ca.surveygizmo.com
Open in
urlscan Pro
2600:9000:200c:c00:a:603f:d140:93a1
Malicious Activity!
Public Scan
Submission: On October 26 via manual from CA
Summary
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on November 4th 2016. Valid for: 3 years.
This is the only time ca.surveygizmo.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: BCE-Bell (Telecommunication)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
5 | 2600:9000:200... 2600:9000:200c:c00:a:603f:d140:93a1 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
1 | 52.95.147.25 52.95.147.25 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
6 | 2 |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
ca.surveygizmo.com |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: s3-w.ca-central-1.amazonaws.com
widgixca-library.s3.amazonaws.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
surveygizmo.com
ca.surveygizmo.com |
388 KB |
1 |
amazonaws.com
widgixca-library.s3.amazonaws.com |
114 KB |
6 | 2 |
Domain | Requested by | |
---|---|---|
5 | ca.surveygizmo.com |
ca.surveygizmo.com
|
1 | widgixca-library.s3.amazonaws.com |
ca.surveygizmo.com
|
6 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.surveygizmo.com Go Daddy Secure Certificate Authority - G2 |
2016-11-04 - 2020-02-02 |
3 years | crt.sh |
*.s3.amazonaws.com DigiCert Baltimore CA-2 G2 |
2018-11-07 - 2020-02-07 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://ca.surveygizmo.com/s3/50059650/Bell-email
Frame ID: D82CB4B8E4B1F70BE641C7E567877BC1
Requests: 6 HTTP requests in this frame
Screenshot
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Amazon Web Services (PaaS) Expand
Detected patterns
- headers via /\(CloudFront\)$/i
Amazon Cloudfront (CDN) Expand
Detected patterns
- headers via /\(CloudFront\)$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
6 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
Bell-email
ca.surveygizmo.com/s3/50059650/ |
28 KB 29 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jscal.css
ca.surveygizmo.com/2019.10.25.00/runtimejs/dist/survey/css/ |
7 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
survey2.css
ca.surveygizmo.com/2019.10.25.00/runtimejs/dist/survey/css/ |
208 KB 42 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sg-icon-font.css
ca.surveygizmo.com/2019.10.25.00/runtimethemes/default/runtime/css/ |
22 KB 9 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
survey.js
ca.surveygizmo.com/2019.10.25.00/runtimejs/dist/survey/js/ |
1015 KB 307 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Bell_logo.png
widgixca-library.s3.amazonaws.com/library/50007652/ |
114 KB 114 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: BCE-Bell (Telecommunication)38 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate boolean| debugMode object| surveyJQueryNoConflict function| SignaturePad function| sortableStopEvent function| addSortAndRankingAccessibility function| handleDropCardSort function| handleDropCardSortClosed function| handleCreateNewCategory function| resetTheFocus function| srAlert function| translate undefined| translatedb function| $ function| jQuery object| SGAPI function| $SG function| SelectParser function| AbstractChosen function| get_side_border_padding function| Fingerprint function| SGCookie function| SG_init_page function| SGSurvey function| slider object| mejs function| MediaElement object| HtmlMediaElement function| onYouTubePlayerAPIReady function| DefaultPlayer function| MediaElementPlayer object| Highcharts function| Calendar object| S50059650 string| currency_glyph_global string| optId object| that0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ca.surveygizmo.com
widgixca-library.s3.amazonaws.com
2600:9000:200c:c00:a:603f:d140:93a1
52.95.147.25
2db3d48e5b10f795451b458c449fbfc8135472c233c7501d30db47c11999730e
3dadfa7b678f67311879b1e99021d0f8dfa3b734b0cc0a6bef66de9fb9cf5864
53f6b08376003a0b725989f15ce61d9c7279532f2b99ac49d724e4e165b751d7
5b888908eadca2849df9f6df613e01f74d76dda71b2f737922123039b79e3ccd
5d1bbb609ff4a69cb1ab9a885dd26c9066cc1c2c01703cfaa8a932f0ea04d6c9
cdfdd8c9e14a41cae928e9712191cb26bb3d9f407588137cbf0b97708610a0b3