rebrandvideos.net - urlscan.io

Summary

This website contacted 3 IPs in 1 countries across 4 domains to perform 5 HTTP transactions. The main IP is 206.212.255.194, located in Mishawaka, United States and belongs to CUSTOMDOTNET - Colostore.com, US. The main domain is rebrandvideos.net.

This is the only time rebrandvideos.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DocuSign (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	67.231.154.66 67.231.154.66	22843 (PROOFPOIN...) (PROOFPOINT-ASN-US-EAST - Proofpoint)
1	206.212.255.194 206.212.255.194	12260 (CUSTOMDOTNET) (CUSTOMDOTNET - Colostore.com)
3	162.248.184.27 162.248.184.27	62856 (DOCUS-6-PROD) (DOCUS-6-PROD - Docusign)
1	162.248.186.53 162.248.186.53	62856 (DOCUS-6-PROD) (DOCUS-6-PROD - Docusign)
5	3

1 67.231.154.66 (Sunnyvale, United States) 1 redirects

ASN22843 (PROOFPOINT-ASN-US-EAST - Proofpoint, Inc., US)
PTR: urldefense.proofpoint.com

urldefense.proofpoint.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 206.212.255.194 (Mishawaka, United States)

ASN12260 (CUSTOMDOTNET - Colostore.com, US)
PTR: server.kwickhost.com

rebrandvideos.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 162.248.184.27 (United States)

ASN62856 (DOCUS-6-PROD - Docusign, Inc, US)
PTR: www.docusign.net

www.docusign.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.248.186.53 (United States)

ASN62856 (DOCUS-6-PROD - Docusign, Inc, US)

account.docusign.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	docusign.net www.docusign.net	14 KB
1	docusign.com account.docusign.com	4 KB
1	rebrandvideos.net rebrandvideos.net	14 KB
1	proofpoint.com 1 redirects urldefense.proofpoint.com	152 B
5	4

	Domain	Requested by
3	www.docusign.net	rebrandvideos.net
1	account.docusign.com	rebrandvideos.net
1	rebrandvideos.net
1	urldefense.proofpoint.com	1 redirects
5	4

This site contains links to these domains. Also see Links.

Domain
www.docusign.com
account.docusign.com
www.docusign.net

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://rebrandvideos.net/DocuSign.html
Frame ID: 7594A045C4913F8EB91FEF22B1306A9F
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://urldefense.proofpoint.com/v2/url?u=http-3A__rebrandvideos.net_DocuSign.html&d=DwMCaQ&c=zYkAlRKy_bjMaDZ... HTTP 302
http://rebrandvideos.net/DocuSign.html Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

5
Requests

0 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

3
IPs

1
Countries

33 kB
Transfer

31 kB
Size

0
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: http://www.docusign.com/

Search URL Search Domain Scan URL

URL: http://www.docusign.com/support
Title: Help

Search URL Search Domain Scan URL

URL: https://account.docusign.com/signup
Title: No account? Sign up for free

Search URL Search Domain Scan URL

URL: https://www.docusign.net/Member/JanrainDisplay.aspx

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://urldefense.proofpoint.com/v2/url?u=http-3A__rebrandvideos.net_DocuSign.html&d=DwMCaQ&c=zYkAlRKy_bjMaDZmctkbTQ&r=cg0W0gc8U1kRl5Aqf21vFstOoAuAewOP835bGFmHKoM&m=1KLbPC5f0Dp3tWxxfqS4ywMWbNYp3SlOXg7WQTDVNEU&s=Wl-hEsbYvUAVjcaQCXxLOVKuLxrF5N-yBLekCcjZkvc&e= HTTP 302
http://rebrandvideos.net/DocuSign.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request DocuSign.html Show response
rebrandvideos.net/
Redirect Chain

https://urldefense.proofpoint.com/v2/url?u=http-3A__rebrandvideos.net_DocuSign.html&d=DwMCaQ&c=zYkAlRKy_bjMaDZmctkbTQ&r=cg0W0gc8U1kRl5Aqf21vFstOoAuAewOP835bGFmHKoM&m=1KLbPC5f0Dp3tWxxfqS4ywMWbNYp3Sl...
http://rebrandvideos.net/DocuSign.html

14 KB
14 KB

224ms
112ms

Document
text/html

206.212.255.194
Colostore.com

General

Check archive.org

Show headers Download Go to

Full URL: http://rebrandvideos.net/DocuSign.html
Protocol: HTTP/1.1
Server: 206.212.255.194 Mishawaka, United States, ASN12260 (CUSTOMDOTNET - Colostore.com, US),
Reverse DNS: server.kwickhost.com
Software: Apache /
Resource Hash: 7f442038e7456785d07b814a57f982466a87eebac9eef37dd1f59e03e07a070e

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: rebrandvideos.net
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Cache-Control: no-cache
Connection: keep-alive
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Mon, 23 Apr 2018 14:48:25 GMT
Last-Modified: Mon, 26 Mar 2018 12:30:14 GMT
Server: Apache
Content-Type: text/html
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 14337

Redirect headers

Location: http://rebrandvideos.net/DocuSign.html
Date: Mon, 23 Apr 2018 14:48:24 GMT
Connection: keep-alive
Content-Length: 0

GET
H/1.1 200
OK docusign.png
www.docusign.net/Member/Images/ 7 KB
8 KB 649ms
161ms Image
image/png 162.248.184.27
Docusign

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.docusign.net/Member/Images/docusign.png

Requested by

Host: rebrandvideos.net
URL: http://rebrandvideos.net/DocuSign.html

Protocol

HTTP/1.1

Server

162.248.184.27 , United States, ASN62856 (DOCUS-6-PROD - Docusign, Inc, US),

Reverse DNS

www.docusign.net

Software

/

Resource Hash

fa2776137cbda7fb85aaa56be710f14e5d3d18e231756cfbe283a2938e7d6620

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: http://rebrandvideos.net/DocuSign.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Mon, 23 Apr 2018 14:48:24 GMT
Content-Type: image/png
Last-Modified: Thu, 15 Mar 2018 23:38:36 GMT
ETag: "026b6bcb6bcd31:0"
Strict-Transport-Security: max-age=31536000; includeSubDomains
p3p: CP="IDC DSP COR CURa ADMa OUR IND PHY ONL COM STA"
Accept-Ranges: bytes
X-DocuSign-Node: SE2FE67
Content-Length: 7635

GET
H/1.1 200
OK social_auth_providers.png
account.docusign.com/LoginAppNext/images/social/ 4 KB
4 KB 494ms
123ms Image
image/png 162.248.186.53
Docusign

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://account.docusign.com/LoginAppNext/images/social/social_auth_providers.png
Requested by: Host: rebrandvideos.net
URL: http://rebrandvideos.net/DocuSign.html
Protocol: HTTP/1.1
Server: 162.248.186.53 , United States, ASN62856 (DOCUS-6-PROD - Docusign, Inc, US),
Reverse DNS
Software: /
Resource Hash: fc38767c5270e458fa2433d18b22354752e1d7173d7f0a21e4f4b13e0aae5b33

Request headers

Referer: http://rebrandvideos.net/DocuSign.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Mon, 23 Apr 2018 14:48:24 GMT
ETag: "06a4288b6bcd31:0"
Last-Modified: Thu, 15 Mar 2018 23:37:08 GMT
Accept-Ranges: bytes
X-DocuSign-Node: DA1FE47
Content-Length: 4056
Content-Type: image/png

GET
H/1.1 200
OK powered_by_docusign_gray.png
www.docusign.net/Member/Images/ 3 KB
3 KB 649ms
162ms Image
image/png 162.248.184.27
Docusign

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.docusign.net/Member/Images/powered_by_docusign_gray.png

Requested by

Host: rebrandvideos.net
URL: http://rebrandvideos.net/DocuSign.html

Protocol

HTTP/1.1

Server

162.248.184.27 , United States, ASN62856 (DOCUS-6-PROD - Docusign, Inc, US),

Reverse DNS

www.docusign.net

Software

/

Resource Hash

4d48e45cf65adea52c6057d85dbcc34528b7829cb5f5b80565a1b5d24972bacc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: http://rebrandvideos.net/DocuSign.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Mon, 23 Apr 2018 14:48:24 GMT
Content-Type: image/png
Last-Modified: Thu, 15 Mar 2018 23:38:38 GMT
ETag: "053e7bdb6bcd31:0"
Strict-Transport-Security: max-age=31536000; includeSubDomains
p3p: CP="IDC DSP COR CURa ADMa OUR IND PHY ONL COM STA"
Accept-Ranges: bytes
X-DocuSign-Node: SE1FE56
Content-Length: 2709

GET
H/1.1 200
OK btn_arrow_u.png
www.docusign.net/Member/Images/controls/ 3 KB
3 KB 650ms
163ms Image
image/png 162.248.184.27
Docusign

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.docusign.net/Member/Images/controls/btn_arrow_u.png

Requested by

Host: rebrandvideos.net
URL: http://rebrandvideos.net/DocuSign.html

Protocol

HTTP/1.1

Server

162.248.184.27 , United States, ASN62856 (DOCUS-6-PROD - Docusign, Inc, US),

Reverse DNS

www.docusign.net

Software

/

Resource Hash

015a8b230071ba12f8d35bc401908c7fdf9a27af371c235e253db9cfc738f732

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: http://rebrandvideos.net/DocuSign.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Mon, 23 Apr 2018 14:48:25 GMT
Content-Type: image/png
Last-Modified: Thu, 15 Mar 2018 23:38:36 GMT
ETag: "026b6bcb6bcd31:0"
Strict-Transport-Security: max-age=31536000; includeSubDomains
p3p: CP="IDC DSP COR CURa ADMa OUR IND PHY ONL COM STA"
Accept-Ranges: bytes
X-DocuSign-Node: SE3FE20
Content-Length: 2952

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DocuSign (Online)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| count

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

account.docusign.com
rebrandvideos.net
urldefense.proofpoint.com
www.docusign.net
162.248.184.27
162.248.186.53
206.212.255.194
67.231.154.66
015a8b230071ba12f8d35bc401908c7fdf9a27af371c235e253db9cfc738f732
4d48e45cf65adea52c6057d85dbcc34528b7829cb5f5b80565a1b5d24972bacc
7f442038e7456785d07b814a57f982466a87eebac9eef37dd1f59e03e07a070e
fa2776137cbda7fb85aaa56be710f14e5d3d18e231756cfbe283a2938e7d6620
fc38767c5270e458fa2433d18b22354752e1d7173d7f0a21e4f4b13e0aae5b33

rebrandvideos.net Open in urlscan Pro 206.212.255.194 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

5 Requests

0 %HTTPS

0 %IPv6

4 Domains

4 Subdomains

3 IPs

1 Countries

33 kBTransfer

31 kBSize

0 Cookies

4 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

Indicators

rebrandvideos.net Open in urlscan Pro
206.212.255.194 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

0 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

3
IPs

1
Countries

33 kB
Transfer

31 kB
Size

0
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!