szephalom.top Open in urlscan Pro
2606:4700:30::681f:45c5 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://consukre.page.link/bSJU
Effective URL:
https://szephalom.top/blow/docusign/DocuSign/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_J...
Submission: On August 06 via manual (August 6th 2019, 2:12:37 pm UTC) from GB

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 11 HTTP transactions. The main IP is 2606:4700:30::681f:45c5, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is szephalom.top.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on August 5th 2019. Valid for: a year.

This is the only time szephalom.top was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DocuSign (Online) DHL (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2a00:1450:400... 2a00:1450:4001:821::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
2 12	2606:4700:30:... 2606:4700:30::681f:45c5	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	162.248.184.53 162.248.184.53	62856 (DOCUS-6-PROD) (DOCUS-6-PROD - Docusign)
11	2

1 2a00:1450:4001:821::200e (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)

consukre.page.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2606:4700:30::681f:45c5 (United States) 2 redirects

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

szephalom.top	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.248.184.53 (United States)

ASN62856 (DOCUS-6-PROD - Docusign, Inc, US)

account.docusign.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	szephalom.top 2 redirects szephalom.top	243 KB
1	docusign.com account.docusign.com	4 KB
1	page.link 1 redirects consukre.page.link	605 B
11	3

	Domain	Requested by
12	szephalom.top	2 redirects szephalom.top
1	account.docusign.com	szephalom.top
1	consukre.page.link	1 redirects
11	3

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2019-08-05` - `2020-08-04`	a year	crt.sh
account.docusign.com DigiCert SHA2 Extended Validation Server CA	`2018-03-26` - `2020-03-26`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://szephalom.top/blow/docusign/DocuSign/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto=
Frame ID: 0EDB0523CDDF48788DCDDB1C35C7D0DC
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://consukre.page.link/bSJU HTTP 302
https://szephalom.top/blow/docusign/DocuSign HTTP 301
http://szephalom.top/blow/docusign/DocuSign/ HTTP 301
https://szephalom.top/blow/docusign/DocuSign/ Page URL
https://szephalom.top/blow/docusign/DocuSign/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFU... Page URL

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^\/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

11
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

246 kB
Transfer

330 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://consukre.page.link/bSJU HTTP 302
https://szephalom.top/blow/docusign/DocuSign HTTP 301
http://szephalom.top/blow/docusign/DocuSign/ HTTP 301
https://szephalom.top/blow/docusign/DocuSign/ Page URL
https://szephalom.top/blow/docusign/DocuSign/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://consukre.page.link/bSJU HTTP 302
https://szephalom.top/blow/docusign/DocuSign HTTP 301
http://szephalom.top/blow/docusign/DocuSign/ HTTP 301
https://szephalom.top/blow/docusign/DocuSign/

11 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ Show response szephalom.top/blow/docusign/DocuSign/ Redirect Chain https://consukre.page.link/bSJU https://szephalom.top/blow/docusign/DocuSign http://szephalom.top/blow/docusign/DocuSign/ https://szephalom.top/blow/docusign/DocuSign/	536 B 301 B	211ms 211ms	Document text/html	2606:4700:30::681f:45c5 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://szephalom.top/blow/docusign/DocuSign/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681f:45c5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `85217b0249e6ddebf3554c59924d805e41b159f857fa5c0c622fef33956b2a3d` Request headers :method GET :authority szephalom.top :scheme https :path /blow/docusign/DocuSign/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-mode navigate sec-fetch-user ?1 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 sec-fetch-site none accept-encoding gzip, deflate, br cookie __cfduid=d1c520d5094f3773bd09445157e61fd2b1565100741 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Response headers status 200 date Tue, 06 Aug 2019 14:12:21 GMT content-type text/html; charset=UTF-8 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" server cloudflare cf-ray 50219af42a58dfc7-FRA content-encoding br Redirect headers Date Tue, 06 Aug 2019 14:12:21 GMT Transfer-Encoding chunked Connection keep-alive Cache-Control max-age=3600 Expires Tue, 06 Aug 2019 15:12:21 GMT Location https://szephalom.top/blow/docusign/DocuSign/ Vary Accept-Encoding Server cloudflare CF-RAY 50219af41de9c2ef-FRA
GET H2	200	hl.jpg szephalom.top/blow/docusign/DocuSign/img/	5 KB 5 KB	13ms 13ms	Image image/jpeg	2606:4700:30::681f:45c5 Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL https://szephalom.top/blow/docusign/DocuSign/img/hl.jpg Requested by Host: szephalom.top URL: https://szephalom.top/blow/docusign/DocuSign/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681f:45c5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `ee3cec3c33913424b8a94f2ba811277a4aaf0a8476d61653769c5d953ddeecbd` Request headers Sec-Fetch-Mode no-cors Referer https://szephalom.top/blow/docusign/DocuSign/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 06 Aug 2019 14:12:22 GMT cf-cache-status HIT last-modified Tue, 19 Dec 2017 03:35:04 GMT server cloudflare age 29 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/jpeg status 200 cache-control public, max-age=14400 accept-ranges bytes cf-ray 50219af58f49dfc7-FRA content-length 5352 expires Tue, 06 Aug 2019 18:12:22 GMT
GET H2	200	bar.gif szephalom.top/blow/docusign/DocuSign/img/	189 KB 189 KB	14ms 13ms	Image image/gif	2606:4700:30::681f:45c5 Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL https://szephalom.top/blow/docusign/DocuSign/img/bar.gif Requested by Host: szephalom.top URL: https://szephalom.top/blow/docusign/DocuSign/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681f:45c5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `84a75ad61d0404ae29810295acffc370e195b64227a5445c30613ea316bdafdc` Request headers Sec-Fetch-Mode no-cors Referer https://szephalom.top/blow/docusign/DocuSign/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 06 Aug 2019 14:12:22 GMT cf-cache-status HIT last-modified Thu, 21 Apr 2016 22:05:34 GMT server cloudflare age 29 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/gif status 200 cache-control public, max-age=14400 accept-ranges bytes cf-ray 50219af58f4adfc7-FRA content-length 193653 expires Tue, 06 Aug 2019 18:12:22 GMT
GET H2	200	Primary Request u.php Show response szephalom.top/blow/docusign/DocuSign/	5 KB 2 KB	210ms 210ms	Document text/html	2606:4700:30::681f:45c5 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://szephalom.top/blow/docusign/DocuSign/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681f:45c5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `0560e5be01afc3a8f4b417d7afecce0439627ff79e90e0e52bd538854e35b892` Request headers :method GET :authority szephalom.top :scheme https :path /blow/docusign/DocuSign/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto= pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-mode navigate accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 sec-fetch-site same-origin referer https://szephalom.top/blow/docusign/DocuSign/ accept-encoding gzip, deflate, br cookie __cfduid=d1c520d5094f3773bd09445157e61fd2b1565100741 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Mode navigate Referer https://szephalom.top/blow/docusign/DocuSign/ Response headers status 200 date Tue, 06 Aug 2019 14:12:24 GMT content-type text/html; charset=UTF-8 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" server cloudflare cf-ray 50219b022f0adfc7-FRA content-encoding br
GET H2	200	facebox.css szephalom.top/blow/docusign/DocuSign/	1 KB 472 B	213ms 208ms	Stylesheet text/css	2606:4700:30::681f:45c5 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://szephalom.top/blow/docusign/DocuSign/facebox.css Requested by Host: szephalom.top URL: https://szephalom.top/blow/docusign/DocuSign/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681f:45c5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `c614122e326d88fffd8495fc3ccbac314634f3c36ea1f003cd222288bf67686b` Request headers Sec-Fetch-Mode no-cors Referer https://szephalom.top/blow/docusign/DocuSign/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 06 Aug 2019 14:12:24 GMT content-encoding br cf-cache-status MISS last-modified Mon, 23 Jan 2017 07:42:12 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css status 200 cache-control public, max-age=14400 cf-ray 50219b039cecdfc7-FRA expires Tue, 06 Aug 2019 18:12:24 GMT
GET H2	200	jquery-1.6.2.min.js Show response szephalom.top/blow/docusign/DocuSign/javascript/	89 KB 30 KB	414ms 410ms	Script application/javascript	2606:4700:30::681f:45c5 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://szephalom.top/blow/docusign/DocuSign/javascript/jquery-1.6.2.min.js Requested by Host: szephalom.top URL: https://szephalom.top/blow/docusign/DocuSign/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681f:45c5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `d16d07a0353405fcec95f7efc50a2621bc7425f9a5e8895078396fb0dc460c4f` Request headers Sec-Fetch-Mode no-cors Referer https://szephalom.top/blow/docusign/DocuSign/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 06 Aug 2019 14:12:24 GMT content-encoding br cf-cache-status MISS last-modified Mon, 23 Jan 2017 00:49:36 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript status 200 cache-control public, max-age=14400 cf-ray 50219b039ceedfc7-FRA expires Tue, 06 Aug 2019 18:12:24 GMT
GET H2	200	facebox.js Show response szephalom.top/blow/docusign/DocuSign/javascript/facebox/src/	9 KB 3 KB	211ms 206ms	Script application/javascript	2606:4700:30::681f:45c5 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://szephalom.top/blow/docusign/DocuSign/javascript/facebox/src/facebox.js Requested by Host: szephalom.top URL: https://szephalom.top/blow/docusign/DocuSign/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681f:45c5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `fc1051ff8ece6493b643873b420df97c3cb5037337891450cad3051a9bba1754` Request headers Sec-Fetch-Mode no-cors Referer https://szephalom.top/blow/docusign/DocuSign/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 06 Aug 2019 14:12:24 GMT content-encoding br cf-cache-status MISS last-modified Mon, 23 Jan 2017 06:56:08 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript status 200 cache-control public, max-age=14400 cf-ray 50219b039cf0dfc7-FRA expires Tue, 06 Aug 2019 18:12:24 GMT
GET H2	200	jquery.watermark.js Show response szephalom.top/blow/docusign/DocuSign/javascript/watermark/	19 KB 6 KB	314ms 310ms	Script application/javascript	2606:4700:30::681f:45c5 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://szephalom.top/blow/docusign/DocuSign/javascript/watermark/jquery.watermark.js Requested by Host: szephalom.top URL: https://szephalom.top/blow/docusign/DocuSign/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681f:45c5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `016f9cfa001792db7ad2be1e1ea1424cea09f108f68e7efb1caf4c5e65ac1335` Request headers Sec-Fetch-Mode no-cors Referer https://szephalom.top/blow/docusign/DocuSign/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 06 Aug 2019 14:12:24 GMT content-encoding br cf-cache-status MISS last-modified Mon, 23 Jan 2017 00:49:36 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript status 200 cache-control public, max-age=14400 cf-ray 50219b039cf1dfc7-FRA expires Tue, 06 Aug 2019 18:12:24 GMT
GET H2	200	javascript1.js Show response szephalom.top/blow/docusign/DocuSign/	3 KB 907 B	214ms 211ms	Script application/javascript	2606:4700:30::681f:45c5 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://szephalom.top/blow/docusign/DocuSign/javascript1.js Requested by Host: szephalom.top URL: https://szephalom.top/blow/docusign/DocuSign/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681f:45c5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `9d57619bd1338db2ee3a7fb1dd7774b4e76e49113b21a07be33d70818433d869` Request headers Sec-Fetch-Mode no-cors Referer https://szephalom.top/blow/docusign/DocuSign/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 06 Aug 2019 14:12:24 GMT content-encoding br cf-cache-status MISS last-modified Thu, 26 Oct 2017 16:04:50 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript status 200 cache-control public, max-age=14400 cf-ray 50219b039cf2dfc7-FRA expires Tue, 06 Aug 2019 18:12:24 GMT
GET H2	200	hl.jpg szephalom.top/blow/docusign/DocuSign/img/	5 KB 5 KB	18ms 15ms	Image image/jpeg	2606:4700:30::681f:45c5 Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL https://szephalom.top/blow/docusign/DocuSign/img/hl.jpg Requested by Host: szephalom.top URL: https://szephalom.top/blow/docusign/DocuSign/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681f:45c5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `ee3cec3c33913424b8a94f2ba811277a4aaf0a8476d61653769c5d953ddeecbd` Request headers Sec-Fetch-Mode no-cors Referer https://szephalom.top/blow/docusign/DocuSign/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 06 Aug 2019 14:12:24 GMT cf-cache-status HIT last-modified Tue, 19 Dec 2017 03:35:04 GMT server cloudflare age 31 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/jpeg status 200 cache-control public, max-age=14400 accept-ranges bytes cf-ray 50219b039cf3dfc7-FRA content-length 5352 expires Tue, 06 Aug 2019 18:12:24 GMT
GET H/1.1	200 OK	social_auth_providers.png account.docusign.com/LoginAppNext/images/social/	4 KB 4 KB	7902ms 198ms	Image image/png	162.248.184.53 Docusign
General Check archive.org Show headers Download Go to Show image Full URL https://account.docusign.com/LoginAppNext/images/social/social_auth_providers.png Requested by Host: szephalom.top URL: https://szephalom.top/blow/docusign/DocuSign/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto= Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 162.248.184.53 , United States, ASN62856 (DOCUS-6-PROD - Docusign, Inc, US), Reverse DNS Software / Resource Hash `fc38767c5270e458fa2433d18b22354752e1d7173d7f0a21e4f4b13e0aae5b33` Request headers Sec-Fetch-Mode no-cors Referer https://szephalom.top/blow/docusign/DocuSign/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Tue, 06 Aug 2019 14:12:32 GMT ETag "0af9b519727d51:0" Last-Modified Thu, 20 Jun 2019 18:38:14 GMT Accept-Ranges bytes X-DocuSign-Node SE2FE100 Content-Length 4056 Content-Type image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DocuSign (Online) DHL (Transportation)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

account.docusign.com
consukre.page.link
szephalom.top
162.248.184.53
2606:4700:30::681f:45c5
2a00:1450:4001:821::200e
016f9cfa001792db7ad2be1e1ea1424cea09f108f68e7efb1caf4c5e65ac1335
0560e5be01afc3a8f4b417d7afecce0439627ff79e90e0e52bd538854e35b892
84a75ad61d0404ae29810295acffc370e195b64227a5445c30613ea316bdafdc
85217b0249e6ddebf3554c59924d805e41b159f857fa5c0c622fef33956b2a3d
9d57619bd1338db2ee3a7fb1dd7774b4e76e49113b21a07be33d70818433d869
c614122e326d88fffd8495fc3ccbac314634f3c36ea1f003cd222288bf67686b
d16d07a0353405fcec95f7efc50a2621bc7425f9a5e8895078396fb0dc460c4f
ee3cec3c33913424b8a94f2ba811277a4aaf0a8476d61653769c5d953ddeecbd
fc1051ff8ece6493b643873b420df97c3cb5037337891450cad3051a9bba1754
fc38767c5270e458fa2433d18b22354752e1d7173d7f0a21e4f4b13e0aae5b33

szephalom.top Open in urlscan Pro 2606:4700:30::681f:45c5 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

11 Requests

100 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

2 IPs

2 Countries

246 kBTransfer

330 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

11 JavaScript Global Variables

0 Cookies

Indicators

szephalom.top Open in urlscan Pro
2606:4700:30::681f:45c5 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

246 kB
Transfer

330 kB
Size

0
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!