opendocuments.s3.us-west-004.backblazeb2.com Open in urlscan Pro
149.137.129.254  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://openlotsnewsletters100.snednewsler12.repl.co/ Page URL
2. https://opendocuments.s3.us-west-004.backblazeb2.com/docusign.html Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ Show response openlotsnewsletters100.snednewsler12.repl.co/	527 B 792 B	616ms 263ms	Document text/html	34.149.204.188 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://openlotsnewsletters100.snednewsler12.repl.co/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.149.204.188 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 188.204.149.34.bc.googleusercontent.com Software / PHP/7.4.21 Resource Hash c04771ad7da2e52045968370c525979405d1c2ebd1796617b69044295da06b11 Security Headers Name Value Strict-Transport-Security max-age=7769819; includeSubDomains Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers content-type text/html; charset=UTF-8 date Wed, 28 Sep 2022 02:12:54 GMT expect-ct max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791" host openlotsnewsletters100.snednewsler12.repl.co replit-cluster global strict-transport-security max-age=7769819; includeSubDomains x-powered-by PHP/7.4.21
GET H2	200	replit-badge.js Show response replit.com/public/js/	12 KB 5 KB	154ms 55ms	Script application/javascript	2606:4700::6812:c26 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://replit.com/public/js/replit-badge.js Requested by Host: openlotsnewsletters100.snednewsler12.repl.co URL: https://openlotsnewsletters100.snednewsler12.repl.co/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:c26 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash 5c232101b5a284c799de58d8177560d8b8b5866eedd34e8743b06a155e297c09 Security Headers Name Value Strict-Transport-Security max-age=31536000; preload Request headers accept-language de-DE,de;q=0.9 Referer https://openlotsnewsletters100.snednewsler12.repl.co/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Wed, 28 Sep 2022 02:12:54 GMT content-encoding br etag W/"3188-182e0a91e60" cf-cache-status HIT last-modified Sat, 27 Aug 2022 18:55:56 GMT server cloudflare age 1127601 x-powered-by Express vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000 strict-transport-security max-age=31536000; preload cf-ray 7518f4f2ccc26945-FRA expires Thu, 28 Sep 2023 02:12:54 GMT
GET H/1.1	200	Primary Request docusign.html Show response opendocuments.s3.us-west-004.backblazeb2.com/	126 KB 127 KB	624ms 251ms	Document text/html	149.137.129.254 BACKBLAZE
General Check archive.org Show headers Download Go to Full URL https://opendocuments.s3.us-west-004.backblazeb2.com/docusign.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 149.137.129.254 , United States, ASN40401 (BACKBLAZE, US), Reverse DNS s3.us-west-004.backblazeb2.com Software / Resource Hash 7b89a6c8da53099a8ef039dcaf59be9d4966dcf149fa2b5767d6fc3f057fb66b Request headers Referer https://openlotsnewsletters100.snednewsler12.repl.co/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Accept-Ranges bytes Connection keep-alive Content-Length 129316 Content-Type text/html Date Wed, 28 Sep 2022 02:12:54 GMT ETag "c00893a3a97ec0f7b26242e9cac1b003" Keep-Alive timeout=5 Last-Modified Wed, 28 Sep 2022 01:23:34 GMT x-amz-id-2 aMxAwkGYlNKQ4m2LfYyNjrTEtY1pmyjnQ x-amz-meta-src_last_modified_millis 1664328007784 x-amz-request-id e5dbde1c32e3edd2 x-amz-version-id 4_zb3f0cf04b80b8c1c813c0f19_f110930d48b4dd09c_d20220928_m012334_c004_v0402003_t0036_u01664328214069
GET H2	200	docusign_logo.png independant.io/wp-content/uploads/	4 KB 4 KB	208ms 92ms	Image image/png	162.159.135.42 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://independant.io/wp-content/uploads/docusign_logo.png Requested by Host: opendocuments.s3.us-west-004.backblazeb2.com URL: https://opendocuments.s3.us-west-004.backblazeb2.com/docusign.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 162.159.135.42 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 108dd2ac3dd3337b4097aa8eaabcbca55e8fcb21931b43634e3ac3556219e952 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://opendocuments.s3.us-west-004.backblazeb2.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Wed, 28 Sep 2022 02:12:56 GMT ki-cache-tag 18748e6c-884b-41d0-a16d-58025e210f19,c745f5871a1bb393ed903144f01891b08fcdd7d0452ab86247ebc908243e1df7 cf-cache-status HIT ki-edge v=17.8 age 16582 nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 3840 ki-cf-cache-status HIT last-modified Sat, 05 Dec 2020 10:27:07 GMT server cloudflare etag "5fcb607b-f00" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Kef2bNYRSX7tDS183scCS7N3OM%2F9GWlH41iHarS6MgwgAReBcK6JqAxicuwc4Xik7nuWvwK8DCX%2BqmEaYanJ%2Bw6NY4Uw%2FbWK3aZm9%2Fb6a9AhHhb8bTasdc6hcXejoDLj"}],"group":"cf-nel","max_age":604800} content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 ki-cache-type CDN accept-ranges bytes cf-ray 7518f4fab94d9006-FRA x-content-type-options nosniff x-edge-location-klb 1 expires Thu, 28 Sep 2023 02:12:56 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DocuSign (Online)

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery object| jQuery16206377445938210431 function| script function| click_to_download function| make_the_delay function| redirect_the function| now_download

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=7769819; includeSubDomains

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

independant.io
opendocuments.s3.us-west-004.backblazeb2.com
openlotsnewsletters100.snednewsler12.repl.co
replit.com
149.137.129.254
162.159.135.42
2606:4700::6812:c26
34.149.204.188
108dd2ac3dd3337b4097aa8eaabcbca55e8fcb21931b43634e3ac3556219e952
5c232101b5a284c799de58d8177560d8b8b5866eedd34e8743b06a155e297c09
7b89a6c8da53099a8ef039dcaf59be9d4966dcf149fa2b5767d6fc3f057fb66b
c04771ad7da2e52045968370c525979405d1c2ebd1796617b69044295da06b11