![](/screenshots/6305dbe9-1aeb-4fa9-990e-153d6e416a57.png)
merchant-login.us.zip.co
Open in
urlscan Pro
104.16.217.241
Public Scan
Effective URL: https://merchant-login.us.zip.co/u/login?state=hKFo2SBwR2Jmbks2R0VqdVJscXUwczFYRXRya3I0MnRiREpHcqFur3VuaXZlcnNhbC1sb2dpbqN0aWTZIF...
Submission Tags: @phish_report
Submission: On April 13 via api from FI — Scanned from AU
Summary
TLS certificate: Issued by E1 on February 19th 2024. Valid for: 3 months.
This is the only time merchant-login.us.zip.co was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
6 | 152.199.39.108 152.199.39.108 | 15133 (EDGECAST) (EDGECAST) | |
1 | 142.251.10.97 142.251.10.97 | 15169 (GOOGLE) (GOOGLE) | |
1 | 199.232.46.49 199.232.46.49 | 54113 (FASTLY) (FASTLY) | |
1 | 108.157.255.148 108.157.255.148 | 16509 (AMAZON-02) (AMAZON-02) | |
1 2 | 104.16.217.241 104.16.217.241 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 20.51.76.26 20.51.76.26 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 | 52.84.224.126 52.84.224.126 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 172.64.150.121 172.64.150.121 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 172.64.148.201 172.64.148.201 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
23 | 10 |
ASN15169 (GOOGLE, US)
PTR: sd-in-f97.1e100.net
www.googletagmanager.com |
ASN16509 (AMAZON-02, US)
PTR: server-108-157-255-148.sin2.r.cloudfront.net
cdn.segment.com |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
rum.browser-intake-us3-datadoghq.com |
ASN16509 (AMAZON-02, US)
PTR: server-52-84-224-126.sin2.r.cloudfront.net
cdn.auth0.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
zip.co
1 redirects
merchant.ca.zip.co merchant-login.us.zip.co zip.co — Cisco Umbrella Rank: 25452 |
2 MB |
1 |
quadpay.com
assets.quadpay.com — Cisco Umbrella Rank: 54163 |
51 KB |
1 |
auth0.com
cdn.auth0.com — Cisco Umbrella Rank: 6764 |
63 KB |
1 |
browser-intake-us3-datadoghq.com
rum.browser-intake-us3-datadoghq.com — Cisco Umbrella Rank: 40453 session-replay.browser-intake-us3-datadoghq.com Failed |
|
1 |
segment.com
cdn.segment.com — Cisco Umbrella Rank: 1785 |
2 KB |
1 |
contentful.com
cdn.contentful.com — Cisco Umbrella Rank: 8101 |
|
1 |
googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 42 |
94 KB |
0 |
wpengine.com
Failed
zipus.wpengine.com Failed |
|
0 |
licdn.com
Failed
snap.licdn.com Failed |
|
23 | 9 |
Domain | Requested by | |
---|---|---|
6 | merchant.ca.zip.co |
merchant.ca.zip.co
|
2 | merchant-login.us.zip.co |
1 redirects
merchant.ca.zip.co
|
1 | assets.quadpay.com |
merchant-login.us.zip.co
|
1 | zip.co |
merchant-login.us.zip.co
|
1 | cdn.auth0.com |
merchant-login.us.zip.co
|
1 | rum.browser-intake-us3-datadoghq.com |
merchant.ca.zip.co
|
1 | cdn.segment.com |
merchant.ca.zip.co
|
1 | cdn.contentful.com |
merchant.ca.zip.co
|
1 | www.googletagmanager.com |
merchant.ca.zip.co
www.googletagmanager.com |
0 | zipus.wpengine.com Failed | |
0 | snap.licdn.com Failed |
www.googletagmanager.com
|
0 | session-replay.browser-intake-us3-datadoghq.com Failed |
merchant.ca.zip.co
|
23 | 12 |
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni26d3fgl.wpc.edgecastcdn.net DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2024-04-13 - 2025-05-14 |
a year | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2024-03-04 - 2024-05-27 |
3 months | crt.sh |
cdn.contentful.com GlobalSign Atlas R3 DV TLS CA 2024 Q1 |
2024-04-03 - 2025-05-05 |
a year | crt.sh |
*.segment.com Amazon RSA 2048 M03 |
2023-11-14 - 2024-12-13 |
a year | crt.sh |
merchant-login.us.zip.co E1 |
2024-02-19 - 2024-05-19 |
3 months | crt.sh |
*.browser-intake-us3-datadoghq.com DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2023-07-18 - 2024-07-18 |
a year | crt.sh |
*.auth0.com Amazon RSA 2048 M03 |
2024-01-25 - 2025-02-22 |
a year | crt.sh |
zip.co GTS CA 1P5 |
2024-03-10 - 2024-06-08 |
3 months | crt.sh |
quadpay.com GTS CA 1P5 |
2024-04-12 - 2024-07-11 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://merchant-login.us.zip.co/u/login?state=hKFo2SBwR2Jmbks2R0VqdVJscXUwczFYRXRya3I0MnRiREpHcqFur3VuaXZlcnNhbC1sb2dpbqN0aWTZIFd0dm1QbEtNYU1LSVpLTzVsVjJlMGN4QXZOMHF6a1lYo2NpZNkgUGxnaU55U3RQUmtPYmJNZEx6Y28wM2NlZGkwdnN1bng
Frame ID: 4176144DE3A19E80506E4B5DDA60EEA2
Requests: 23 HTTP requests in this frame
Screenshot
![](/screenshots/6305dbe9-1aeb-4fa9-990e-153d6e416a57.png)
Page Title
Log in | Merchant PortalPage URL History Show full URLs
-
http://merchant.ca.zip.co/
HTTP 307
https://merchant.ca.zip.co/ Page URL
-
https://merchant-login.us.zip.co/authorize?client_id=PlgiNyStPRkObbMdLzco03cedi0vsunx&audience=https%3A%2F%2F...
HTTP 302
https://merchant-login.us.zip.co/u/login?state=hKFo2SBwR2Jmbks2R0VqdVJscXUwczFYRXRya3I0MnRiREpHcqFur3VuaXZlcn... Page URL
Detected technologies
Detected patterns
- zip\.co
![](/vendor/wappa/icons/Google Tag Manager.png)
Detected patterns
- googletagmanager\.com/gtm\.js
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Sign up instead
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://merchant.ca.zip.co/
HTTP 307
https://merchant.ca.zip.co/ Page URL
-
https://merchant-login.us.zip.co/authorize?client_id=PlgiNyStPRkObbMdLzco03cedi0vsunx&audience=https%3A%2F%2Fmerchants-auth.quadpay.com&isSignUp=false&scope=openid%20profile%20email&response_type=code&response_mode=query&state=Q0hCY2NKNjBlcF9PMFZHY3NHQTNJamxoeEhQdU4wd1MzaFU2WUlKQ21oYQ%3D%3D&nonce=TjVUM0NSX3pPM0Y0dHd5SUd5WHR5b19Va3dsSUhYMThuMmVwcmRrWVYwTQ%3D%3D&redirect_uri=https%3A%2F%2Fmerchant.ca.zip.co%2Fcallback&code_challenge=XbGQUllthtr5L2aCAB2UyMFP1cy9uXqoGGjxYh_xe7I&code_challenge_method=S256&auth0Client=eyJuYW1lIjoiYXV0aDAtc3BhLWpzIiwidmVyc2lvbiI6IjEuMTQuMCJ9
HTTP 302
https://merchant-login.us.zip.co/u/login?state=hKFo2SBwR2Jmbks2R0VqdVJscXUwczFYRXRya3I0MnRiREpHcqFur3VuaXZlcnNhbC1sb2dpbqN0aWTZIFd0dm1QbEtNYU1LSVpLTzVsVjJlMGN4QXZOMHF6a1lYo2NpZNkgUGxnaU55U3RQUmtPYmJNZEx6Y28wM2NlZGkwdnN1bng Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://merchant.ca.zip.co/ HTTP 307
- https://merchant.ca.zip.co/
23 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
merchant.ca.zip.co/ Redirect Chain
|
2 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
chunk-vendors.1e33298f.js
merchant.ca.zip.co/js/ |
2 MB 723 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.273d3204.js
merchant.ca.zip.co/js/ |
3 MB 1 MB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
chunk-vendors.68c40a17.css
merchant.ca.zip.co/css/ |
196 KB 25 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.a3a8f5cb.css
merchant.ca.zip.co/css/ |
116 KB 18 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gtm.js
www.googletagmanager.com/ |
283 KB 94 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
entries
cdn.contentful.com/spaces/l6e5nwwfjxup/environments/master/ |
0 0 |
Preflight
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
settings
cdn.segment.com/v1/projects/xaNctDFEUj8G9HPTE9RuvZnEJ7umxzfI/ |
2 KB 2 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
entries
cdn.contentful.com/spaces/l6e5nwwfjxup/environments/master/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET BLOB |
99166092-2c26-412c-98da-2006a7f49274
https://merchant.ca.zip.co/ |
25 KB 0 |
Other
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
login
merchant-login.us.zip.co/u/ Redirect Chain
|
39 KB 39 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
rum
rum.browser-intake-us3-datadoghq.com/api/v2/ |
0 0 |
Ping
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
replay
session-replay.browser-intake-us3-datadoghq.com/api/v2/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
insight.min.js
snap.licdn.com/li.lms-analytics/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
destination
www.googletagmanager.com/gtag/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ajs-destination.dd2f2b48.js
merchant.ca.zip.co/js/ |
78 KB 9 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
schemaFilter.973c5701.js
merchant.ca.zip.co/js/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
rum
rum.browser-intake-us3-datadoghq.com/api/v2/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.cdn.min.css
cdn.auth0.com/ulp/react-components/1.87.4/css/ |
272 KB 63 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
black.svg
zip.co/assets/fearless/logos/zip/ |
975 B 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
auth0-login-background_US.svg
assets.quadpay.com/auth0-universal/ |
157 KB 51 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
650 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
sharp-grotesk-book-20.woff2
zip.co/static-assets/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Square-Favicon.svg
zipus.wpengine.com/wp-content/uploads/2021/08/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- cdn.contentful.com
- URL
- https://cdn.contentful.com/spaces/l6e5nwwfjxup/environments/master/entries?content_type=notification
- Domain
- session-replay.browser-intake-us3-datadoghq.com
- URL
- https://session-replay.browser-intake-us3-datadoghq.com/api/v2/replay?ddsource=browser&ddtags=sdk_version%3A4.50.0%2Capi%3Abeacon%2Cenv%3Aproduction%2Cservice%3Amerchant-portal%2Cversion%3A1.0.766&dd-api-key=pub0bca794cc55f614b1c619317639af531&dd-evp-origin-version=4.50.0&dd-evp-origin=browser&dd-request-id=7bd0e768-9a91-499f-b090-57495364d118
- Domain
- snap.licdn.com
- URL
- https://snap.licdn.com/li.lms-analytics/insight.min.js
- Domain
- www.googletagmanager.com
- URL
- https://www.googletagmanager.com/gtag/destination?id=AW-520051803&l=dataLayer&cx=c
- Domain
- merchant.ca.zip.co
- URL
- https://merchant.ca.zip.co/js/schemaFilter.973c5701.js
- Domain
- rum.browser-intake-us3-datadoghq.com
- URL
- https://rum.browser-intake-us3-datadoghq.com/api/v2/rum?ddsource=browser&ddtags=sdk_version%3A4.50.0%2Capi%3Abeacon%2Cenv%3Aproduction%2Cservice%3Amerchant-portal%2Cversion%3A1.0.766&dd-api-key=pub0bca794cc55f614b1c619317639af531&dd-evp-origin-version=4.50.0&dd-evp-origin=browser&dd-request-id=4c221762-c0bf-4496-8af5-1dc5bea40c9c&batch_time=1713017772660
- Domain
- zip.co
- URL
- https://zip.co/static-assets/fonts/sharp-grotesk-book-20.woff2
- Domain
- zipus.wpengine.com
- URL
- https://zipus.wpengine.com/wp-content/uploads/2021/08/Square-Favicon.svg
Verdicts & Comments Add Verdict or Comment
3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| customizeResetPasswordEmailScreen function| customizeSignUpUrlInLoginScreen object| ulpFlags8 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.zip.co/ | Name: _gcl_au Value: 1.1.1820507348.1713017772 |
|
merchant.ca.zip.co/ | Name: _dd_s Value: rum=1&id=10d68a9a-24be-48a7-a6c7-241540d0be54&created=1713017770721&expire=1713018670721 |
|
merchant-login.us.zip.co/ | Name: did Value: s%3Av0%3A614a7fe0-f9a0-11ee-96cb-27236fe6c1aa.09vb%2Be0PUZ9fPmszRMukj74s8tzAHEjVaxlJgo5cCG4 |
|
merchant-login.us.zip.co/ | Name: auth0 Value: s%3Av1.gadzZXNzaW9ugqZoYW5kbGXEQDJ0GakAfDKzCKOA9FvWQo0TtWMUwA_jV1Sr7tbnLetE3jj5LEpzYMGoc9_0i4yJH0h5rgxlu8UU-DD2b5So6zGmY29va2llg6dleHBpcmVz1__Hjm0AZh6IK65vcmlnaW5hbE1heEFnZc4PcxQAqHNhbWVTaXRlpG5vbmU.w8XbJJi45Mb%2BtoLSyf1%2BS%2BSe5u9W9Gw%2BaF4IcoeifcE |
|
merchant-login.us.zip.co/ | Name: did_compat Value: s%3Av0%3A614a7fe0-f9a0-11ee-96cb-27236fe6c1aa.09vb%2Be0PUZ9fPmszRMukj74s8tzAHEjVaxlJgo5cCG4 |
|
merchant-login.us.zip.co/ | Name: auth0_compat Value: s%3Av1.gadzZXNzaW9ugqZoYW5kbGXEQDJ0GakAfDKzCKOA9FvWQo0TtWMUwA_jV1Sr7tbnLetE3jj5LEpzYMGoc9_0i4yJH0h5rgxlu8UU-DD2b5So6zGmY29va2llg6dleHBpcmVz1__Hjm0AZh6IK65vcmlnaW5hbE1heEFnZc4PcxQAqHNhbWVTaXRlpG5vbmU.w8XbJJi45Mb%2BtoLSyf1%2BS%2BSe5u9W9Gw%2BaF4IcoeifcE |
|
.zip.co/ | Name: __cf_bm Value: jhC1w.uLZlR2CwcFE3fX1GBCJv12faa8.B_D.eC5aUs-1713017773-1.0.1.1-3UBNE0JDjimof5yBr3a.v0o1yzV9iNQ6p2X786Yf6mJmI1MHfnDX.pXgbC7u5EcyEh6GnGUGwFNo8G_iQEW9Ug |
|
.quadpay.com/ | Name: __cf_bm Value: usTzbm8kgmaIX4CzCIgGQBvmPBKsKLQ6ZuABD6zMH9U-1713017774-1.0.1.1-8HQSZB_Kc_r9_yLZO3GpbWp4l2KHS.HV1p6tZqSFPuhB4jtoP2pqlkO9HkUvA3KrJVaj2ryIf9NyN4QdQEppMQ |
4 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000; includeSubDomains; preload |
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
assets.quadpay.com
cdn.auth0.com
cdn.contentful.com
cdn.segment.com
merchant-login.us.zip.co
merchant.ca.zip.co
rum.browser-intake-us3-datadoghq.com
session-replay.browser-intake-us3-datadoghq.com
snap.licdn.com
www.googletagmanager.com
zip.co
zipus.wpengine.com
cdn.contentful.com
merchant.ca.zip.co
rum.browser-intake-us3-datadoghq.com
session-replay.browser-intake-us3-datadoghq.com
snap.licdn.com
www.googletagmanager.com
zip.co
zipus.wpengine.com
104.16.217.241
108.157.255.148
142.251.10.97
152.199.39.108
172.64.148.201
172.64.150.121
199.232.46.49
20.51.76.26
52.84.224.126
14997af1d3d5ece87d847eb290efcbefd476033ac066bfaed3f166bd0ebe66fa
40db496b666bc587f8159cca9f8ff43b1c83d8ef1d7b3438a5056480ece8a125
6857f1ddbfc8d2211fbac2383e1e0ede3b3e1f9c86a748e7807fc96023b9ba8b
6c7b8838b1680b8482d0441136cadec7e099a2bfba6ee897d34b94eaae8e7a77
7a2e6f837f737da77815c84e917c8bdbbf245e180d1128dbb4af4ef792f1cefb
93068e1d764c570b7a3dad4bc991b7a4ab69e869b53854c8b29b531e81d45e35
97fd7c15e7e8fe7e2b30d090233fc05beb333430767bc5041bb09ae10c2b12e0
aaf1eac584819e98c7f78a20216bd2fb10ee29e10b290983bc0fa82d0f293bce
e5c8e84eb1e686fbe74223b3f0819c4bff696d080b7b472936792991110b622e
f1b4527976e08e563ac60216edd73e41996e7ff6e9e53a70e117f2fca2a2aac1