![](/screenshots/6fe07606-28dd-48f4-ae0c-82de82c624c5.png)
www.surveygizmo.com
Open in
urlscan Pro
52.222.152.32
Malicious Activity!
Public Scan
Submission: On May 03 via manual from CA
Summary
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on November 4th 2016. Valid for: 3 years.
This is the only time www.surveygizmo.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Telus (Telecommunication)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 52.222.152.32 52.222.152.32 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
4 | 54.230.93.211 54.230.93.211 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
1 | 2a00:1450:400... 2a00:1450:4001:81f::200a | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 2406:da00:ff0... 2406:da00:ff00::3211:de8c | 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com) | |
1 | 2a00:1450:400... 2a00:1450:4001:808::2003 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
8 | 6 |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-52-222-152-32.fra53.r.cloudfront.net
www.surveygizmo.com |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-54-230-93-211.fra2.r.cloudfront.net
www.surveygizmo.com |
ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
static.telus.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
surveygizmo.com
www.surveygizmo.com |
392 KB |
1 |
gstatic.com
fonts.gstatic.com |
13 KB |
1 |
telus.com
static.telus.com |
2 KB |
1 |
googleapis.com
fonts.googleapis.com |
567 B |
8 | 4 |
Domain | Requested by | |
---|---|---|
5 | www.surveygizmo.com |
www.surveygizmo.com
|
1 | fonts.gstatic.com |
www.surveygizmo.com
|
1 | static.telus.com |
www.surveygizmo.com
|
1 | fonts.googleapis.com |
www.surveygizmo.com
|
8 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.surveygizmo.com Go Daddy Secure Certificate Authority - G2 |
2016-11-04 - 2020-02-02 |
3 years | crt.sh |
*.googleapis.com Google Internet Authority G3 |
2019-04-16 - 2019-07-09 |
3 months | crt.sh |
static.telus.com DigiCert Global CA G2 |
2019-04-02 - 2020-04-25 |
a year | crt.sh |
*.google.com Google Internet Authority G3 |
2019-04-16 - 2019-07-09 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.surveygizmo.com/s3/4994468/Webmail-Telus
Frame ID: 8D7A797636FC2C5CC8BE92AE813EF81A
Requests: 9 HTTP requests in this frame
Screenshot
![](/screenshots/6fe07606-28dd-48f4-ae0c-82de82c624c5.png)
Detected technologies
![](/vendor/wappa/icons/Highcharts.png)
Detected patterns
- env /^Highcharts$/i
![](/vendor/wappa/icons/MediaElement.js.png)
Detected patterns
- env /^mejs$/i
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Detected patterns
- env /^jQuery$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
8 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
Webmail-Telus
www.surveygizmo.com/s3/4994468/ |
33 KB 34 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jscal.css
www.surveygizmo.com/2019.05.02.03/runtimejs/dist/survey/css/ |
7 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
survey2.css
www.surveygizmo.com/2019.05.02.03/runtimejs/dist/survey/css/ |
207 KB 42 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sg-icon-font.css
www.surveygizmo.com/2019.05.02.03/runtimethemes/default/runtime/css/ |
22 KB 9 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
survey.js
www.surveygizmo.com/2019.05.02.03/runtimejs/dist/survey/js/ |
1012 KB 305 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
2 KB 567 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
TELUS-logo.svg
static.telus.com/common/images/header/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
42 B 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
JTUSjIg1_i6t8kCHKm459WlhyyTh89Y.woff2
fonts.gstatic.com/s/montserrat/v13/ |
13 KB 13 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Telus (Telecommunication)41 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask boolean| debugMode object| surveyJQueryNoConflict function| SignaturePad function| sortableStopEvent function| addSortAndRankingAccessibility function| handleDropCardSort function| handleDropCardSortClosed function| handleCreateNewCategory function| resetTheFocus function| srAlert function| translate undefined| translatedb function| $ function| jQuery object| SGAPI function| $SG function| SelectParser function| AbstractChosen function| get_side_border_padding function| Fingerprint function| SGCookie function| SG_init_page function| SGSurvey function| slider object| mejs function| MediaElement object| HtmlMediaElement function| onYouTubePlayerAPIReady function| DefaultPlayer function| MediaElementPlayer object| Highcharts function| Calendar function| phishingBannerChecker function| phishingFooterChecker object| S4994468 string| currency_glyph_global string| optId object| that0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
fonts.gstatic.com
static.telus.com
www.surveygizmo.com
2406:da00:ff00::3211:de8c
2a00:1450:4001:808::2003
2a00:1450:4001:81f::200a
52.222.152.32
54.230.93.211
0353647f3caf6187318d37022a18401c12c693136d43c4d795500de701274b14
0ce5a460ace775560c3344a43245687bdbec5cb8ee20d209ab9fa67f4e09a3e8
53f6b08376003a0b725989f15ce61d9c7279532f2b99ac49d724e4e165b751d7
8c0b230f7dcf65e2f232a2825bc769fb4dcff96982af865b1f6e72a86f196d2b
c2ef8569508c875007a472dd4a96e1c1728115484007490030dc8f37418ee79f
cdfdd8c9e14a41cae928e9712191cb26bb3d9f407588137cbf0b97708610a0b3
df0bd0f6b706ed68879702b8ddd0a61586c503add9d1c7b1fa8fdd658bf50818
e0ed9867a9118466d21a4a639414867e96380440e4ea4b24782d5e30db52084f
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629