URL: http://kibaha.com/state.nm.us/
Submission: On July 28 via manual from US

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 7 HTTP transactions. The main IP is 108.178.10.226, located in United States and belongs to SINGLEHOP-LLC, US. The main domain is kibaha.com.
This is the only time kibaha.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DocuSign (Online)

Domain & IP information

IP Address AS Autonomous System
5 108.178.10.226 32475 (SINGLEHOP...)
1 185.81.100.38 62856 (DOCUS-6-PROD)
1 2001:4de0:ac1... 20446 (HIGHWINDS3)
7 3
Apex Domain
Subdomains
Transfer
5 kibaha.com
kibaha.com
482 KB
1 jquery.com
code.jquery.com
30 KB
1 docusign.com
account.docusign.com
4 KB
7 3
Domain Requested by
5 kibaha.com kibaha.com
1 code.jquery.com kibaha.com
1 account.docusign.com kibaha.com
7 3

This site contains links to these domains. Also see Links.

Domain
account.docusign.com
www.docusign.com
Subject Issuer Validity Valid
account.docusign.com
DigiCert SHA2 Extended Validation Server CA
2020-01-09 -
2022-03-26
2 years crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA
2021-07-14 -
2022-08-14
a year crt.sh

This page contains 1 frames:

Primary Page: http://kibaha.com/state.nm.us/
Frame ID: F7D4D082D8604DCFDF5108FC21E894EF
Requests: 7 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

7
Requests

29 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

517 kB
Transfer

572 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request Cookie set /
kibaha.com/state.nm.us/
151 KB
152 KB
Document
General
Full URL
http://kibaha.com/state.nm.us/
Protocol
HTTP/1.1
Server
108.178.10.226 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
solo.superdnssite.com
Software
Apache /
Resource Hash
852c825c53236e404312937483e3452230642913bf72ae1dcda9f874d9dade17

Request headers

Host
kibaha.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 28 Jul 2021 21:10:12 GMT
Server
Apache
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma
no-cache
Set-Cookie
PHPSESSID=j7tli4ms2o0oqqlacjs3vtdeo6; path=/
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
app
kibaha.com/state.nm.us/index_files/
236 KB
237 KB
Stylesheet
General
Full URL
http://kibaha.com/state.nm.us/index_files/app
Requested by
Host: kibaha.com
URL: http://kibaha.com/state.nm.us/
Protocol
HTTP/1.1
Server
108.178.10.226 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
solo.superdnssite.com
Software
Apache /
Resource Hash
f39daa36e62d2902109b1971bcd36cee542b3c0a67d27fa7388ef7e12923594c

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
kibaha.com
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://kibaha.com/state.nm.us/
Cookie
PHPSESSID=j7tli4ms2o0oqqlacjs3vtdeo6
Connection
keep-alive
Cache-Control
no-cache
Referer
http://kibaha.com/state.nm.us/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 28 Jul 2021 21:10:12 GMT
Last-Modified
Wed, 07 Apr 2021 21:41:38 GMT
Server
Apache
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
241976
docusign_logo_small.png
account.docusign.com/LoginAppNext/images/
4 KB
4 KB
Image
General
Full URL
https://account.docusign.com/LoginAppNext/images/docusign_logo_small.png
Requested by
Host: kibaha.com
URL: http://kibaha.com/state.nm.us/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.81.100.38 , United States, ASN62856 (DOCUS-6-PROD, US),
Reverse DNS
Software
/
Resource Hash
e83f8d0b4a78d14185abfca96ee2fbaf18e396a047f725d944ff27a845787279

Request headers

Referer
http://kibaha.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 28 Jul 2021 21:10:12 GMT
ETag
"4d9fbbdad27cd71:0"
Last-Modified
Mon, 19 Jul 2021 19:18:28 GMT
Accept-Ranges
bytes
X-DocuSign-Node
FR1FE22
Content-Length
4064
Content-Type
image/png
jquery-3.6.0.min.js
code.jquery.com/
87 KB
30 KB
Script
General
Full URL
https://code.jquery.com/jquery-3.6.0.min.js
Requested by
Host: kibaha.com
URL: http://kibaha.com/state.nm.us/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac18::1:a:2a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
nginx /
Resource Hash
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

Origin
http://kibaha.com
Referer
http://kibaha.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 28 Jul 2021 21:10:13 GMT
content-encoding
gzip
last-modified
Tue, 02 Mar 2021 17:27:20 GMT
server
nginx
etag
W/"603e7578-15d9d"
vary
Accept-Encoding
x-hw
1627506613.dop223.fr8.t,1627506613.cds224.fr8.hn,1627506613.cds144.fr8.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
30875
HelveticaNeueW01-55Roma.woff
kibaha.com/state.nm.us/fonts/
47 KB
47 KB
Font
General
Full URL
http://kibaha.com/state.nm.us/fonts/HelveticaNeueW01-55Roma.woff
Requested by
Host: kibaha.com
URL: http://kibaha.com/state.nm.us/index_files/app
Protocol
HTTP/1.1
Server
108.178.10.226 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
solo.superdnssite.com
Software
Apache /
Resource Hash
dac5803d6cbe40244dfd39661406239f83e94e86c976e7229a4e35305a9b5efe

Request headers

Pragma
no-cache
Origin
http://kibaha.com
Accept-Encoding
gzip, deflate
Host
kibaha.com
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
*/*
Referer
http://kibaha.com/state.nm.us/index_files/app
Cookie
PHPSESSID=j7tli4ms2o0oqqlacjs3vtdeo6
Connection
keep-alive
Cache-Control
no-cache
Origin
http://kibaha.com
Referer
http://kibaha.com/state.nm.us/index_files/app
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 28 Jul 2021 21:10:13 GMT
Last-Modified
Wed, 07 Apr 2021 21:45:04 GMT
Server
Apache
Content-Type
font/woff
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
47748
maven_pro_bold.woff
kibaha.com/state.nm.us/fonts/
33 KB
33 KB
Font
General
Full URL
http://kibaha.com/state.nm.us/fonts/maven_pro_bold.woff
Requested by
Host: kibaha.com
URL: http://kibaha.com/state.nm.us/index_files/app
Protocol
HTTP/1.1
Server
108.178.10.226 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
solo.superdnssite.com
Software
Apache /
Resource Hash
8f6a520a392ff62149e5fc5aa87bfab9b3816cd6010d4d4fca194e8683ca498b

Request headers

Pragma
no-cache
Origin
http://kibaha.com
Accept-Encoding
gzip, deflate
Host
kibaha.com
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
*/*
Referer
http://kibaha.com/state.nm.us/index_files/app
Cookie
PHPSESSID=j7tli4ms2o0oqqlacjs3vtdeo6
Connection
keep-alive
Cache-Control
no-cache
Origin
http://kibaha.com
Referer
http://kibaha.com/state.nm.us/index_files/app
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 28 Jul 2021 21:10:13 GMT
Last-Modified
Wed, 07 Apr 2021 21:44:38 GMT
Server
Apache
Content-Type
font/woff
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
33752
olive-icons.woff
kibaha.com/state.nm.us/fonts/
13 KB
13 KB
Font
General
Full URL
http://kibaha.com/state.nm.us/fonts/olive-icons.woff
Requested by
Host: kibaha.com
URL: http://kibaha.com/state.nm.us/index_files/app
Protocol
HTTP/1.1
Server
108.178.10.226 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
solo.superdnssite.com
Software
Apache /
Resource Hash
e335d0fea78a01565a4dca5f26503d15170ef4b6c9a855f5f1d5cac3ee6e9e6d

Request headers

Pragma
no-cache
Origin
http://kibaha.com
Accept-Encoding
gzip, deflate
Host
kibaha.com
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
*/*
Referer
http://kibaha.com/state.nm.us/index_files/app
Cookie
PHPSESSID=j7tli4ms2o0oqqlacjs3vtdeo6
Connection
keep-alive
Cache-Control
no-cache
Origin
http://kibaha.com
Referer
http://kibaha.com/state.nm.us/index_files/app
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 28 Jul 2021 21:10:13 GMT
Last-Modified
Wed, 07 Apr 2021 21:45:14 GMT
Server
Apache
Content-Type
font/woff
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
13472

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DocuSign (Online)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery

1 Cookies

Domain/Path Name / Value
kibaha.com/ Name: PHPSESSID
Value: j7tli4ms2o0oqqlacjs3vtdeo6