![](/screenshots/327b27cf-96e7-4162-ae99-87a061750817.png)
zeroheight.com
Open in
urlscan Pro
52.51.23.169
Malicious Activity!
Public Scan
Submission: On September 21 via manual from AU — Scanned from AU
Summary
TLS certificate: Issued by R3 on July 21st 2022. Valid for: 3 months.
This is the only time zeroheight.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Adobe (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 13 | 52.51.23.169 52.51.23.169 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 13.225.0.95 13.225.0.95 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 54.192.111.111 54.192.111.111 | 16509 (AMAZON-02) (AMAZON-02) | |
2 | 46.137.138.178 46.137.138.178 | 16509 (AMAZON-02) (AMAZON-02) | |
5 | 35.188.42.15 35.188.42.15 | 15169 (GOOGLE) (GOOGLE) | |
1 | 54.214.110.41 54.214.110.41 | 16509 (AMAZON-02) (AMAZON-02) | |
3 | 52.218.121.98 52.218.121.98 | 16509 (AMAZON-02) (AMAZON-02) | |
24 | 7 |
ASN16509 (AMAZON-02, US)
PTR: ec2-52-51-23-169.eu-west-1.compute.amazonaws.com
zeroheight.com |
ASN16509 (AMAZON-02, US)
PTR: server-13-225-0-95.sin52.r.cloudfront.net
cdn.amplitude.com |
ASN16509 (AMAZON-02, US)
PTR: server-54-192-111-111.mrs52.r.cloudfront.net
public.profitwell.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-46-137-138-178.eu-west-1.compute.amazonaws.com
api.zeroheight.com |
ASN15169 (GOOGLE, US)
PTR: 15.42.188.35.bc.googleusercontent.com
sentry.io |
ASN16509 (AMAZON-02, US)
PTR: ec2-54-214-110-41.us-west-2.compute.amazonaws.com
api.amplitude.com |
ASN16509 (AMAZON-02, US)
PTR: s3-eu-west-1-r-w.amazonaws.com
zeroheight.s3.eu-west-1.amazonaws.com | |
zeroheight-user-uploads.s3.eu-west-1.amazonaws.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
15 |
zeroheight.com
2 redirects
zeroheight.com — Cisco Umbrella Rank: 228216 api.zeroheight.com — Cisco Umbrella Rank: 558419 |
2 MB |
5 |
sentry.io
sentry.io — Cisco Umbrella Rank: 300 |
2 KB |
3 |
amazonaws.com
zeroheight.s3.eu-west-1.amazonaws.com — Cisco Umbrella Rank: 555910 zeroheight-user-uploads.s3.eu-west-1.amazonaws.com — Cisco Umbrella Rank: 454915 |
893 KB |
2 |
amplitude.com
cdn.amplitude.com — Cisco Umbrella Rank: 2561 api.amplitude.com — Cisco Umbrella Rank: 1363 |
26 KB |
1 |
profitwell.com
public.profitwell.com — Cisco Umbrella Rank: 5112 |
9 KB |
24 | 5 |
Domain | Requested by | |
---|---|---|
13 | zeroheight.com |
2 redirects
zeroheight.com
|
5 | sentry.io |
zeroheight.com
|
2 | zeroheight-user-uploads.s3.eu-west-1.amazonaws.com |
zeroheight.com
|
2 | api.zeroheight.com |
zeroheight.com
|
1 | zeroheight.s3.eu-west-1.amazonaws.com |
zeroheight.com
|
1 | api.amplitude.com |
zeroheight.com
|
1 | public.profitwell.com |
zeroheight.com
|
1 | cdn.amplitude.com |
zeroheight.com
|
24 | 8 |
This site contains links to these domains. Also see Links.
Domain |
---|
accespoint2.matne.ru |
Subject Issuer | Validity | Valid | |
---|---|---|---|
zeroheight.com R3 |
2022-07-21 - 2022-10-19 |
3 months | crt.sh |
cdn.amplitude.com Amazon |
2021-12-17 - 2023-01-14 |
a year | crt.sh |
*.profitwell.com Amazon |
2022-07-03 - 2023-08-01 |
a year | crt.sh |
*.api.zeroheight.com Amazon |
2021-11-01 - 2022-11-29 |
a year | crt.sh |
sentry.io DigiCert TLS RSA SHA256 2020 CA1 |
2022-06-03 - 2023-07-04 |
a year | crt.sh |
*.amplitude.com COMODO RSA Domain Validation Secure Server CA |
2022-01-28 - 2023-02-28 |
a year | crt.sh |
*.s3-eu-west-1.amazonaws.com Amazon |
2021-12-17 - 2022-12-07 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://zeroheight.com/96e579fc9
Frame ID: FC279379710D1FB11AB6CC4CCC7C0929
Requests: 23 HTTP requests in this frame
Screenshot
![](/screenshots/327b27cf-96e7-4162-ae99-87a061750817.png)
Page Title
ACCOUNT PAYABLE ยท zeroheightDetected technologies
![](/vendor/wappa/icons/amplitude.png)
Detected patterns
- cdn\.amplitude\.com
![](/vendor/wappa/icons/Highlight.js.png)
Detected patterns
- /(?:([\d.])+/)?highlight(?:\.min)?\.js
Detected patterns
- public\.profitwell\.com/js/profitwell\.js
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: DOWNLOAD PDF
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 19- https://zeroheight.com/uploads/yuHo-uBEFxD3X9dlWJcv1Q.png HTTP 302
- https://zeroheight-user-uploads.s3.eu-west-1.amazonaws.com/images/yuHo-uBEFxD3X9dlWJcv1Q.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIA3AVNYHQK4QFFEFF5%2F20220921%2Feu-west-1%2Fs3%2Faws4_request&X-Amz-Date=20220921T044646Z&X-Amz-Expires=86400&X-Amz-SignedHeaders=host&X-Amz-Signature=a6e3ebc7f51f0192d4cbe65b189f794ae4eabb033f07f0942027dd79eaaa66fb
- https://zeroheight.com/uploads/hSsYSsMOyOGqa10G7DOXkw.png HTTP 302
- https://zeroheight-user-uploads.s3.eu-west-1.amazonaws.com/images/hSsYSsMOyOGqa10G7DOXkw.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIA3AVNYHQK4QFFEFF5%2F20220921%2Feu-west-1%2Fs3%2Faws4_request&X-Amz-Date=20220921T044646Z&X-Amz-Expires=86400&X-Amz-SignedHeaders=host&X-Amz-Signature=2e3b3e0795d00878a4c4a08294e81189f4f9e992957d4b5c0da653e0ca17b557
24 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
96e579fc9
zeroheight.com/ |
11 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
plugin-7c69eaf05f6ca396ba42061b38ad1222281df8ce38be2d25a440a89e0398bb5a.css
zeroheight.com/the-other-assets/ |
88 KB 15 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
zeroheight.com/zhapp/bundles/ |
426 KB 83 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
SpaceGrotesk.css
zeroheight.com/fonts/ |
635 B 865 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
highlight.min.js
zeroheight.com/ |
45 KB 19 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
app.js
zeroheight.com/zhapp/bundles/ |
7 MB 2 MB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
amplitude-4.4.0-min.gz.js
cdn.amplitude.com/libs/ |
74 KB 25 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
profitwell.js
public.profitwell.com/js/ |
35 KB 9 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
view
api.zeroheight.com/ |
0 0 |
Preflight
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
/
sentry.io/api/1297203/envelope/ |
2 B 404 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
spin.gif
zeroheight.com/images/zhapp/ |
31 KB 31 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
full-logo-350.png
zeroheight.com/images/zhapp/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
multidrag.png
zeroheight.com/images/zhapp/ |
523 B 754 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
load_blocks
zeroheight.com/api/styleguide/ |
13 B 1 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
load_pages
zeroheight.com/api/styleguide/ |
1 KB 2 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
/
api.amplitude.com/ |
7 B 205 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
view
api.zeroheight.com/ |
28 B 381 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
/
sentry.io/api/1297203/envelope/ |
2 B 404 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
/
sentry.io/api/1297203/envelope/ |
2 B 404 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.png
zeroheight.s3.eu-west-1.amazonaws.com/zeroheight-huddle/logos/93767/93515/ |
71 KB 72 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
yuHo-uBEFxD3X9dlWJcv1Q.png
zeroheight-user-uploads.s3.eu-west-1.amazonaws.com/images/ Redirect Chain
|
518 KB 519 KB |
Image
binary/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
hSsYSsMOyOGqa10G7DOXkw.png
zeroheight-user-uploads.s3.eu-west-1.amazonaws.com/images/ Redirect Chain
|
302 KB 303 KB |
Image
binary/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
/
sentry.io/api/1297203/envelope/ |
2 B 404 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
/
sentry.io/api/1297203/envelope/ |
2 B 404 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Adobe (Consumer)38 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| forgeryToken object| amplitude string| SENTRY_DSN string| SENTRY_ENVIRONMENT function| profitwell string| APP_VERSION string| APP_MODE object| USER_INFO string| DEFAULT_DOMAIN object| AVAILABLE_PLANS object| USER_ATTACHMENTS_WHITELIST number| USER_ATTACHMENTS_BATCH_LIMIT string| USER_ATTACHMENTS_MAX_FILE_SIZE string| FIGMA_CLIENT_ID string| ZEPLIN_CLIENT_ID boolean| KEEP_OPEN object| styleguideDetails string| STRIPE_KEY object| hljs object| webpackJsonp object| SENTRY_RELEASE object| __SENTRY__ object| regeneratorRuntime object| Backbone object| scCGSHMRCache function| Quill object| less object| jsonlint boolean| loadingFigmaImages4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
zeroheight.com/ | Name: loc_code Value: AU |
|
.zeroheight.com/ | Name: viewer_uid Value: cDlUZ09ieDBLRWEveWtkNkRIT1pMTHZ3K0I4MktMTnozaXp3Q1pqMEwyRT0tLWxjK2t4emxtWm5jck1JOGdwUmtVNVE9PQ%3D%3D--978d90f8227ae7d0d610a03ee7eca2373329ad18 |
|
.zeroheight.com/ | Name: amplitude_id_710046ca554fe7c78d358b8c5e09a168zeroheight.com Value: eyJkZXZpY2VJZCI6IjRiMDMzNzUwLThiYTMtNGYxZC05M2JmLTc1ZjYyZjMwNGQxNlIiLCJ1c2VySWQiOm51bGwsIm9wdE91dCI6ZmFsc2UsInNlc3Npb25JZCI6MTY2MzczNTYwMzczNSwibGFzdEV2ZW50VGltZSI6MTY2MzczNTYwNjE4OCwiZXZlbnRJZCI6MSwiaWRlbnRpZnlJZCI6MCwic2VxdWVuY2VOdW1iZXIiOjF9 |
|
zeroheight.com/ | Name: _zeroheight_session Value: YWlTcjcyazVETnJCTHpoN1dVR3VmVHdkVDNpQThQZFliTUVRc3JqaFR0UXcwMVhkOVJxVU05aWs0MkduRlluTGI1QnlCS3U1UTRBS2RBYUZETGNZM0NRNFJoRTRRaGFGNnl5d0lEV1cxbjVUZE5ZVE5UYndlcEExYjRTQnVTVWNOS0lSZjBQeEh1UFhFdHd6ZWFHUEdBPT0tLVovYk1TNU0xQzJURFZiNHJrbGh3Y1E9PQ%3D%3D--b19c0850e717e52b01fc3fb75b6958cfc79d1e7f |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | default-src https: 'self'; connect-src *.hotjar.com:* vc.hotjar.io:* surveystats.hotjar.io wss://*.hotjar.com https: 'self'; font-src 'self' data: script.hotjar.com https:; img-src 'self' https: data: blob: script.hotjar.com; object-src 'self' https: data:; script-src 'self' js.stripe.c 'unsafe-eval' static.hotjar.com script.hotjar.com 'unsafe-inline' https: data:; style-src 'self' https: 'unsafe-inline' |
Strict-Transport-Security | max-age=31536000; includeSubDomains; preload |
X-Content-Type-Options | nosniff |
X-Frame-Options | sameorigin |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
api.amplitude.com
api.zeroheight.com
cdn.amplitude.com
public.profitwell.com
sentry.io
zeroheight-user-uploads.s3.eu-west-1.amazonaws.com
zeroheight.com
zeroheight.s3.eu-west-1.amazonaws.com
13.225.0.95
35.188.42.15
46.137.138.178
52.218.121.98
52.51.23.169
54.192.111.111
54.214.110.41
00ce3cf487e823d14a89eab41ece2d3deadb0545ab404cacc2a22ecd796b04ae
1b0688fd25c8ed55bc9e189e52f9f8b88390620d2a3a0c02f8a18d0d03b43bb4
1efc72ad0d7957b7d93831875400c7b5ec74c783c2078261a4851a848b1b06b7
2822310ad5d103fcc9602a78e0840ff0143a28a01b48083740cb562dcd1c7dc4
42c00a91566d54e8b87465709fcb882fca52e6354a334101b34c318830282b87
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4cf0818dd9010568437158677180d8aa461ec9c52770ee6cef771b5f6d01f3c1
5696e0f9ed4f9a25c297013f55715e2cbcf13dc04a82828cdeb6ca951b7757e5
587d22d93b5a21d14f120835bbca1a065a3aa93903ba23b9745eb3cf523669fa
7c69eaf05f6ca396ba42061b38ad1222281df8ce38be2d25a440a89e0398bb5a
92f9c5adcb1361309d91e0587b85b10fa3279396e9aa791f2759e7be5514c3eb
94793e651d33131640f21098c7a9ee7155892c1a0be754c80e8e38c3ec5a81d2
9d6bc673da8459803b24621dd2a278e425c6aca2b32490c46c20163b1849d6db
a55cdbdee33189e33d7d91aee0487d88a6d5ba6b4e457859bfe2239ce671565f
aa4d27e0d0c0172667e24d953344b058b7f16c6ef7dcc54a8910878f1d050cae
aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
cff919a47442633e73f773413a3113010df7990b27236422593b99e52217c7be
f1dd2736bdf640a1ca2c378fef5aacb61a78e9553a02700d14f89add468c4738
fc17e22241e51e856285975ce9316e8fb3262744d6716b0c5e4783170862d33c