/b88c981effbb8e0d7766df42b8f5f92a/ Redirect Chain
|
50 KB 50 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tiara.css
d1tjxxwiv1dd3b.cloudfront.net/ |
23 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
72168671.js
app.sendgrid.com.login.5449.feuerwehr-rannenberg.de/SendGrid/com/src/ |
371 KB 372 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
api_config.js
app.sendgrid.com.login.5449.feuerwehr-rannenberg.de/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
108.e0ff89b5ed61aa692324.css
app.sendgrid.com.login.5449.feuerwehr-rannenberg.de/SendGrid/com/src/ |
157 KB 157 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
12.a3c87866979216143f24.css
app.sendgrid.com.login.5449.feuerwehr-rannenberg.de/SendGrid/com/src/ |
388 KB 389 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
container.css
app.sendgrid.com.login.5449.feuerwehr-rannenberg.de/SendGrid/com/src/ |
15 KB 15 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
EHawkTalon.js
www.ehawk.net/talon-cdn/ Redirect Chain
|
43 KB 14 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ckeditor.js
app.sendgrid.com.login.5449.feuerwehr-rannenberg.de/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
zuora-min.js
static.zuora.com/Resources/libs/hosted/1.3.0/ |
16 KB 6 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
polyfill.min.js
cdn.polyfill.io/v2/ |
222 B 638 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sg-twilio-lockup.svg
uiux.s3.amazonaws.com/logo/ |
4 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
runtime.90bee01e22454a5f6de0.js
app.sendgrid.com.login.5449.feuerwehr-rannenberg.de/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
vendors~main.8dbed9e02b0fb25fdd9a.js
app.sendgrid.com.login.5449.feuerwehr-rannenberg.de/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.3fc4efc9e81871874e68.js
app.sendgrid.com.login.5449.feuerwehr-rannenberg.de/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
s.js
cdn.siftscience.com/ |
61 KB 20 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
api_config.js
app.sendgrid.com.login.5449.feuerwehr-rannenberg.de/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ckeditor.js
app.sendgrid.com.login.5449.feuerwehr-rannenberg.de/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
a72168671.html
a72168671.cdn.optimizely.com/client_storage/ Frame 7C4D |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
colfax-regular.05f3d250.woff2
app.sendgrid.com.login.5449.feuerwehr-rannenberg.de/dist/static/media/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
polyfill.min.js
cdn.polyfill.io/v2/ |
222 B 228 B |
Other
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
runtime.90bee01e22454a5f6de0.js
app.sendgrid.com.login.5449.feuerwehr-rannenberg.de/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
colfax-regular.95413010.woff
app.sendgrid.com.login.5449.feuerwehr-rannenberg.de/dist/static/media/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
vendors~main.8dbed9e02b0fb25fdd9a.js
app.sendgrid.com.login.5449.feuerwehr-rannenberg.de/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.3fc4efc9e81871874e68.js
app.sendgrid.com.login.5449.feuerwehr-rannenberg.de/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
events
logx.optimizely.com/v1/ |
0 395 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
events
logx.optimizely.com/v1/ |
0 395 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Sendgrid (Online)33 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate object| trackedEvents function| track undefined| _ object| optimizely object| dataLayer object| referrer string| hostname object| theBody function| initNewRelic function| initGTM string| publicPath string| route boolean| inBlackList object| urlBlacklist boolean| OnlyBlacklist boolean| blackListInit function| eHawkTalon function| EHTalon function| Fingerprint object| script string| __z_version string| ifrmId boolean| threedRedirected object| ZLOG object| ZXD object| Z object| ZFB object| _sift function| __siftFlashCB undefined| Sift object| PluginDetect1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.feuerwehr-rannenberg.de/ | Name: optimizelyEndUserId Value: oeu1590051542898r0.7103945152008531 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
a72168671.cdn.optimizely.com
app.sendgrid.com.login.5448.feuerwehr-rannenberg.de
app.sendgrid.com.login.5449.feuerwehr-rannenberg.de
cdn.polyfill.io
cdn.siftscience.com
d1tjxxwiv1dd3b.cloudfront.net
logx.optimizely.com
static.zuora.com
talon-ehawk.netdna-ssl.com
uiux.s3.amazonaws.com
www.ehawk.net
104.111.237.220
151.139.236.32
199.127.61.19
23.45.99.37
2600:9000:2047:8c00:19:a248:21c0:21
2a00:d01:ff:905:94:228:142:45
2a04:4e42:3::621
34.200.62.85
34.96.67.224
52.216.98.11
1a2a572f006b242096d76275e8c9edb114f9aa65cbd67fd1c4d57053da83932f
29eb73b66f7f12c0e8cb17b131dffa962bf9d992d24406a6ced52315c33a1f3a
67ebd998fb16c0f51f2725b55ada5d28982e4943f5b50c3c141b78b96317fdfc
7921df86278b7fa9be0cbd78d9990071763ec4e9e88aaff2c3d466723090b8ae
929e88471afd8a6882e29779d1f4175111d92b6180baa86265db6bb90c9f18cd
9c039230a469d0d57cfc3866662782543561dae3ce6cb54ea02a9df6d4d6a67e
ad513eaf2eb2f74e2d6e618c02037e7e842952dd55cbb870ba3d3b060a712f9a
b29a07e2825e8ec2610a36eea52d9c1657f4e5101d9ef4a6082b93eb7277e871
cae897bdde94867960ad284a56b1631296eaceddf5710a2857127ca0aa2777d3
ce6c8a655514b0de3173c43f4175e9f37ca8e59956ee1a1e3e0218aee2735671
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f7dff0321d998ec9f035b23e16c81bf72f44af5c6c06167ebd5374a426fae1ed