sappd.org.sa Open in urlscan Pro
162.214.4.99 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://sappd.org.sa/docusign/284ca08a6962d79ee2a058e361bfb6e1/al.html
Submission: On February 08 via manual (February 8th 2022, 6:31:51 pm UTC) from US — Scanned from DE

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 10 HTTP transactions. The main IP is 162.214.4.99, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is sappd.org.sa.
TLS certificate: Issued by cPanel, Inc. Certification Authority on February 6th 2022. Valid for: 3 months.

This is the only time sappd.org.sa was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: AOL (Online)

Domain & IP information

	IP Address		AS Autonomous System
10	162.214.4.99 162.214.4.99		46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
10	1

10 162.214.4.99 (United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: cp117.hawsabah.com.sa

sappd.org.sa	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	sappd.org.sa sappd.org.sa	43 KB
10	1

	Domain	Requested by
10	sappd.org.sa	sappd.org.sa
10	1

This site contains no links.

Subject Issuer	Validity	Valid
sappd.org.sa cPanel, Inc. Certification Authority	`2022-02-06` - `2022-05-07`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://sappd.org.sa/docusign/284ca08a6962d79ee2a058e361bfb6e1/al.html
Frame ID: 73CA0410A4AEB904673564531D9A9BD9
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign in

Detected technologies

Pure CSS (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]+(?:([\d.])+/)?pure(?:-min)?\.css

Page Statistics

10
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

43 kB
Transfer

40 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request al.html Show response sappd.org.sa/docusign/284ca08a6962d79ee2a058e361bfb6e1/	3 KB 3 KB	1329ms 585ms	Document text/html	162.214.4.99 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://sappd.org.sa/docusign/284ca08a6962d79ee2a058e361bfb6e1/al.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.214.4.99 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS cp117.hawsabah.com.sa Software Apache / Resource Hash `512622094168eda5bb13cc50ec8a1d0e12a43208d22756a942083db1f230f8bd` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers Date Tue, 08 Feb 2022 18:31:46 GMT Server Apache Last-Modified Tue, 11 Jan 2022 15:32:47 GMT Accept-Ranges bytes Content-Length 2810 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html
GET H/1.1	200 OK	pure-min.css sappd.org.sa/docusign/284ca08a6962d79ee2a058e361bfb6e1/	17 KB 17 KB	161ms 161ms	Stylesheet text/css	162.214.4.99 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://sappd.org.sa/docusign/284ca08a6962d79ee2a058e361bfb6e1/pure-min.css Requested by Host: sappd.org.sa URL: https://sappd.org.sa/docusign/284ca08a6962d79ee2a058e361bfb6e1/al.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.214.4.99 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS cp117.hawsabah.com.sa Software Apache / Resource Hash `255d6dfae2b0ab59f97774b8fe2a2c037e8550571af5299150cf8175ed71bac9` Request headers Accept-Language de-DE,de;q=0.9 Referer https://sappd.org.sa/docusign/284ca08a6962d79ee2a058e361bfb6e1/al.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Tue, 08 Feb 2022 18:31:46 GMT Last-Modified Tue, 11 Jan 2022 15:32:47 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 17296
GET H/1.1	200 OK	header.png sappd.org.sa/docusign/284ca08a6962d79ee2a058e361bfb6e1/images/	1 KB 1 KB	319ms 319ms	Image image/png	162.214.4.99 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL https://sappd.org.sa/docusign/284ca08a6962d79ee2a058e361bfb6e1/images/header.png Requested by Host: sappd.org.sa URL: https://sappd.org.sa/docusign/284ca08a6962d79ee2a058e361bfb6e1/al.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.214.4.99 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS cp117.hawsabah.com.sa Software Apache / Resource Hash `d71c520298a4b0c66f052d452cb65992646249a678170937faa2ee9586d7797c` Request headers Accept-Language de-DE,de;q=0.9 Referer https://sappd.org.sa/docusign/284ca08a6962d79ee2a058e361bfb6e1/al.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Tue, 08 Feb 2022 18:31:46 GMT Last-Modified Tue, 11 Jan 2022 15:32:47 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 1162
GET H/1.1	200 OK	pnel.png sappd.org.sa/docusign/284ca08a6962d79ee2a058e361bfb6e1/images/	8 KB 8 KB	480ms 161ms	Image image/png	162.214.4.99 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL https://sappd.org.sa/docusign/284ca08a6962d79ee2a058e361bfb6e1/images/pnel.png Requested by Host: sappd.org.sa URL: https://sappd.org.sa/docusign/284ca08a6962d79ee2a058e361bfb6e1/al.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.214.4.99 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS cp117.hawsabah.com.sa Software Apache / Resource Hash `b3681ae4ba23ab0c56c679cf3c79300795da909ecc0758624c77e6ec6ea61b17` Request headers Accept-Language de-DE,de;q=0.9 Referer https://sappd.org.sa/docusign/284ca08a6962d79ee2a058e361bfb6e1/al.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Tue, 08 Feb 2022 18:31:47 GMT Last-Modified Tue, 11 Jan 2022 15:32:47 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 8201
GET H/1.1	200 OK	ggg.png sappd.org.sa/docusign/284ca08a6962d79ee2a058e361bfb6e1/images/	2 KB 3 KB	480ms 160ms	Image image/png	162.214.4.99 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL https://sappd.org.sa/docusign/284ca08a6962d79ee2a058e361bfb6e1/images/ggg.png Requested by Host: sappd.org.sa URL: https://sappd.org.sa/docusign/284ca08a6962d79ee2a058e361bfb6e1/al.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.214.4.99 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS cp117.hawsabah.com.sa Software Apache / Resource Hash `5fc3d4ea02c1a7b2b94eeed06c860513508396144dca7d0b8bd6c5ce33214eee` Request headers Accept-Language de-DE,de;q=0.9 Referer https://sappd.org.sa/docusign/284ca08a6962d79ee2a058e361bfb6e1/al.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Tue, 08 Feb 2022 18:31:47 GMT Last-Modified Tue, 11 Jan 2022 15:32:47 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 2359
GET H/1.1	200 OK	ooooo.png sappd.org.sa/docusign/284ca08a6962d79ee2a058e361bfb6e1/images/	3 KB 3 KB	481ms 161ms	Image image/png	162.214.4.99 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL https://sappd.org.sa/docusign/284ca08a6962d79ee2a058e361bfb6e1/images/ooooo.png Requested by Host: sappd.org.sa URL: https://sappd.org.sa/docusign/284ca08a6962d79ee2a058e361bfb6e1/al.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.214.4.99 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS cp117.hawsabah.com.sa Software Apache / Resource Hash `1c39b00043860c1a67b9c94c95f3c2656f48b349021568229d08216b83348462` Request headers Accept-Language de-DE,de;q=0.9 Referer https://sappd.org.sa/docusign/284ca08a6962d79ee2a058e361bfb6e1/al.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Tue, 08 Feb 2022 18:31:47 GMT Last-Modified Tue, 11 Jan 2022 15:32:47 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 2881
GET H/1.1	200 OK	for.png sappd.org.sa/docusign/284ca08a6962d79ee2a058e361bfb6e1/images/	1 KB 1 KB	480ms 160ms	Image image/png	162.214.4.99 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL https://sappd.org.sa/docusign/284ca08a6962d79ee2a058e361bfb6e1/images/for.png Requested by Host: sappd.org.sa URL: https://sappd.org.sa/docusign/284ca08a6962d79ee2a058e361bfb6e1/al.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.214.4.99 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS cp117.hawsabah.com.sa Software Apache / Resource Hash `772012ce2bc44065d3acf14d382b5e2cc76bc5cec7fb9988669803b463ee0fd6` Request headers Accept-Language de-DE,de;q=0.9 Referer https://sappd.org.sa/docusign/284ca08a6962d79ee2a058e361bfb6e1/al.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Tue, 08 Feb 2022 18:31:47 GMT Last-Modified Tue, 11 Jan 2022 15:32:47 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 1037
GET H/1.1	200 OK	fooottteeee.png sappd.org.sa/docusign/284ca08a6962d79ee2a058e361bfb6e1/images/	3 KB 4 KB	166ms 161ms	Image image/png	162.214.4.99 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL https://sappd.org.sa/docusign/284ca08a6962d79ee2a058e361bfb6e1/images/fooottteeee.png Requested by Host: sappd.org.sa URL: https://sappd.org.sa/docusign/284ca08a6962d79ee2a058e361bfb6e1/al.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.214.4.99 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS cp117.hawsabah.com.sa Software Apache / Resource Hash `300a76728d7561a1432ce0c7cf5fc64fa8857528138e3ba7c623e574bff7ed91` Request headers Accept-Language de-DE,de;q=0.9 Referer https://sappd.org.sa/docusign/284ca08a6962d79ee2a058e361bfb6e1/al.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Tue, 08 Feb 2022 18:31:47 GMT Last-Modified Tue, 11 Jan 2022 15:32:47 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 3564
GET H/1.1	200 OK	sign.png sappd.org.sa/docusign/284ca08a6962d79ee2a058e361bfb6e1/images/	1004 B 1 KB	169ms 161ms	Image image/png	162.214.4.99 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL https://sappd.org.sa/docusign/284ca08a6962d79ee2a058e361bfb6e1/images/sign.png Requested by Host: sappd.org.sa URL: https://sappd.org.sa/docusign/284ca08a6962d79ee2a058e361bfb6e1/al.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.214.4.99 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS cp117.hawsabah.com.sa Software Apache / Resource Hash `b38c6cd1ef63f895c6087cbe9f3b33c35640b85cbedaacb118c3796ea570e863` Request headers Accept-Language de-DE,de;q=0.9 Referer https://sappd.org.sa/docusign/284ca08a6962d79ee2a058e361bfb6e1/al.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Tue, 08 Feb 2022 18:31:47 GMT Last-Modified Tue, 11 Jan 2022 15:32:47 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 1004
GET H/1.1	200 OK	sign.png sappd.org.sa/docusign/284ca08a6962d79ee2a058e361bfb6e1/images/	1004 B 1 KB	161ms 161ms	Image image/png	162.214.4.99 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL https://sappd.org.sa/docusign/284ca08a6962d79ee2a058e361bfb6e1/images/sign.png Requested by Host: sappd.org.sa URL: https://sappd.org.sa/docusign/284ca08a6962d79ee2a058e361bfb6e1/al.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.214.4.99 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS cp117.hawsabah.com.sa Software Apache / Resource Hash `b38c6cd1ef63f895c6087cbe9f3b33c35640b85cbedaacb118c3796ea570e863` Request headers Accept-Language de-DE,de;q=0.9 Referer https://sappd.org.sa/docusign/284ca08a6962d79ee2a058e361bfb6e1/al.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Tue, 08 Feb 2022 18:31:47 GMT Last-Modified Tue, 11 Jan 2022 15:32:47 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 1004

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: AOL (Online)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| unhideBody

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

sappd.org.sa
162.214.4.99
1c39b00043860c1a67b9c94c95f3c2656f48b349021568229d08216b83348462
255d6dfae2b0ab59f97774b8fe2a2c037e8550571af5299150cf8175ed71bac9
300a76728d7561a1432ce0c7cf5fc64fa8857528138e3ba7c623e574bff7ed91
512622094168eda5bb13cc50ec8a1d0e12a43208d22756a942083db1f230f8bd
5fc3d4ea02c1a7b2b94eeed06c860513508396144dca7d0b8bd6c5ce33214eee
772012ce2bc44065d3acf14d382b5e2cc76bc5cec7fb9988669803b463ee0fd6
b3681ae4ba23ab0c56c679cf3c79300795da909ecc0758624c77e6ec6ea61b17
b38c6cd1ef63f895c6087cbe9f3b33c35640b85cbedaacb118c3796ea570e863
d71c520298a4b0c66f052d452cb65992646249a678170937faa2ee9586d7797c

sappd.org.sa Open in urlscan Pro 162.214.4.99 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

10 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

43 kBTransfer

40 kBSize

0 Cookies

0 Outgoing links

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

Indicators

sappd.org.sa Open in urlscan Pro
162.214.4.99 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

43 kB
Transfer

40 kB
Size

0
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!