kalderos-7cca5b914948.intercom-attachments-4.com
Open in
urlscan Pro
2600:9000:2047:de00:19:1477:f380:93a1
Malicious Activity!
Public Scan
Effective URL: https://kalderos-7cca5b914948.intercom-attachments-4.com/admins/sign_in
Submission: On June 24 via manual from US
Summary
TLS certificate: Issued by Amazon on June 14th 2019. Valid for: a year.
This is the only time kalderos-7cca5b914948.intercom-attachments-4.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Intercom (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 3 | 2600:9000:204... 2600:9000:2047:de00:19:1477:f380:93a1 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
4 | 52.222.157.128 52.222.157.128 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
2 | 2600:9000:204... 2600:9000:2047:ec00:10:8536:c280:93a1 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
1 2 | 2a00:1450:400... 2a00:1450:4001:81e::200e | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 1 | 2a00:1450:400... 2a00:1450:400c:c06::9b | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 1 | 2a00:1450:400... 2a00:1450:4001:808::2004 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 2a00:1450:400... 2a00:1450:4001:808::2003 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 1 | 52.222.157.94 52.222.157.94 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
3 | 52.222.157.46 52.222.157.46 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
2 | 52.222.157.89 52.222.157.89 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
14 | 7 |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
kalderos-7cca5b914948.intercom-attachments-4.com |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-52-222-157-128.fra53.r.cloudfront.net
static.intercomassets.com |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
fonts.intercomcdn.com |
ASN15169 (GOOGLE - Google LLC, US)
www.google-analytics.com |
ASN15169 (GOOGLE - Google LLC, US)
stats.g.doubleclick.net |
ASN15169 (GOOGLE - Google LLC, US)
www.google.com |
ASN15169 (GOOGLE - Google LLC, US)
www.google.de |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-52-222-157-94.fra53.r.cloudfront.net
widget.intercom.io |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-52-222-157-46.fra53.r.cloudfront.net
js.intercomcdn.com |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-52-222-157-89.fra53.r.cloudfront.net
api-iam.intercom.io |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
intercomcdn.com
fonts.intercomcdn.com js.intercomcdn.com |
373 KB |
4 |
intercomassets.com
static.intercomassets.com |
154 KB |
3 |
intercom.io
1 redirects
widget.intercom.io api-iam.intercom.io |
2 KB |
3 |
intercom-attachments-4.com
2 redirects
kalderos-7cca5b914948.intercom-attachments-4.com |
8 KB |
2 |
google-analytics.com
1 redirects
www.google-analytics.com |
17 KB |
1 |
google.de
www.google.de |
109 B |
1 |
google.com
1 redirects
www.google.com |
191 B |
1 |
doubleclick.net
1 redirects
stats.g.doubleclick.net |
159 B |
14 | 8 |
Domain | Requested by | |
---|---|---|
4 | static.intercomassets.com |
kalderos-7cca5b914948.intercom-attachments-4.com
|
3 | js.intercomcdn.com |
js.intercomcdn.com
|
3 | kalderos-7cca5b914948.intercom-attachments-4.com | 2 redirects |
2 | api-iam.intercom.io |
js.intercomcdn.com
|
2 | www.google-analytics.com |
1 redirects
kalderos-7cca5b914948.intercom-attachments-4.com
|
2 | fonts.intercomcdn.com |
kalderos-7cca5b914948.intercom-attachments-4.com
|
1 | widget.intercom.io | 1 redirects |
1 | www.google.de |
kalderos-7cca5b914948.intercom-attachments-4.com
|
1 | www.google.com | 1 redirects |
1 | stats.g.doubleclick.net | 1 redirects |
14 | 10 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.intercom.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
intercom-attachments-9.com Amazon |
2019-06-14 - 2020-07-14 |
a year | crt.sh |
intercomassets.com Amazon |
2018-10-11 - 2019-11-11 |
a year | crt.sh |
*.intercomcdn.com Amazon |
2019-04-27 - 2020-05-27 |
a year | crt.sh |
*.google-analytics.com Google Internet Authority G3 |
2019-06-11 - 2019-09-03 |
3 months | crt.sh |
www.google.de Google Internet Authority G3 |
2019-06-11 - 2019-09-03 |
3 months | crt.sh |
*.intercom.com Amazon |
2019-06-11 - 2020-07-11 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://kalderos-7cca5b914948.intercom-attachments-4.com/admins/sign_in
Frame ID: C61D9B17E3048C92097A7360A897F20E
Requests: 10 HTTP requests in this frame
Frame:
https://js.intercomcdn.com/frame.705a1436.js
Frame ID: 42C0A9ACE67930B18888FDE94F67C1C5
Requests: 4 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://kalderos-7cca5b914948.intercom-attachments-4.com/
HTTP 301
https://kalderos-7cca5b914948.intercom-attachments-4.com/ HTTP 302
https://kalderos-7cca5b914948.intercom-attachments-4.com/admins/sign_in Page URL
Detected technologies
Ruby (Programming Languages) ExpandDetected patterns
- meta csrf-param /^authenticity_token$/i
Nginx (Web Servers) Expand
Detected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Ruby on Rails (Web Frameworks) Expand
Detected patterns
- meta csrf-param /^authenticity_token$/i
Amazon Web Services (PaaS) Expand
Detected patterns
- headers via /\(CloudFront\)$/i
Amazon Cloudfront (CDN) Expand
Detected patterns
- headers via /\(CloudFront\)$/i
Google Analytics (Analytics) Expand
Detected patterns
- script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title:
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://kalderos-7cca5b914948.intercom-attachments-4.com/
HTTP 301
https://kalderos-7cca5b914948.intercom-attachments-4.com/ HTTP 302
https://kalderos-7cca5b914948.intercom-attachments-4.com/admins/sign_in Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 7- https://www.google-analytics.com/r/collect?v=1&_v=j76&a=825076037&t=pageview&_s=1&dl=https%3A%2F%2Fkalderos-7cca5b914948.intercom-attachments-4.com%2Fadmins%2Fsign_in&ul=en-us&de=UTF-8&dt=Intercom%20%7C%20The%20easiest%20way%20to%20see%20and%20talk%20to%20your%20users&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEAB~&jid=788382280&gjid=433348108&cid=637911508.1561391059&tid=UA-22834013-1&_gid=904236192.1561391059&_r=1&z=1478118609 HTTP 302
- https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-22834013-1&cid=637911508.1561391059&jid=788382280&_gid=904236192.1561391059&gjid=433348108&_v=j76&z=1478118609 HTTP 302
- https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-22834013-1&cid=637911508.1561391059&jid=788382280&_v=j76&z=1478118609 HTTP 302
- https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-22834013-1&cid=637911508.1561391059&jid=788382280&_v=j76&z=1478118609&slf_rd=1&random=3354642935
- https://widget.intercom.io/widget/tx2p130c HTTP 302
- https://js.intercomcdn.com/shim.latest.js
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
sign_in
kalderos-7cca5b914948.intercom-attachments-4.com/admins/ Redirect Chain
|
9 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
core_styles_shim-f5d7188a4f47864b72cb8bb881096b7c4625952056d6a2e98cbb40238265775e.css
static.intercomassets.com/assets/ |
113 KB 114 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
intercom-logo-b7b715b2c9baaf90a695a6fcab2f9c660f205bc793857bedb666504fbef888d5.svg
static.intercomassets.com/assets/ |
4 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gtm-d877ccd246e27fbedc430677f6c29d78d07152d333bbe7f539822b7b46f1d382.js
static.intercomassets.com/assets/ |
33 KB 34 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Graphik-Regular.woff
fonts.intercomcdn.com/graphik/ |
46 KB 46 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
google_g_logo-36x36-at-2x-7cd954075c56741d84c838f69188f38591848a470a0c2bfe2b949ade6aec59ec.png
static.intercomassets.com/assets/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Graphik-Semibold.woff
fonts.intercomcdn.com/graphik/ |
49 KB 49 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
43 KB 17 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ga-audiences
www.google.de/ads/ Redirect Chain
|
42 B 109 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
shim.latest.js
js.intercomcdn.com/ Redirect Chain
|
11 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
frame.705a1436.js
js.intercomcdn.com/ Frame 42C0 |
325 KB 89 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vendor.513347c4.js
js.intercomcdn.com/ Frame 42C0 |
586 KB 184 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
ping
api-iam.intercom.io/messenger/web/ Frame 42C0 |
170 B 906 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
metrics
api-iam.intercom.io/messenger/web/ Frame 42C0 |
0 686 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Intercom (Online)15 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask function| ga_click function| GTM object| IntercomGTM string| GoogleAnalyticsObject function| ga object| intercomSettings function| Intercom object| google_tag_data object| gaplugins object| gaGlobal object| gaData undefined| __INTERCOM_BUNDLE_LOAD_TIME__0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | default-src 'self'; base-uri 'self'; child-src 'self' docs.google.com fast.wistia.net js.stripe.com platform.twitter.com player.vimeo.com staticxx.facebook.com www.facebook.com web.facebook.com www.loom.com play.vidyard.com www.youtube.com intercom-sheets.com app-sjqe.marketo.com app-sjst.marketo.com app-ab27.marketo.com gtm.intercom-marketing.com intercominc.typeform.com www.intercom-reporting.com; connect-src 'self' app.intercom.com api-iam.intercom.io api-ping.intercom.io nexus-websocket-a.intercom.io nexus-long-poller-a.intercom.io wss://nexus-websocket-a.intercom.io uploads.intercomcdn.com static.intercomassets.com *.tiles.mapbox.com api.amplitude.com app.getsentry.com sentry.io js.logentries.com api.giphy.com api.stripe.com heapanalytics.com meet.intercom.com www.google-analytics.com stats.g.doubleclick.net; font-src data: https:; frame-src 'self' docs.google.com fast.wistia.net js.stripe.com platform.twitter.com player.vimeo.com staticxx.facebook.com www.facebook.com web.facebook.com www.loom.com play.vidyard.com www.youtube.com intercom-sheets.com app-sjqe.marketo.com app-sjst.marketo.com app-ab27.marketo.com gtm.intercom-marketing.com intercominc.typeform.com www.intercom-reporting.com; img-src data: blob: https:; media-src data: blob: https:; object-src 'none'; script-src 'self' js.intercomcdn.com static.intercomassets.com store.intercomassets.com billing-admin.intercomassets.com billing-internal.intercomcdn.com developer-home.intercomassets.com store.intercom.io widget.intercom.io api.tiles.mapbox.com connect.facebook.net js.stripe.com netdna.bootstrapcdn.com platform.twitter.com static.segment.com switchet.s3.amazonaws.com www.google-analytics.com run.pstmn.io cdn.heapanalytics.com heapanalytics.com munchkin.marketo.net app-sjqe.marketo.com app-sjst.marketo.com app-ab27.marketo.com admin.typeform.com 'nonce-ypQg0Kpp6Dpwns8K+KYXIV6a1bpPrZ0uOg1pCehg+vs=' 'unsafe-inline'; style-src 'self' 'unsafe-inline' static.intercomassets.com billing-internal.intercomcdn.com developer-home.intercomassets.com static.intercomcdn.com marketing.intercomassets.com api.tiles.mapbox.com fonts.googleapis.com maxcdn.bootstrapcdn.com netdna.bootstrapcdn.com heapanalytics.com app-sjqe.marketo.com app-sjst.marketo.com app-ab27.marketo.com fonts.intercomcdn.com |
Strict-Transport-Security | max-age=31556952; includeSubDomains; preload |
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
api-iam.intercom.io
fonts.intercomcdn.com
js.intercomcdn.com
kalderos-7cca5b914948.intercom-attachments-4.com
static.intercomassets.com
stats.g.doubleclick.net
widget.intercom.io
www.google-analytics.com
www.google.com
www.google.de
2600:9000:2047:de00:19:1477:f380:93a1
2600:9000:2047:ec00:10:8536:c280:93a1
2a00:1450:4001:808::2003
2a00:1450:4001:808::2004
2a00:1450:4001:81e::200e
2a00:1450:400c:c06::9b
52.222.157.128
52.222.157.46
52.222.157.89
52.222.157.94
048222156bbcbb6b249c6818f9752a28c9aa33bd30599eb24bd57e0b36939d35
2f01c6603c8fd9ccdc6a24b25176520bc952a499eb1ad972542567f9256bfee8
45a0eff5a1b3897e6fa5fcbb0a9bcebdb2768ada35bf1d4d860992fdca779f2b
5d071d0488458c668ebda59c8a8aec1831b7a638ca27aa4befe5a7625631f106
7cd954075c56741d84c838f69188f38591848a470a0c2bfe2b949ade6aec59ec
8f88cb7a1cd4134f5d616b9fca90b9069fa16c162b7ae66ba1b500c490b41dd2
a52f3ca3c9e604f08e2a61f85beaf7d750930ed3d3d8e18f29c20584da338e68
b7b715b2c9baaf90a695a6fcab2f9c660f205bc793857bedb666504fbef888d5
c31f9617ab13c0c1643f28a2edc660051b1cb81fa31c61be93d4cccb4c1747c0
ce4f4b70002ff090e1d722734f5a3f0c2c668d66cf5c5bf3b10b493f3aa743ca
d877ccd246e27fbedc430677f6c29d78d07152d333bbe7f539822b7b46f1d382
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f5d7188a4f47864b72cb8bb881096b7c4625952056d6a2e98cbb40238265775e