docusign.site Open in urlscan Pro
23.229.193.165 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.go2l.ink/1iu9/
Effective URL:
https://docusign.site/wp-admin/css/login.adobe.com/$%5e%2525-$&%5e$.php?id=d4cabac9eecd6b9f1199c72d26328dfe
Submission: On August 07 via automatic, source openphish (August 7th 2017, 10:36:03 pm UTC)

Summary HTTP 2 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 2 HTTP transactions. The main IP is 23.229.193.165, located in Scottsdale, United States and belongs to AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US. The main domain is docusign.site.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on August 5th 2017. Valid for: a year.

This is the only time docusign.site was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Adobe (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1	23.229.193.165 23.229.193.165	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com)
1	46.4.115.108 46.4.115.108	24940 (HETZNER-AS) (HETZNER-AS)
2	3

1 23.229.193.165 (Scottsdale, United States)

ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-23-229-193-165.ip.secureserver.net

docusign.site	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 46.4.115.108 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: de-hz5.cubeupload.com

u.cubeupload.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	cubeupload.com u.cubeupload.com	22 KB
1	docusign.site docusign.site	45 KB
2	2

	Domain	Requested by
1	u.cubeupload.com	docusign.site
1	docusign.site
2	2

This site contains no links.

Subject Issuer	Validity	Valid
docusign.site Go Daddy Secure Certificate Authority - G2	`2017-08-05` - `2018-08-05`	a year	crt.sh
u.cubeupload.com Let's Encrypt Authority X3	`2017-07-31` - `2017-10-29`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://docusign.site/wp-admin/css/login.adobe.com/$%5e%2525-$&%5e$.php?id=d4cabac9eecd6b9f1199c72d26328dfe
Frame ID: 31781.1
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

2
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

67 kB
Transfer

131 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request 0

http://i.cubeupload.com/n82joM.png
https://u.cubeupload.com/n82joM.png

2 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request $%5e%2525-$&%5e$.php Show response
docusign.site/wp-admin/css/login.adobe.com/
Redirect Chain

https://docusign.site/wp-admin/css/login.adobe.com/index.php
https://docusign.site/wp-admin/css/login.adobe.com/$%5e%2525-$&%5e$.php?id=d4cabac9eecd6b9f1199c72d26328dfe

94 KB
45 KB

361ms
361ms

Document
text/html

23.229.193.165
GoDaddy.com

General

Check archive.org

Show headers Download Go to

Full URL: https://docusign.site/wp-admin/css/login.adobe.com/$%5e%2525-$&%5e$.php?id=d4cabac9eecd6b9f1199c72d26328dfe
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.229.193.165 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS: ip-23-229-193-165.ip.secureserver.net
Software: Apache/2.4.25 / PHP/7.1.6
Resource Hash: cae955abd63679f6f0b6dfac04568d79a422355cc634420ed2437ccedb096680

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Mon, 07 Aug 2017 22:35:53 GMT
Content-Encoding: gzip
Server: Apache/2.4.25
X-Powered-By: PHP/7.1.6
Vary: Accept-Encoding,User-Agent
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: Keep-Alive
Keep-Alive: timeout=5

Redirect headers

Date: Mon, 07 Aug 2017 22:35:52 GMT
Server: Apache/2.4.25
X-Powered-By: PHP/7.1.6
Vary: User-Agent
Content-Type: text/html; charset=UTF-8
Location: $%5e%2525-$&%5e$.php?id=d4cabac9eecd6b9f1199c72d26328dfe
Connection: Keep-Alive
Keep-Alive: timeout=5
Content-Length: 0

GET
H/1.1

200
OK

n82joM.png
u.cubeupload.com/
Redirect Chain

http://i.cubeupload.com/n82joM.png
https://u.cubeupload.com/n82joM.png

22 KB
22 KB

118ms
3ms

Image
image/png

46.4.115.108
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://u.cubeupload.com/n82joM.png

Requested by

Host: docusign.site
URL: https://docusign.site/wp-admin/css/login.adobe.com/$%5e%2525-$&%5e$.php?id=d4cabac9eecd6b9f1199c72d26328dfe

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

46.4.115.108 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

de-hz5.cubeupload.com

Software

nginx/1.10.1 (Ubuntu) /

Resource Hash

64d12f0e4df422337328a3689a08d1fc5fb805fd7cef0cee089068a9d5c3bb7f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Mon, 07 Aug 2017 22:35:53 GMT
X-Content-Type-Options: nosniff
X-Delivered-By: Content Library
Server: nginx/1.10.1 (Ubuntu)
X-Frame-Options: DENY
Strict-Transport-Security: max-age=63072000; includeSubdomains
Content-Type: image/png; charset=binary
Cache-Control: no-cache
Transfer-Encoding: chunked
Connection: keep-alive

Redirect headers

Location: https://u.cubeupload.com/n82joM.png
Date: Mon, 07 Aug 2017 22:35:53 GMT
Server: nginx/1.10.1 (Ubuntu)
Connection: keep-alive
Content-Length: 194
Content-Type: text/html

GET
DATA 200
OK truncated
/ 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c2bf63a87ef0d4ac43482c5722a0a5b68e225ef69073019411a408b8084ff70c

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/png

GET
DATA 200
OK truncated
/ 11 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0f7ca77a8ac88efd0254763ffd1e11bb301f729c71988b7abb7f2e32d58126dc

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Adobe (Consumer)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

docusign.site
u.cubeupload.com
23.229.193.165
46.4.115.108
0f7ca77a8ac88efd0254763ffd1e11bb301f729c71988b7abb7f2e32d58126dc
64d12f0e4df422337328a3689a08d1fc5fb805fd7cef0cee089068a9d5c3bb7f
c2bf63a87ef0d4ac43482c5722a0a5b68e225ef69073019411a408b8084ff70c
cae955abd63679f6f0b6dfac04568d79a422355cc634420ed2437ccedb096680

docusign.site Open in urlscan Pro 23.229.193.165 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

2 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

67 kBTransfer

131 kBSize

0 Cookies

0 Outgoing links

Redirected requests

2 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

docusign.site Open in urlscan Pro
23.229.193.165 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

2
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

67 kB
Transfer

131 kB
Size

0
Cookies

2 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!