docusign.cruisingodyssey.org

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 5 HTTP transactions. The main IP is 2606:4700:3037::6815:414c, located in United States and belongs to CLOUDFLARENET, US. The main domain is docusign.cruisingodyssey.org.
TLS certificate: Issued by GTS CA 1P5 on May 12th 2023. Valid for: 3 months.

This is the only time docusign.cruisingodyssey.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DocuSign (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	2606:4700:303... 2606:4700:3032::6815:2070	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700:303... 2606:4700:3037::6815:414c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	193.108.153.29 193.108.153.29	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
5	4

1 2606:4700:3032::6815:2070 (United States)

ASN13335 (CLOUDFLARENET, US)

idt-biologika.nemountainsports.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:3037::6815:414c (United States)

ASN13335 (CLOUDFLARENET, US)

docusign.cruisingodyssey.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 193.108.153.29 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a193-108-153-29.deploy.static.akamaitechnologies.com

docucdn-a.akamaihd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	cruisingodyssey.org docusign.cruisingodyssey.org Failed	5 KB
1	akamaihd.net docucdn-a.akamaihd.net — Cisco Umbrella Rank: 8975	3 KB
1	nemountainsports.com idt-biologika.nemountainsports.com	2 KB
5	3

	Domain	Requested by
2	docusign.cruisingodyssey.org	idt-biologika.nemountainsports.com docusign.cruisingodyssey.org
1	docucdn-a.akamaihd.net	docusign.cruisingodyssey.org
1	idt-biologika.nemountainsports.com
5	3

This site contains no links.

Subject Issuer	Validity	Valid
nemountainsports.com GTS CA 1P5	`2023-05-12` - `2023-08-10`	3 months	crt.sh
cruisingodyssey.org GTS CA 1P5	`2023-05-12` - `2023-08-10`	3 months	crt.sh
a248.e.akamai.net DigiCert TLS RSA SHA256 2020 CA1	`2022-06-28` - `2023-06-30`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://docusign.cruisingodyssey.org/.docc./?0=karsten.poenitzsch@idt-biologika.de
Frame ID: 2B0FEF91C4A7C87C3DE1134D0904E338
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://idt-biologika.nemountainsports.com/.1./ Page URL
https://docusign.cruisingodyssey.org/.docc./?0=karsten.poenitzsch@idt-biologika.de Page URL

Page Statistics

5
Requests

80 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

11 kB
Transfer

24 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://idt-biologika.nemountainsports.com/.1./ Page URL
https://docusign.cruisingodyssey.org/.docc./?0=karsten.poenitzsch@idt-biologika.de Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 /
idt-biologika.nemountainsports.com/.1./ 7 KB
2 KB 252ms
203ms Document
text/html 2606:4700:3032::6815:2070
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://idt-biologika.nemountainsports.com/.1./
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::6815:2070 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7c8c2b138dd5bbb9-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Wed, 17 May 2023 13:22:16 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Rs5ZgRKHj0FIZhXhG9SZu3iPh5YX%2FCAX4xK%2F1vVarnkQ1pz886YimVYgHDturi4dgQWm14owWCpWLZ0OU2AD%2FsBKTj51XJm1yglAM0oAffezxuSD%2BQq%2FiRApK5A%2FHT5%2BGmAajFeeFPkCRMn1FfQYPIdOuOp718npAJNqumsiliI%2F"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET /
docusign.cruisingodyssey.org/.docc./ 0
0

GET
H2 200 Primary Request / Show response
docusign.cruisingodyssey.org/.docc./ 13 KB
4 KB 251ms
203ms Document
text/html 2606:4700:3037::6815:414c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://docusign.cruisingodyssey.org/.docc./?0=karsten.poenitzsch@idt-biologika.de
Requested by: Host: idt-biologika.nemountainsports.com
URL: https://idt-biologika.nemountainsports.com/.1./
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::6815:414c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.33
Resource Hash: 01225f1b245116c504baf88459c7c74f4655e52a646f1f3482706b61b3e29950

Request headers

Referer: https://idt-biologika.nemountainsports.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7c8c2b154fd68ff4-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Wed, 17 May 2023 13:22:16 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2F2o6AwYlhXJc7bt%2BfLaK5EbZYdcI5IERX47S%2BU9EvZp4LQmqxIZu%2BRsVSwZBGW7oMNFfy2PUlMmkgtVmi4ZXzyeUx2TrINqww9XH1IcVm5nQRQ1RE2gYRiFrKO3B39oKhyKo3uN8iJm9ubBiMBbYLqcoWkmpcfvJfPZy"}],"group":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: PHP/7.4.33

GET
H2 200 logo-docusign-sans-black.png
docucdn-a.akamaihd.net/olive/images/2.34.0/ 3 KB
3 KB 371ms
13ms Image
image/png 193.108.153.29
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://docucdn-a.akamaihd.net/olive/images/2.34.0/logo-docusign-sans-black.png

Requested by

Host: docusign.cruisingodyssey.org
URL: https://docusign.cruisingodyssey.org/.docc./?0=karsten.poenitzsch@idt-biologika.de

Protocol

H2

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

193.108.153.29 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a193-108-153-29.deploy.static.akamaitechnologies.com

Software

AkamaiNetStorage /

Resource Hash

7d011d48a833994c3c7bc4b8efa0463c03f8de419f34a13dc118b6ad45bf90f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://docusign.cruisingodyssey.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 17 May 2023 13:22:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 27 May 2021 18:55:44 GMT
server: AkamaiNetStorage
etag: "0452113b4de5d55674a7fa601094932e:1622651533.755214"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=3628800
accept-ranges: bytes
content-length: 3146

GET
H2 200 email-decode.min.js Show response
docusign.cruisingodyssey.org/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
1 KB 13ms
12ms Script
application/javascript 2606:4700:3037::6815:414c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://docusign.cruisingodyssey.org/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: docusign.cruisingodyssey.org
URL: https://docusign.cruisingodyssey.org/.docc./?0=karsten.poenitzsch@idt-biologika.de

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3037::6815:414c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://docusign.cruisingodyssey.org/.docc./?0=karsten.poenitzsch@idt-biologika.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 17 May 2023 13:22:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 12 May 2023 14:04:08 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"645e4758-4d7"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HTlzP5sHYHBlMUr9voIIW8Uy%2BwXn4rVx4ShWntwymdJuFPy%2BVMZiFAGVhvsmeiiwjk8TR1akEO6nIhUEBgfgfGWTZ3cF3OmeGEtjWoXB8PRFhbenrBkmFKsfJk1lvtuLrBNA67pAa5B8QURi5SSjsBXmVZbbgp3IDe2E"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-frame-options: DENY
cache-control: max-age=172800, public
cf-ray: 7c8c2b16997d8ff4-FRA
expires: Fri, 19 May 2023 13:22:16 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: docusign.cruisingodyssey.org
URL: https://docusign.cruisingodyssey.org/.docc./?0=karsten.poenitzsch@idt-biologika.de

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DocuSign (Online)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

docucdn-a.akamaihd.net
docusign.cruisingodyssey.org
idt-biologika.nemountainsports.com
docusign.cruisingodyssey.org
193.108.153.29
2606:4700:3032::6815:2070
2606:4700:3037::6815:414c
01225f1b245116c504baf88459c7c74f4655e52a646f1f3482706b61b3e29950
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
7d011d48a833994c3c7bc4b8efa0463c03f8de419f34a13dc118b6ad45bf90f8

docusign.cruisingodyssey.org Open in urlscan Pro 2606:4700:3037::6815:414c Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

5 Requests

80 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

4 IPs

2 Countries

11 kBTransfer

24 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

Indicators

docusign.cruisingodyssey.org Open in urlscan Pro
2606:4700:3037::6815:414c Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

80 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

11 kB
Transfer

24 kB
Size

0
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!