email.sendgrid.com.click.21354819.wirdeinfestival.de
Open in
urlscan Pro
104.243.38.230
Malicious Activity!
Public Scan
Effective URL: http://email.sendgrid.com.click.21354819.wirdeinfestival.de/en/5/a3623b754ae1d024c8495f22b48c1e92/e7db3925a3d47d0b27941fa0046cd9db/a311fb8f98d8adf911c8abf39...
Submission: On December 26 via manual from US
Summary
This is the only time email.sendgrid.com.click.21354819.wirdeinfestival.de was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Sendgrid (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 18 | 104.243.38.230 104.243.38.230 | 23470 (RELIABLESITE) (RELIABLESITE - ReliableSite.Net LLC) | |
1 | 2600:9000:214... 2600:9000:214f:bc00:19:a248:21c0:21 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
1 1 | 151.139.236.32 151.139.236.32 | 33438 (HIGHWINDS2) (HIGHWINDS2 - Highwinds Network Group) | |
1 | 2a00:d01:ff:9... 2a00:d01:ff:905:94:228:142:37 | 41887 (PROLOCATI...) (PROLOCATION Transit policy pref 100) | |
1 | 104.109.91.112 104.109.91.112 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
2 | 2a04:4e42:3::621 2a04:4e42:3::621 | 54113 (FASTLY) (FASTLY - Fastly) | |
1 | 52.216.170.251 52.216.170.251 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
1 | 34.96.67.224 34.96.67.224 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
2 | 34.204.222.116 34.204.222.116 | 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com) | |
26 | 8 |
ASN23470 (RELIABLESITE - ReliableSite.Net LLC, US)
email.sendgrid.com.click.21354818.wirdeinfestival.de | |
email.sendgrid.com.click.21354819.wirdeinfestival.de |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
d1tjxxwiv1dd3b.cloudfront.net |
ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US)
talon-ehawk.netdna-ssl.com |
ASN41887 (PROLOCATION Transit policy pref 100, NL)
www.e-hawk.net |
ASN20940 (AKAMAI-ASN1, US)
PTR: a104-109-91-112.deploy.static.akamaitechnologies.com
static.zuora.com |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: s3-1-w.amazonaws.com
uiux.s3.amazonaws.com |
ASN15169 (GOOGLE - Google LLC, US)
PTR: 224.67.96.34.bc.googleusercontent.com
cdn.siftscience.com |
ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-34-204-222-116.compute-1.amazonaws.com
errors.client.optimizely.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
18 |
wirdeinfestival.de
1 redirects
email.sendgrid.com.click.21354818.wirdeinfestival.de email.sendgrid.com.click.21354819.wirdeinfestival.de |
983 KB |
2 |
optimizely.com
errors.client.optimizely.com |
720 B |
2 |
polyfill.io
cdn.polyfill.io |
767 B |
1 |
siftscience.com
cdn.siftscience.com |
20 KB |
1 |
amazonaws.com
uiux.s3.amazonaws.com |
4 KB |
1 |
zuora.com
static.zuora.com |
6 KB |
1 |
e-hawk.net
www.e-hawk.net |
14 KB |
1 |
netdna-ssl.com
1 redirects
talon-ehawk.netdna-ssl.com |
158 B |
1 |
cloudfront.net
d1tjxxwiv1dd3b.cloudfront.net |
4 KB |
26 | 9 |
Domain | Requested by | |
---|---|---|
17 | email.sendgrid.com.click.21354819.wirdeinfestival.de |
email.sendgrid.com.click.21354819.wirdeinfestival.de
|
2 | errors.client.optimizely.com |
email.sendgrid.com.click.21354819.wirdeinfestival.de
|
2 | cdn.polyfill.io |
email.sendgrid.com.click.21354819.wirdeinfestival.de
|
1 | cdn.siftscience.com |
email.sendgrid.com.click.21354819.wirdeinfestival.de
|
1 | uiux.s3.amazonaws.com |
email.sendgrid.com.click.21354819.wirdeinfestival.de
|
1 | static.zuora.com |
email.sendgrid.com.click.21354819.wirdeinfestival.de
|
1 | www.e-hawk.net |
email.sendgrid.com.click.21354819.wirdeinfestival.de
|
1 | talon-ehawk.netdna-ssl.com | 1 redirects |
1 | d1tjxxwiv1dd3b.cloudfront.net |
email.sendgrid.com.click.21354819.wirdeinfestival.de
|
1 | email.sendgrid.com.click.21354818.wirdeinfestival.de | 1 redirects |
26 | 10 |
This site contains links to these domains. Also see Links.
Domain |
---|
sendgrid.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.cloudfront.net DigiCert Global CA G2 |
2019-07-17 - 2020-07-05 |
a year | crt.sh |
*.e-hawk.net Sectigo RSA Domain Validation Secure Server CA |
2019-06-05 - 2020-06-21 |
a year | crt.sh |
www.zuora.com COMODO RSA Domain Validation Secure Server CA |
2018-10-12 - 2021-01-13 |
2 years | crt.sh |
f3.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3 |
2019-05-29 - 2020-04-23 |
a year | crt.sh |
*.s3.amazonaws.com DigiCert Baltimore CA-2 G2 |
2019-11-09 - 2021-03-12 |
a year | crt.sh |
*.siftscience.com DigiCert SHA2 Secure Server CA |
2019-01-03 - 2021-03-26 |
2 years | crt.sh |
errors.client.optimizely.com DigiCert SHA2 High Assurance Server CA |
2018-09-24 - 2020-09-28 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
http://email.sendgrid.com.click.21354819.wirdeinfestival.de/en/5/a3623b754ae1d024c8495f22b48c1e92/e7db3925a3d47d0b27941fa0046cd9db/a311fb8f98d8adf911c8abf3950a5e4d
Frame ID: 8EC80E36AF7E7E5C727813D981362F44
Requests: 26 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://email.sendgrid.com.click.21354818.wirdeinfestival.de/c4ca4238a0b923820dcc509a6f75849b/30465e1d9f7434f27282a295052da335/a3623b754a...
HTTP 302
http://email.sendgrid.com.click.21354819.wirdeinfestival.de/en/5/a3623b754ae1d024c8495f22b48c1e92/e7db3925a3d47d0b27941fa0046cd9db/a311f... Page URL
Detected technologies
CentOS (Operating Systems) ExpandDetected patterns
- headers server /CentOS/i
Apache (Web Servers) Expand
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Sign up now!
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://email.sendgrid.com.click.21354818.wirdeinfestival.de/c4ca4238a0b923820dcc509a6f75849b/30465e1d9f7434f27282a295052da335/a3623b754ae1d024c8495f22b48c1e92/ffc5e01f578535fd6f95f889cb31939d
HTTP 302
http://email.sendgrid.com.click.21354819.wirdeinfestival.de/en/5/a3623b754ae1d024c8495f22b48c1e92/e7db3925a3d47d0b27941fa0046cd9db/a311fb8f98d8adf911c8abf3950a5e4d Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 6- https://talon-ehawk.netdna-ssl.com/EHawkTalon.js HTTP 301
- https://www.e-hawk.net/talon-cdn/EHawkTalon.js
26 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
a311fb8f98d8adf911c8abf3950a5e4d
email.sendgrid.com.click.21354819.wirdeinfestival.de/en/5/a3623b754ae1d024c8495f22b48c1e92/e7db3925a3d47d0b27941fa0046cd9db/ Redirect Chain
|
50 KB 50 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tiara.css
d1tjxxwiv1dd3b.cloudfront.net/ |
23 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
72168671.js
email.sendgrid.com.click.21354819.wirdeinfestival.de/SendGrid/com/src/ |
371 KB 372 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
api_config.js
email.sendgrid.com.click.21354819.wirdeinfestival.de/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
108.e0ff89b5ed61aa692324.css
email.sendgrid.com.click.21354819.wirdeinfestival.de/SendGrid/com/src/ |
157 KB 157 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
12.a3c87866979216143f24.css
email.sendgrid.com.click.21354819.wirdeinfestival.de/SendGrid/com/src/ |
388 KB 389 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
container.css
email.sendgrid.com.click.21354819.wirdeinfestival.de/SendGrid/com/src/ |
15 KB 15 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
EHawkTalon.js
www.e-hawk.net/talon-cdn/ Redirect Chain
|
43 KB 14 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ckeditor.js
email.sendgrid.com.click.21354819.wirdeinfestival.de/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
zuora-min.js
static.zuora.com/Resources/libs/hosted/1.3.0/ |
16 KB 6 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
polyfill.min.js
cdn.polyfill.io/v2/ |
222 B 542 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sg-twilio-lockup.svg
uiux.s3.amazonaws.com/logo/ |
4 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
runtime.90bee01e22454a5f6de0.js
email.sendgrid.com.click.21354819.wirdeinfestival.de/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
vendors~main.8dbed9e02b0fb25fdd9a.js
email.sendgrid.com.click.21354819.wirdeinfestival.de/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.3fc4efc9e81871874e68.js
email.sendgrid.com.click.21354819.wirdeinfestival.de/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
s.js
cdn.siftscience.com/ |
61 KB 20 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
api_config.js
email.sendgrid.com.click.21354819.wirdeinfestival.de/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ckeditor.js
email.sendgrid.com.click.21354819.wirdeinfestival.de/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
colfax-regular.05f3d250.woff2
email.sendgrid.com.click.21354819.wirdeinfestival.de/dist/static/media/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
polyfill.min.js
cdn.polyfill.io/v2/ |
222 B 225 B |
Other
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
runtime.90bee01e22454a5f6de0.js
email.sendgrid.com.click.21354819.wirdeinfestival.de/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
colfax-regular.95413010.woff
email.sendgrid.com.click.21354819.wirdeinfestival.de/dist/static/media/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
vendors~main.8dbed9e02b0fb25fdd9a.js
email.sendgrid.com.click.21354819.wirdeinfestival.de/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.3fc4efc9e81871874e68.js
email.sendgrid.com.click.21354819.wirdeinfestival.de/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H/1.1 |
log
errors.client.optimizely.com/ |
13 B 443 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
log
errors.client.optimizely.com/ |
0 277 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Sendgrid (Online)32 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate object| trackedEvents function| track undefined| _ object| dataLayer object| referrer string| hostname object| theBody function| initNewRelic function| initGTM string| publicPath string| route boolean| inBlackList object| urlBlacklist boolean| OnlyBlacklist boolean| blackListInit function| eHawkTalon function| EHTalon function| Fingerprint object| script string| __z_version string| ifrmId boolean| threedRedirected object| ZLOG object| ZXD object| Z object| ZFB object| _sift function| __siftFlashCB undefined| Sift object| PluginDetect0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.polyfill.io
cdn.siftscience.com
d1tjxxwiv1dd3b.cloudfront.net
email.sendgrid.com.click.21354818.wirdeinfestival.de
email.sendgrid.com.click.21354819.wirdeinfestival.de
errors.client.optimizely.com
static.zuora.com
talon-ehawk.netdna-ssl.com
uiux.s3.amazonaws.com
www.e-hawk.net
104.109.91.112
104.243.38.230
151.139.236.32
2600:9000:214f:bc00:19:a248:21c0:21
2a00:d01:ff:905:94:228:142:37
2a04:4e42:3::621
34.204.222.116
34.96.67.224
52.216.170.251
16f1efa415bfdd7abcf8fdd76cc05ae6fa66ffdfdc730368ecea89ecfe5c3a12
1a2a572f006b242096d76275e8c9edb114f9aa65cbd67fd1c4d57053da83932f
29eb73b66f7f12c0e8cb17b131dffa962bf9d992d24406a6ced52315c33a1f3a
67ebd998fb16c0f51f2725b55ada5d28982e4943f5b50c3c141b78b96317fdfc
929e88471afd8a6882e29779d1f4175111d92b6180baa86265db6bb90c9f18cd
9c039230a469d0d57cfc3866662782543561dae3ce6cb54ea02a9df6d4d6a67e
a64557141635487855396145cdcec9e360869ec31c67612958dfabfc8577aa41
b29a07e2825e8ec2610a36eea52d9c1657f4e5101d9ef4a6082b93eb7277e871
cae897bdde94867960ad284a56b1631296eaceddf5710a2857127ca0aa2777d3
cca4a7a37cbd21cf375e5bbd4b2d64a38128f7eb178693c0f28d0f228c7bc6eb
ce6c8a655514b0de3173c43f4175e9f37ca8e59956ee1a1e3e0218aee2735671
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f7dff0321d998ec9f035b23e16c81bf72f44af5c6c06167ebd5374a426fae1ed