user-sign-in.s3.us-east-005.backblazeb2.com Open in urlscan Pro
2605:72c0:6ff:b3::b005:1  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 8

• https://i.gyazo.com/c53edc4e1a0f348888311307324c0f89.pngquot;);%20background-repeat:%20no-repeat;%20background-size:%201280px%20640px; HTTP 302
• https://gyazo.com/c53edc4e1a0f348888311307324c0f89.pngquot;);%20background-repeat:%20no-repeat;%20background-size:%201280px%20640px;

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200	Primary Request DocuSign.html Show response user-sign-in.s3.us-east-005.backblazeb2.com/	198 KB 199 KB	270ms 196ms	Document text/html	2605:72c0:6ff:b3::b005:1 BACKBLAZE
General Check archive.org Show headers Download Go to Full URL https://user-sign-in.s3.us-east-005.backblazeb2.com/DocuSign.html Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2605:72c0:6ff:b3::b005:1 , United States, ASN40401 (BACKBLAZE, US), Reverse DNS Software nginx / Resource Hash 871091e6354754f6b58c426d94ef0d98d8737df109fa950f665107eac119d167 Security Headers Name Value Strict-Transport-Security max-age=63072000 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers Accept-Ranges bytes Connection keep-alive Content-Length 202920 Content-Type text/html Date Fri, 20 Dec 2024 07:55:32 GMT ETag "5d916d78eebd2f6ed8f0a7eafed9a6c9" Last-Modified Tue, 17 Dec 2024 16:28:00 GMT Server nginx Strict-Transport-Security max-age=63072000 x-amz-id-2 aYWBhR2adMSE5tGN3OERjZzj1MmNjBDko x-amz-meta-src_last_modified_millis 1734449133046 x-amz-request-id 30865c38ed3c66d6 x-amz-version-id 4_z3acaaf41290cb8bc98320c19_f113cbd75dc243e52_d20241217_m162800_c005_v0501025_t0011_u01734452880758
GET H3	200	bootstrap.min.css maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/	141 KB 22 KB	37ms 19ms	Stylesheet text/css	2606:4700::6812:acf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css Requested by Host: user-sign-in.s3.us-east-005.backblazeb2.com URL: https://user-sign-in.s3.us-east-005.backblazeb2.com/DocuSign.html Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://user-sign-in.s3.us-east-005.backblazeb2.com/ Response headers cdn-status 200 content-encoding br cf-cache-status HIT etag "450fc463b8b1a349df717056fbb3e078" age 2082109 x-content-type-options nosniff alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Fri, 20 Dec 2024 07:55:32 GMT last-modified Mon, 25 Jan 2021 22:04:04 GMT content-type text/css; charset=utf-8 vary Accept-Encoding cdn-cache HIT cdn-cachedat 11/04/2024 13:29:58 cdn-requestpullcode 200 priority u=0,i=?0 strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=31919000 cdn-requestpullsuccess True timing-allow-origin * cdn-requesttime 0 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid 7746f76a7d8055ab788636751a524d59 cross-origin-resource-policy cross-origin cdn-pullzone 252412 cdn-proxyver 1.06 cf-ray 8f4e1219ddb878d9-EWR access-control-allow-origin * cdn-edgestorageid 718 server cloudflare cdn-requestcountrycode US
GET H2	200	DocuSign_logo.png upload.wikimedia.org/wikipedia/commons/3/34/	17 KB 18 KB	64ms 25ms	Image image/png	2620:0:861:ed1a::2:b WIKIMEDIA
General Check archive.org Show headers Download Go to Show image Full URL https://upload.wikimedia.org/wikipedia/commons/3/34/DocuSign_logo.png Requested by Host: user-sign-in.s3.us-east-005.backblazeb2.com URL: https://user-sign-in.s3.us-east-005.backblazeb2.com/DocuSign.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2620:0:861:ed1a::2:b , United States, ASN14907 (WIKIMEDIA, US), Reverse DNS Software ATS/9.2.6 / Resource Hash 6621675a14e6f8c5b13cfbaf380df6b9a25c58c0fb2b494bf8e1607ad78a05e4 Security Headers Name Value Strict-Transport-Security max-age=106384710; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://user-sign-in.s3.us-east-005.backblazeb2.com/ Response headers access-control-expose-headers Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache etag ed0dc9d462a385e3b4209b06c4708219 age 13797 x-object-meta-sha1base36 tnsfnmre17vxs3sihbidna3zzvzfr7t report-to { "group": "wm_nel", "max_age": 604800, "endpoints": [{ "url": "https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error&schema_uri=/w3c/reportingapi/network_error/1.0.0" }] } x-content-type-options nosniff server-timing cache;desc="hit-front", host;desc="cp1103" x-cache cp1103 miss, cp1103 hit/59 date Fri, 20 Dec 2024 04:05:35 GMT content-type image/png last-modified Wed, 01 May 2019 01:34:08 GMT x-client-ip 2a0d:5600:24:1500:1012:85b7:9f6d:5069 x-cache-status hit-front strict-transport-security max-age=106384710; includeSubDomains; preload nel { "report_to": "wm_nel", "max_age": 604800, "failure_fraction": 0.05, "success_fraction": 0.0} timing-allow-origin * accept-ranges bytes access-control-allow-origin * content-length 17715 server ATS/9.2.6
GET H2	200	6eae75d87eebc05d2e882397e5ef8480.png i.gyazo.com/	18 KB 18 KB	62ms 33ms	Image image/png	2606:4700:4400::6812:20c5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://i.gyazo.com/6eae75d87eebc05d2e882397e5ef8480.png Requested by Host: user-sign-in.s3.us-east-005.backblazeb2.com URL: https://user-sign-in.s3.us-east-005.backblazeb2.com/DocuSign.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:20c5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 71e729939e175f4ae9d3fcc645d6b7389ec341a47a84950e047197331fdc22f1 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://user-sign-in.s3.us-east-005.backblazeb2.com/ Response headers cf-cache-status HIT etag "6eae" age 1127215 expires Sat, 20 Dec 2025 07:55:32 GMT date Fri, 20 Dec 2024 07:55:32 GMT content-type image/png vary Accept-Encoding cache-control public, max-age=31536000 x-cache-level ZS access-control-allow-credentials true via 1.1 google cf-ray 8f4e1219fe594414-EWR accept-ranges bytes access-control-allow-origin https://gyazo.com content-length 18147 server cloudflare
GET H2	200	6a6271e3e40ab27f2c950c82f50136df.png i.gyazo.com/	21 KB 21 KB	41ms 37ms	Image image/png	2606:4700:4400::6812:20c5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://i.gyazo.com/6a6271e3e40ab27f2c950c82f50136df.png Requested by Host: user-sign-in.s3.us-east-005.backblazeb2.com URL: https://user-sign-in.s3.us-east-005.backblazeb2.com/DocuSign.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:20c5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3a9b144d6482b78afc4e0a940a1d3c22240f14fa535b808cf4dab9635339569f Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://user-sign-in.s3.us-east-005.backblazeb2.com/ Response headers cf-cache-status HIT etag "6a62" age 2076237 expires Sat, 20 Dec 2025 07:55:32 GMT date Fri, 20 Dec 2024 07:55:32 GMT content-type image/png vary Accept-Encoding cache-control public, max-age=31536000 x-cache-level ZS access-control-allow-credentials true via 1.1 google cf-ray 8f4e1219fe5d4414-EWR accept-ranges bytes access-control-allow-origin https://gyazo.com content-length 21882 server cloudflare
GET H2	200	6696ea0b401cbe3fb90177b597c2c051.png i.gyazo.com/	11 KB 12 KB	39ms 36ms	Image image/png	2606:4700:4400::6812:20c5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://i.gyazo.com/6696ea0b401cbe3fb90177b597c2c051.png Requested by Host: user-sign-in.s3.us-east-005.backblazeb2.com URL: https://user-sign-in.s3.us-east-005.backblazeb2.com/DocuSign.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:20c5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ddf5887ce15778102013d5527ec1fd09bc400fa19b91416b36b828ecdbd76ca8 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://user-sign-in.s3.us-east-005.backblazeb2.com/ Response headers cf-cache-status HIT etag "6696" age 1733246 expires Sat, 20 Dec 2025 07:55:32 GMT date Fri, 20 Dec 2024 07:55:32 GMT content-type image/png vary Accept-Encoding cache-control public, max-age=31536000 x-cache-level ZS access-control-allow-credentials true via 1.1 google cf-ray 8f4e1219fe604414-EWR accept-ranges bytes access-control-allow-origin https://gyazo.com content-length 11741 server cloudflare
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/2.2.4/	84 KB 30 KB	203ms 23ms	Script text/javascript	2607:f8b0:400d:c0c::5f GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js Requested by Host: user-sign-in.s3.us-east-005.backblazeb2.com URL: https://user-sign-in.s3.us-east-005.backblazeb2.com/DocuSign.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:400d:c0c::5f Morganton, United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://user-sign-in.s3.us-east-005.backblazeb2.com/ Response headers content-encoding gzip age 273871 report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} x-content-type-options nosniff expires Wed, 17 Dec 2025 03:51:01 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 17 Dec 2024 03:51:01 GMT last-modified Tue, 03 Mar 2020 19:15:00 GMT content-type text/javascript; charset=UTF-8 vary Accept-Encoding cache-control public, max-age=31536000, stale-while-revalidate=2592000 timing-allow-origin * cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" cross-origin-resource-policy cross-origin content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers accept-ranges bytes access-control-allow-origin * content-length 30028 x-xss-protection 0 server sffe
GET H3	200	bootstrap.min.js Show response stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/	50 KB 15 KB	21ms 19ms	Script application/javascript	2606:4700::6812:acf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js Requested by Host: user-sign-in.s3.us-east-005.backblazeb2.com URL: https://user-sign-in.s3.us-east-005.backblazeb2.com/DocuSign.html Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://user-sign-in.s3.us-east-005.backblazeb2.com/ Response headers cdn-status 200 content-encoding br cf-cache-status HIT etag "67176c242e1bdc20603c878dee836df3" age 2064937 x-content-type-options nosniff alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Fri, 20 Dec 2024 07:55:32 GMT last-modified Mon, 25 Jan 2021 22:04:06 GMT content-type application/javascript; charset=utf-8 vary Accept-Encoding cdn-cache HIT cdn-cachedat 10/04/2024 02:53:43 cdn-requestpullcode 200 priority u=2,i=?0 strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=31919000 cdn-requestpullsuccess True timing-allow-origin * cdn-requesttime 1 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid c6c8a086d090f1d2baac8a7b0c894894 cross-origin-resource-policy cross-origin cdn-pullzone 252412 cdn-proxyver 1.04 cf-ray 8f4e1219fdbc78d9-EWR access-control-allow-origin * cdn-edgestorageid 1029 server cloudflare cdn-requestcountrycode US
GET H2	200	jquery.session.min.js Show response cdn.jsdelivr.net/npm/jquery.session@1.0.0/	2 KB 1 KB	189ms 10ms	Script application/javascript	2a04:4e42:400::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/jquery.session@1.0.0/jquery.session.min.js Requested by Host: user-sign-in.s3.us-east-005.backblazeb2.com URL: https://user-sign-in.s3.us-east-005.backblazeb2.com/DocuSign.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:400::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 35e38c13207686ff7836fb1a81e55beffc957037981ca72e663973ba300616af Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://user-sign-in.s3.us-east-005.backblazeb2.com/ Response headers access-control-expose-headers * content-encoding br etag W/"918-S/odanAfLcjzS/u1I3yXinmRccA" age 2074953 x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT, HIT date Fri, 20 Dec 2024 07:55:32 GMT content-type application/javascript; charset=utf-8 x-served-by cache-fra-eddf8230025-FRA, cache-lga21954-LGA vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=31536000, s-maxage=31536000, immutable timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 834 x-jsd-version 1.0.0
GET		c53edc4e1a0f348888311307324c0f89.pngquot;);%20background-repeat:%20no-repeat;%20background-size:%201280px%20640px; gyazo.com/ Redirect Chain https://i.gyazo.com/c53edc4e1a0f348888311307324c0f89.pngquot;);%20background-repeat:%20no-repeat;%20background-size:%201280px%20640px; https://gyazo.com/c53edc4e1a0f348888311307324c0f89.pngquot;);%20background-repeat:%20no-repeat;%20background-size:%201280px%20640px;	0 0
GET H2	200	favicon.ico www.docusign.com/themes/custom/cubic/	9 KB 10 KB	553ms 18ms	Other image/vnd.microsoft.icon	2600:1f18:16e:df02::1f4 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://www.docusign.com/themes/custom/cubic/favicon.ico Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1f18:16e:df02::1f4 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Netlify / Resource Hash c5835e96f0a912584cd74f41486c326f88220ed02fbecbe71847c62b7f7e78d1 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://user-sign-in.s3.us-east-005.backblazeb2.com/ Response headers strict-transport-security max-age=31536000 cache-control public,max-age=0,must-revalidate etag "4dce04a410c373d8bf48b0591175c245-ssl" age 25678 accept-ranges bytes content-length 9662 x-nf-request-id 01JFHH13TWZR2ZP02FV9SKXG5A cache-status "Netlify Edge"; hit date Fri, 20 Dec 2024 07:55:33 GMT content-type image/vnd.microsoft.icon server Netlify

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

gyazo.com

URL

https://gyazo.com/c53edc4e1a0f348888311307324c0f89.pngquot;);%20background-repeat:%20no-repeat;%20background-size:%201280px%20640px;

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: OneDrive (Online) Generic (Online)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery object| bootstrap function| activater function| _0x3552 function| _0x5eae function| _0x5eeba8

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			i.gyazo.com/	1970-01-21 11:27:21	Name: Gyazo_cfwoker Value: i
			user-sign-in.s3.us-east-005.backblazeb2.com/	1970-01-21 01:51:21	Name: __session:0.6071890274899363: Value: https:

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://user-sign-in.s3.us-east-005.backblazeb2.com/DocuSign.html Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=63072000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cdn.jsdelivr.net
gyazo.com
i.gyazo.com
maxcdn.bootstrapcdn.com
stackpath.bootstrapcdn.com
upload.wikimedia.org
user-sign-in.s3.us-east-005.backblazeb2.com
www.docusign.com
gyazo.com
2600:1f18:16e:df02::1f4
2605:72c0:6ff:b3::b005:1
2606:4700:4400::6812:20c5
2606:4700::6812:acf
2607:f8b0:400d:c0c::5f
2620:0:861:ed1a::2:b
2a04:4e42:400::485
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d
35e38c13207686ff7836fb1a81e55beffc957037981ca72e663973ba300616af
3a9b144d6482b78afc4e0a940a1d3c22240f14fa535b808cf4dab9635339569f
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
6621675a14e6f8c5b13cfbaf380df6b9a25c58c0fb2b494bf8e1607ad78a05e4
71e729939e175f4ae9d3fcc645d6b7389ec341a47a84950e047197331fdc22f1
871091e6354754f6b58c426d94ef0d98d8737df109fa950f665107eac119d167
c5835e96f0a912584cd74f41486c326f88220ed02fbecbe71847c62b7f7e78d1
ddf5887ce15778102013d5527ec1fd09bc400fa19b91416b36b828ecdbd76ca8