securemessagealerts.us-east-1.elasticbeanstalk.com
Open in
urlscan Pro
3.218.50.17
Malicious Activity!
Public Scan
Effective URL: http://securemessagealerts.us-east-1.elasticbeanstalk.com/docusign/documents/api-b0f7888e3e8ba1c1cbe4836c23f91a1b/index?cmd=_view-document&session=2b08416...
Submission: On November 01 via manual from HK
Summary
This is the only time securemessagealerts.us-east-1.elasticbeanstalk.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: DocuSign (Online) GDrive and other (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
6 32 | 3.218.50.17 3.218.50.17 | 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com) | |
4 | 162.248.184.53 162.248.184.53 | 62856 (DOCUS-6-PROD) (DOCUS-6-PROD - Docusign) | |
1 | 2606:4700:30:... 2606:4700:30::681c:192e | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
37 | 4 |
ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-3-218-50-17.compute-1.amazonaws.com
securemessagealerts.us-east-1.elasticbeanstalk.com |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
bc.adrut.bz |
Apex Domain Subdomains |
Transfer | |
---|---|---|
32 |
elasticbeanstalk.com
6 redirects
securemessagealerts.us-east-1.elasticbeanstalk.com |
502 KB |
4 |
docusign.com
account.docusign.com |
|
1 |
adrut.bz
bc.adrut.bz |
6 KB |
0 |
msocdn.com
Failed
prod.msocdn.com Failed |
|
37 | 4 |
Domain | Requested by | |
---|---|---|
32 | securemessagealerts.us-east-1.elasticbeanstalk.com |
6 redirects
securemessagealerts.us-east-1.elasticbeanstalk.com
|
4 | account.docusign.com |
securemessagealerts.us-east-1.elasticbeanstalk.com
|
1 | bc.adrut.bz |
securemessagealerts.us-east-1.elasticbeanstalk.com
|
0 | prod.msocdn.com Failed |
securemessagealerts.us-east-1.elasticbeanstalk.com
|
37 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
portal.office.com |
g.microsoftonline.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
account.docusign.com DigiCert SHA2 Extended Validation Server CA |
2018-03-26 - 2020-03-26 |
2 years | crt.sh |
sni46408.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2 |
2019-08-20 - 2020-02-26 |
6 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://securemessagealerts.us-east-1.elasticbeanstalk.com/docusign/documents/api-b0f7888e3e8ba1c1cbe4836c23f91a1b/index?cmd=_view-document&session=2b0841682441ab16f67493fae7cbd8b3&dispatch=03453834acc130059d87c0189033a28da9721e7acountry.x=NL-Netherlands&lang.x=en
Frame ID: 3BB6D33B2710BC849F626D6619C0469C
Requests: 37 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://securemessagealerts.us-east-1.elasticbeanstalk.com/docusign
HTTP 301
http://securemessagealerts.us-east-1.elasticbeanstalk.com/docusign/ HTTP 302
http://securemessagealerts.us-east-1.elasticbeanstalk.com/docusign/documents/api-b0f7888e3e8ba1c1cbe4836c23f91a1b/index?cmd=_view-docu... Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Page Statistics
4 Outgoing links
These are links going to different origins than the main page.
Title: Feedback
Search URL Search Domain Scan URL
Title: Community
Search URL Search Domain Scan URL
Title: Legal
Search URL Search Domain Scan URL
Title: Privacy & cookies
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://securemessagealerts.us-east-1.elasticbeanstalk.com/docusign
HTTP 301
http://securemessagealerts.us-east-1.elasticbeanstalk.com/docusign/ HTTP 302
http://securemessagealerts.us-east-1.elasticbeanstalk.com/docusign/documents/api-b0f7888e3e8ba1c1cbe4836c23f91a1b/index?cmd=_view-document&session=2b0841682441ab16f67493fae7cbd8b3&dispatch=03453834acc130059d87c0189033a28da9721e7acountry.x=NL-Netherlands&lang.x=en Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 7- http://securemessagealerts.us-east-1.elasticbeanstalk.com/docusign/css/MasterStyles15MVC.css HTTP 302
- https://account.docusign.com/
- http://securemessagealerts.us-east-1.elasticbeanstalk.com/docusign/css/shellg2corecss_11377998.css HTTP 302
- https://account.docusign.com/
- http://securemessagealerts.us-east-1.elasticbeanstalk.com/docusign/css/shellg2pluscss_baae2042.css HTTP 302
- https://account.docusign.com/
- http://securemessagealerts.us-east-1.elasticbeanstalk.com/docusign/documents/api-b0f7888e3e8ba1c1cbe4836c23f91a1b/images/apple-touch-icon-72x72.png HTTP 302
- https://account.docusign.com/
- http://securemessagealerts.us-east-1.elasticbeanstalk.com/docusign/css/shellwofficons_f991c945.woff HTTP 302
- https://account.docusign.com/
- http://securemessagealerts.us-east-1.elasticbeanstalk.com/docusign/css/shellttficons_9739c58c.ttf HTTP 302
- https://account.docusign.com/
37 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
index
securemessagealerts.us-east-1.elasticbeanstalk.com/docusign/documents/api-b0f7888e3e8ba1c1cbe4836c23f91a1b/ Redirect Chain
|
84 KB 84 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
SpryValidationTextField.css
securemessagealerts.us-east-1.elasticbeanstalk.com/docusign/assets/ |
3 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
SpryValidationPassword.css
securemessagealerts.us-east-1.elasticbeanstalk.com/docusign/assets/ |
2 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
GeminiHomeV2.css
securemessagealerts.us-east-1.elasticbeanstalk.com/docusign/css/ |
2 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
conciergehelper.css
securemessagealerts.us-east-1.elasticbeanstalk.com/docusign/css/ |
5 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
AppTile.css
securemessagealerts.us-east-1.elasticbeanstalk.com/docusign/css/ |
1 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
EmbeddedFonts.css
securemessagealerts.us-east-1.elasticbeanstalk.com/docusign/css/ |
4 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
MasterStyles15.css
securemessagealerts.us-east-1.elasticbeanstalk.com/docusign/css/ |
90 KB 90 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
account.docusign.com/ Redirect Chain
|
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headersRedirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
shellg2coremincss_ba45585d.css
securemessagealerts.us-east-1.elasticbeanstalk.com/docusign/css/ |
31 KB 31 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
account.docusign.com/ Redirect Chain
|
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headersRedirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
data.css
securemessagealerts.us-east-1.elasticbeanstalk.com/docusign/css/ |
14 KB 14 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
account.docusign.com/ Redirect Chain
|
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headersRedirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.min.js
securemessagealerts.us-east-1.elasticbeanstalk.com/docusign/assets/ |
93 KB 93 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.ddslick.min.js
securemessagealerts.us-east-1.elasticbeanstalk.com/docusign/assets/ |
7 KB 7 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
SpryValidationTextField.js
securemessagealerts.us-east-1.elasticbeanstalk.com/docusign/assets/ |
76 KB 76 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
SpryValidationPassword.js
securemessagealerts.us-east-1.elasticbeanstalk.com/docusign/assets/ |
20 KB 21 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
social_auth_providers.png
securemessagealerts.us-east-1.elasticbeanstalk.com/docusign/images/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
docusign.png
securemessagealerts.us-east-1.elasticbeanstalk.com/docusign/images/ |
7 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
account.docusign.com/ Redirect Chain
|
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headersRedirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
home_bkgd_1.png
securemessagealerts.us-east-1.elasticbeanstalk.com/docusign/css/ |
22 KB 22 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
office365icons.woff
securemessagealerts.us-east-1.elasticbeanstalk.com/16.00.1279.006/en-US/css/Fabric/0.10.3/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
SegoeUI-Light-final.woff
prod.msocdn.com/16.00.1279.006/en-US/css/webfonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
SegoeUI-Light-final.ttf
prod.msocdn.com/16.00.1279.006/en-US/css/webfonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
office365icons.ttf
securemessagealerts.us-east-1.elasticbeanstalk.com/16.00.1279.006/en-US/css/Fabric/0.10.3/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.css
bc.adrut.bz/css/ |
6 KB 6 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
SegoeUI-Regular-final.woff
prod.msocdn.com/16.00.1279.006/en-US/css/webfonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cJZKeOuBrn4kERxqtaUH3T8E0i7KZn-EPnyo3HZu7kw.woff
securemessagealerts.us-east-1.elasticbeanstalk.com/docusign/assets/ |
21 KB 22 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
o365.png
securemessagealerts.us-east-1.elasticbeanstalk.com/docusign/images/ |
922 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mail_gmail.png
securemessagealerts.us-east-1.elasticbeanstalk.com/docusign/images/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
yahoo.png
securemessagealerts.us-east-1.elasticbeanstalk.com/docusign/images/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
live_hotmail.png
securemessagealerts.us-east-1.elasticbeanstalk.com/docusign/images/ |
517 B 759 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
aol.png
securemessagealerts.us-east-1.elasticbeanstalk.com/docusign/images/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
email.png
securemessagealerts.us-east-1.elasticbeanstalk.com/docusign/images/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
/
account.docusign.com/ Redirect Chain
|
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
SegoeUI-Regular-final.ttf
prod.msocdn.com/16.00.1279.006/en-US/css/webfonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
/
account.docusign.com/ Redirect Chain
|
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- prod.msocdn.com
- URL
- https://prod.msocdn.com/16.00.1279.006/en-US/css/webfonts/SegoeUI-Light-final.woff
- Domain
- prod.msocdn.com
- URL
- https://prod.msocdn.com/16.00.1279.006/en-US/css/webfonts/SegoeUI-Light-final.ttf
- Domain
- prod.msocdn.com
- URL
- https://prod.msocdn.com/16.00.1279.006/en-US/css/webfonts/SegoeUI-Regular-final.woff
- Domain
- account.docusign.com
- URL
- https://account.docusign.com/
- Domain
- prod.msocdn.com
- URL
- https://prod.msocdn.com/16.00.1279.006/en-US/css/webfonts/SegoeUI-Regular-final.ttf
- Domain
- account.docusign.com
- URL
- https://account.docusign.com/
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: DocuSign (Online) GDrive and other (Online)7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| $ function| jQuery object| Spry object| sprypassword1 object| sprytextfield11 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
securemessagealerts.us-east-1.elasticbeanstalk.com/ | Name: PHPSESSID Value: kuir506c8hsfb768l767419af9 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
account.docusign.com
bc.adrut.bz
prod.msocdn.com
securemessagealerts.us-east-1.elasticbeanstalk.com
account.docusign.com
prod.msocdn.com
162.248.184.53
2606:4700:30::681c:192e
3.218.50.17
0b6c1e1b33c085efad5bdc32654ec90b4ddc934eb1c1aca71a439ff89867f468
0e95cbf733f41b43a1e2716643ad7ea8cd5fdfcb2eee2d038f4618c579bcaff7
1b5fe12e21a9d8ff78e007ecf9fa5a819947dc3e6ba7a0ca4951760d1c006adf
1e433631dd88e2b7c65a36d80acd0134287a5b6effc8a68a6a3f8bfe619928d1
23d0712c0ed03b1f4636061df39f42471c13e811d5373ff7875a9b7821743be1
3b20a0c711b489bf56697cc5bc20cbc05b15fa6f4548a2cf83f217c81b3ab948
3df1b7719a1aa90d70ae337b76b6253b01ede9afa038b290498c3abf4ab54027
69e875128adeedbc8aa1221b7ebffb20b484685964f4ab9a9772ce2146e52d48
7203ea431e00ea57bbbeef3d0d86e71660c6cf089ed83f7c9bda8d3c7f15cea8
73b1ce58fa539aab1d6d1424607c5ff60fc5e2f2c0becd3a776f7f4f8f3664b0
8a1687e9cc74a616cd14fcb8dac9bc3d901765d7d4d9644183b406f4a0cc155d
90556675373ea9ed1d0e9b5678426d69296b6801c906ca378bb426aa3d6acdc3
970882d4a7e6a84819f31de8d238cb3ada20bf0a4ea307b45bf44988bbfc4602
a79d12b1ece73120a07168f3a409515e43736055e7d40a9daf4f8d619e417a0b
a8b6798721ae62801a74027daff7b0d4f0d10034cb46bc492fc995553c598c92
b21a9de9414be9988efb7b56c4d2ab101aee02ebf6e80a16bfa43dfa7234da9b
c7b07a0440ecfbd1f32110a6a5c7e92ecfe0200a65ba5fdd5660a98cf2294c09
d72fcb8924d1e14dbd4b04aff994c1183ee86c620f0aaac034f75fc508548220
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3dd3d2eb577e0976c6c3bb2a597839a4b50019e6f34767d692b371aa6a87dd7
e87010b14aca80b1c1f3f2efec982d906303e81f618b7d27dc2fdf281ba44757
ee63a0504d463e639fd21abb1a96d909f530d309b679e6ab953155cf58f07a84
f4572394df6ea4a588f57d13e7808dee11d2bbf9f54618572a19147173c559ce
fa2776137cbda7fb85aaa56be710f14e5d3d18e231756cfbe283a2938e7d6620
fc38767c5270e458fa2433d18b22354752e1d7173d7f0a21e4f4b13e0aae5b33