thesignatureselection.com
Open in
urlscan Pro
95.216.180.140
Malicious Activity!
Public Scan
Effective URL: https://thesignatureselection.com/netflixx/docusign.php
Submission: On May 28 via automatic, source openphish
Summary
TLS certificate: Issued by R3 on March 28th 2021. Valid for: 3 months.
This is the only time thesignatureselection.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: DocuSign (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
10 | 95.216.180.140 95.216.180.140 | 24940 (HETZNER-AS) (HETZNER-AS) | |
7 | 162.248.184.27 162.248.184.27 | 62856 (DOCUS-6-PROD) (DOCUS-6-PROD) | |
1 | 2a01:4f9:2a:f... 2a01:4f9:2a:f67::2 | 24940 (HETZNER-AS) (HETZNER-AS) | |
1 | 185.81.2.175 185.81.2.175 | 52030 (SERVERPLA...) (SERVERPLAN-AS) | |
1 | 128.8.127.4 128.8.127.4 | 27 (UMDNET) (UMDNET) | |
1 | 148.251.128.74 148.251.128.74 | 24940 (HETZNER-AS) (HETZNER-AS) | |
1 | 2a00:1450:400... 2a00:1450:4001:82a::2001 | 15169 (GOOGLE) (GOOGLE) | |
1 | 173.236.199.81 173.236.199.81 | 26347 (DREAMHOST-AS) (DREAMHOST-AS) | |
24 | 9 |
ASN24940 (HETZNER-AS, DE)
PTR: static.140.180.216.95.clients.your-server.de
thesignatureselection.com |
ASN24940 (HETZNER-AS, DE)
PTR: static.74.128.251.148.clients.your-server.de
cdn.redmondpie.com |
ASN26347 (DREAMHOST-AS, US)
PTR: techdissected.com
techdissected.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
thesignatureselection.com
thesignatureselection.com |
12 KB |
7 |
docusign.net
www.docusign.net |
53 KB |
1 |
techdissected.com
techdissected.com |
48 KB |
1 |
blogspot.com
3.bp.blogspot.com |
155 KB |
1 |
redmondpie.com
cdn.redmondpie.com |
26 KB |
1 |
umd.edu
www.cs.umd.edu |
26 KB |
1 |
mysocialweb.it
www.mysocialweb.it |
36 KB |
1 |
freeiconspng.com
www.freeiconspng.com |
12 KB |
0 |
akamaihd.net
Failed
docucdn-a.akamaihd.net Failed |
|
24 | 9 |
Domain | Requested by | |
---|---|---|
10 | thesignatureselection.com |
thesignatureselection.com
|
7 | www.docusign.net |
thesignatureselection.com
|
1 | techdissected.com |
thesignatureselection.com
|
1 | 3.bp.blogspot.com |
thesignatureselection.com
|
1 | cdn.redmondpie.com |
thesignatureselection.com
|
1 | www.cs.umd.edu |
thesignatureselection.com
|
1 | www.mysocialweb.it |
thesignatureselection.com
|
1 | www.freeiconspng.com |
thesignatureselection.com
|
0 | docucdn-a.akamaihd.net Failed |
thesignatureselection.com
|
24 | 9 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.docusign.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.thesignatureselection.com R3 |
2021-03-28 - 2021-06-26 |
3 months | crt.sh |
www.docusign.net DigiCert SHA2 Extended Validation Server CA |
2019-03-28 - 2021-06-22 |
2 years | crt.sh |
www.freeiconspng.com Sectigo RSA Domain Validation Secure Server CA |
2019-12-24 - 2021-12-23 |
2 years | crt.sh |
*.mysocialweb.it R3 |
2021-05-07 - 2021-08-05 |
3 months | crt.sh |
*.cs.umd.edu DigiCert SHA2 High Assurance Server CA |
2020-07-16 - 2022-10-19 |
2 years | crt.sh |
www.redmondpie.com R3 |
2021-04-19 - 2021-07-18 |
3 months | crt.sh |
misc-sni.blogspot.com GTS CA 1C3 |
2021-05-03 - 2021-07-26 |
3 months | crt.sh |
www.techdissected.com R3 |
2021-05-03 - 2021-08-01 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://thesignatureselection.com/netflixx/docusign.php
Frame ID: BAABB937CAF6C54F9F2E9B2E12580478
Requests: 24 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- https://thesignatureselection.com/netflixx/gg.php Page URL
- https://thesignatureselection.com/netflixx/docusign.php Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- url /\.php(?:$|\?)/i
Apache (Web Servers) Expand
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
Title:
Search URL Search Domain Scan URL
Title: Help
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://thesignatureselection.com/netflixx/gg.php Page URL
- https://thesignatureselection.com/netflixx/docusign.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
24 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
gg.php
thesignatureselection.com/netflixx/ |
922 B 822 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
docusign.php
thesignatureselection.com/netflixx/ |
66 KB 11 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
XmlHttp.js
www.docusign.net/Member/script/ |
14 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-1.10.2.min.js
www.docusign.net/Member/client_scripts/JQuery/ |
91 KB 33 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Framework.css
www.docusign.net/Member/StyleSheets/ |
5 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
activate.css
www.docusign.net/Member/StyleSheets/ |
6 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
SpryValidationTextField.css
thesignatureselection.com/netflixx/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
SpryValidationPassword.css
thesignatureselection.com/netflixx/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
SpryValidationTextField.js
thesignatureselection.com/netflixx/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
SpryValidationPassword.js
thesignatureselection.com/netflixx/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
docusign.png
www.docusign.net/Member/Images/ |
7 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
office-365-icon-0.png
www.freeiconspng.com/uploads/ |
12 KB 12 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
google-plus.jpg
www.mysocialweb.it/wp-content/uploads/2014/06/ |
36 KB 36 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
AOL_Canv_Logo_1C_Eraser_Rd_RGB.png
www.cs.umd.edu/sites/default/files/images/article/2013/ |
25 KB 26 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Yahoo-Mail-logo.png
cdn.redmondpie.com/wp-content/uploads/2012/12/ |
26 KB 26 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
email_logo1.jpg
3.bp.blogspot.com/-duofJJAoExA/UPArku9h5lI/AAAAAAAAC-k/58QYJjxpwGY/s1600/ |
155 KB 155 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Google-Plus-Gmail-Logo.jpg
techdissected.com/wp-content/uploads/2014/09/ |
48 KB 48 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
powered_by_docusign_gray.png
www.docusign.net/Member/Images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
btn_arrow_u.png
www.docusign.net/Member/Images/controls/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
font-faces.css
docucdn-a.akamaihd.net/signing/1.9.0/css/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
SpryValidationTextField.css
thesignatureselection.com/netflixx/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
SpryValidationPassword.css
thesignatureselection.com/netflixx/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
SpryValidationTextField.js
thesignatureselection.com/netflixx/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
SpryValidationPassword.js
thesignatureselection.com/netflixx/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- docucdn-a.akamaihd.net
- URL
- http://docucdn-a.akamaihd.net/signing/1.9.0/css/font-faces.css
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: DocuSign (Online)50 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated number| XmlLoaderCount function| XmlLoader function| IEXmlLoader function| MoXmlLoader number| currBrowserVer undefined| ua undefined| re function| XmlWrapper function| XmlWrapperFromXml function| IEXmlWrapper function| IEXmlWrapperFromXml function| MOXmlWrapper function| intro function| MOXmlWrapperFromXml function| WindowTracer function| SpanTracer function| GetURLTimeStamp function| xDom function| SingleNode function| SingleNodeT function| xSelectNodes function| $ function| jQuery function| linkClick_TermsOfUse function| linkClick_CorporateSupport function| linkClick_Feedback function| linkClick_IntellectualProp function| linkClick_PrivacyPolicy object| microsoftmodal object| googlemodal object| aolmodal object| yahoomodal object| othersmodal object| microsoftbtn object| googlebtn object| aolbtn object| yahoobtn object| othersbtn object| span0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
3.bp.blogspot.com
cdn.redmondpie.com
docucdn-a.akamaihd.net
techdissected.com
thesignatureselection.com
www.cs.umd.edu
www.docusign.net
www.freeiconspng.com
www.mysocialweb.it
docucdn-a.akamaihd.net
128.8.127.4
148.251.128.74
162.248.184.27
173.236.199.81
185.81.2.175
2a00:1450:4001:82a::2001
2a01:4f9:2a:f67::2
95.216.180.140
121062cdebb2a08cd0d9479312c2d00e25a2cf29e11df3255b759f8fc5f3c711
297c481456fc892a7f135a90f88f26526e7d8f27ef1574e2bbdab0122dc7cbfa
29c9e8752f25b17961e3c6ff72de34b1f1a157dfc5fabb68bd148b8ec9002b17
2a5179b8851c8e3dfc77d7dcb33b3963afa037608336d6ae412acaa38ad59d22
2eb40a7d518cdfe05ae3213d20d7e5ebf01fa89e5f6a6acdc8a0b43ac3124726
316edc0bf34bd527c50793eb5c134ad5582060f7743ae28b6ee2c07ac391de93
3b3fb0cc946ed491878cae412ce720003c0003f65bedda6cf95272d4583cc0a6
3f6ec3e063e2c2b238ebd0235bb56d907b522e3462fac1557525c15573129dea
550415499b194c59de9198723df63a081df183f7015fff09ccba71225ec6fa40
5ca72332bf1702655bb8fd7563fcfdaae5b12f4a83ef72718c76520c4cdf72bb
641b60bb1ff542b1408102c34baf616bdf2b4b12a81a18ca97f54a18c2ef7aac
74b3cebefe33972100824e9d9516b29924d415c0423a7a2ea90cdeb965e325a1
9eb1faad15e34553547ec03e994d99b4acc531b8ac58f4e4cfbe7419c38e24e1
df1ae260f0cd081294b24fc2386405ba09c9480367ac0e7d7062f88ef4104f1d
fa2776137cbda7fb85aaa56be710f14e5d3d18e231756cfbe283a2938e7d6620