edoc-signature.officialcountdown11.com

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 4 HTTP transactions. The main IP is 162.19.135.142, located in France and belongs to OVH, FR. The main domain is edoc-signature.officialcountdown11.com.
TLS certificate: Issued by R3 on September 12th 2023. Valid for: 3 months.

This is the only time edoc-signature.officialcountdown11.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1 3	173.213.4.175 173.213.4.175	53316 (ASN-CHEET...) (ASN-CHEETA-MAIL)
1	192.185.24.45 192.185.24.45	19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING)
1	162.19.135.142 162.19.135.142	16276 (OVH) (OVH)
4	4

3 173.213.4.175 (United States) 1 redirects

ASN53316 (ASN-CHEETA-MAIL, US)

l.h4.hilton.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
s.h1.hilton.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.185.24.45 (United States)

ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: ns8071.websitewelcome.com

wadeinuae.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.19.135.142 (France)

ASN16276 (OVH, FR)
PTR: ip142.ip-162-19-135.eu

edoc-signature.officialcountdown11.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	hilton.com 1 redirects l.h4.hilton.com — Cisco Umbrella Rank: 609879 s.h1.hilton.com — Cisco Umbrella Rank: 190864	4 KB
1	officialcountdown11.com edoc-signature.officialcountdown11.com	129 KB
1	wadeinuae.com wadeinuae.com	130 B
4	3

	Domain	Requested by
2	l.h4.hilton.com	1 redirects
1	edoc-signature.officialcountdown11.com
1	wadeinuae.com	l.h4.hilton.com
1	s.h1.hilton.com	l.h4.hilton.com
4	4

This site contains no links.

Subject Issuer	Validity	Valid
h4.hilton.com DigiCert TLS RSA SHA256 2020 CA1	`2022-11-08` - `2023-11-08`	a year	crt.sh
h1.hilton.com DigiCert TLS RSA SHA256 2020 CA1	`2022-12-15` - `2023-12-14`	a year	crt.sh
*.wadeinuae.com R3	`2023-08-06` - `2023-11-04`	3 months	crt.sh
officialcountdown11.com R3	`2023-09-12` - `2023-12-11`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://edoc-signature.officialcountdown11.com/?username=dsommers@gellerco.com
Frame ID: 9013C7B2F27956DCDED6699948B89BDE
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Microsoft reCAPTCHA

Page URL History Show full URLs

http://l.h4.hilton.com/rts/go2.aspx?h=1993652&tp=i-16D9-Ak-Dd7-C0Cn1s-24-urf45-1c-l80th8gw79-WSYPS&... HTTP 302
https://l.h4.hilton.com/rts/go2.aspx?h=1993652&tp=i-16D9-Ak-Dd7-C0Cn1s-24-urf45-1c-l80th8gw79-WSYPS&... Page URL
https://edoc-signature.officialcountdown11.com/?username=dsommers@gellerco.com Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Page Statistics

4
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

4
IPs

2
Countries

132 kB
Transfer

361 kB
Size

6
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://l.h4.hilton.com/rts/go2.aspx?h=1993652&tp=i-16D9-Ak-Dd7-C0Cn1s-24-urf45-1c-l80th8gw79-WSYPS&x=wadeinuae.com%2F%2Fwp-includes%2Fpomo%2F.final%2Fjojo%2FXPJ7xWV%2FIUxxp%2FZHNvbW1lcnNAZ2VsbGVyY28uY29t HTTP 302
https://l.h4.hilton.com/rts/go2.aspx?h=1993652&tp=i-16D9-Ak-Dd7-C0Cn1s-24-urf45-1c-l80th8gw79-WSYPS&x=wadeinuae.com%2F%2Fwp-includes%2Fpomo%2F.final%2Fjojo%2FXPJ7xWV%2FIUxxp%2FZHNvbW1lcnNAZ2VsbGVyY28uY29t Page URL
https://edoc-signature.officialcountdown11.com/?username=dsommers@gellerco.com Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://l.h4.hilton.com/rts/go2.aspx?h=1993652&tp=i-16D9-Ak-Dd7-C0Cn1s-24-urf45-1c-l80th8gw79-WSYPS&x=wadeinuae.com%2F%2Fwp-includes%2Fpomo%2F.final%2Fjojo%2FXPJ7xWV%2FIUxxp%2FZHNvbW1lcnNAZ2VsbGVyY28uY29t HTTP 302
https://l.h4.hilton.com/rts/go2.aspx?h=1993652&tp=i-16D9-Ak-Dd7-C0Cn1s-24-urf45-1c-l80th8gw79-WSYPS&x=wadeinuae.com%2F%2Fwp-includes%2Fpomo%2F.final%2Fjojo%2FXPJ7xWV%2FIUxxp%2FZHNvbW1lcnNAZ2VsbGVyY28uY29t

4 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

go2.aspx Show response
l.h4.hilton.com/rts/
Redirect Chain

http://l.h4.hilton.com/rts/go2.aspx?h=1993652&tp=i-16D9-Ak-Dd7-C0Cn1s-24-urf45-1c-l80th8gw79-WSYPS&x=wadeinuae.com%2F%2Fwp-includes%2Fpomo%2F.final%2Fjojo%2FXPJ7xWV%2FIUxxp%2FZHNvbW1lcnNAZ2VsbGVyY2...
https://l.h4.hilton.com/rts/go2.aspx?h=1993652&tp=i-16D9-Ak-Dd7-C0Cn1s-24-urf45-1c-l80th8gw79-WSYPS&x=wadeinuae.com%2F%2Fwp-includes%2Fpomo%2F.final%2Fjojo%2FXPJ7xWV%2FIUxxp%2FZHNvbW1lcnNAZ2VsbGVyY...

1 KB
2 KB

479ms
127ms

Document
text/html

173.213.4.175
ASN-CHEETA-MAIL

General

Check archive.org

Show headers Download Go to

Full URL: https://l.h4.hilton.com/rts/go2.aspx?h=1993652&tp=i-16D9-Ak-Dd7-C0Cn1s-24-urf45-1c-l80th8gw79-WSYPS&x=wadeinuae.com%2F%2Fwp-includes%2Fpomo%2F.final%2Fjojo%2FXPJ7xWV%2FIUxxp%2FZHNvbW1lcnNAZ2VsbGVyY28uY29t
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 173.213.4.175 , United States, ASN53316 (ASN-CHEETA-MAIL, US),
Reverse DNS
Software: /
Resource Hash: 8a4e231d701b237ef84df0494e8b3882c702de0ab8f5cedbf3bfcba339c84016

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private
Content-Type: text/html; charset=utf-8
Date: Wed, 13 Sep 2023 19:10:54 GMT
Server
Transfer-Encoding: chunked
X-Powered-By

Redirect headers

Connection: Keep-Alive
Content-Length: 0
Location: https://l.h4.hilton.com/rts/go2.aspx?h=1993652&tp=i-16D9-Ak-Dd7-C0Cn1s-24-urf45-1c-l80th8gw79-WSYPS&x=wadeinuae.com%2F%2Fwp-includes%2Fpomo%2F.final%2Fjojo%2FXPJ7xWV%2FIUxxp%2FZHNvbW1lcnNAZ2VsbGVyY28uY29t
Server: BigIP

GET
H/1.1 200
OK SetCookie.gif
s.h1.hilton.com/wts/WebEvent/ 807 B
2 KB 436ms
110ms Image
image/gif 173.213.4.175
ASN-CHEETA-MAIL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.h1.hilton.com/wts/WebEvent/SetCookie.gif?tp=i-16D9-Ak-Dd7-C0Cn1s-24-urf45-1c-l80th8gw79-WSYPS
Requested by: Host: l.h4.hilton.com
URL: https://l.h4.hilton.com/rts/go2.aspx?h=1993652&tp=i-16D9-Ak-Dd7-C0Cn1s-24-urf45-1c-l80th8gw79-WSYPS&x=wadeinuae.com%2F%2Fwp-includes%2Fpomo%2F.final%2Fjojo%2FXPJ7xWV%2FIUxxp%2FZHNvbW1lcnNAZ2VsbGVyY28uY29t
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 173.213.4.175 , United States, ASN53316 (ASN-CHEETA-MAIL, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://l.h4.hilton.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 13 Sep 2023 19:10:55 GMT
X-AspNetMvc-Version: 3.0
Server
X-Powered-By
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: no-cache, max-age=0
Content-Length: 807
Expires: 0

GET
H2 200 ZHNvbW1lcnNAZ2VsbGVyY28uY29t
wadeinuae.com//wp-includes/pomo/.final/jojo/XPJ7xWV/IUxxp/ 0
130 B 957ms
153ms Document
text/html 192.185.24.45
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://wadeinuae.com//wp-includes/pomo/.final/jojo/XPJ7xWV/IUxxp/ZHNvbW1lcnNAZ2VsbGVyY28uY29t
Requested by: Host: l.h4.hilton.com
URL: https://l.h4.hilton.com/rts/go2.aspx?h=1993652&tp=i-16D9-Ak-Dd7-C0Cn1s-24-urf45-1c-l80th8gw79-WSYPS&x=wadeinuae.com%2F%2Fwp-includes%2Fpomo%2F.final%2Fjojo%2FXPJ7xWV%2FIUxxp%2FZHNvbW1lcnNAZ2VsbGVyY28uY29t
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.185.24.45 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: ns8071.websitewelcome.com
Software: Apache /
Resource Hash

Request headers

Referer: https://l.h4.hilton.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-length: 0
content-type: text/html; charset=UTF-8
date: Wed, 13 Sep 2023 19:10:56 GMT
refresh: 0;url=https://edoc-signature.officialcountdown11.com/?username=dsommers@gellerco.com
server: Apache

GET
H2 200 Primary Request / Show response
edoc-signature.officialcountdown11.com/ 318 KB
129 KB 273ms
166ms Document
text/html 162.19.135.142
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://edoc-signature.officialcountdown11.com/?username=dsommers@gellerco.com

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

162.19.135.142 , France, ASN16276 (OVH, FR),

Reverse DNS

ip142.ip-162-19-135.eu

Software

nginx /

Resource Hash

7c7963f08a220ee66b79f482f96256daf84eb5fc533b8cc63ae2e7ae42d40979

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://wadeinuae.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: gzip
content-type: text/html; charset=utf-8
date: Wed, 13 Sep 2023 19:10:57 GMT
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding

GET
DATA 200
OK truncated
/ 858 B
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 19b8ee66ab60c45d5d24988d090b61c938b44c2ee9a5f8558335b27a2f315072

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 40 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 64c2019b369b4f3b45009d1740f4c7ae0856bb2608aea7d7628b78f43cecb3fa

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

Content-Type: image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| a0_0x1211 function| a0_0x4c70 function| onCheckBoxChange

6 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
l.h4.hilton.com/	1969-12-31 23:59:59	Name: ASP.NET_SessionId Value: 4y0gaobk3yffxi4fhq3nuz3y
.hilton.com/	1970-01-20 14:53:57	Name: xyz_cr_666_et_128 Value: ak_guid=15e9cd36-ea5a-433d-b2bc-b9d71031d113&tp=i-16D9-Ak-Dd7-C0Cn1s-24-urf45-1c-l80th8gw79-WSYPS
l.h4.hilton.com/	1969-12-31 23:59:59	Name: BIGipServercnv_ats_ssl_pool Value: !3J5GhtfW3A/plCGq0v/hGslLrah/S1yYIc8coVgRi2BKbTxaj7V8z+D7Gtuyew8MZyVUScvL+1vAZ4c=
.hilton.com/	1970-01-20 14:53:57	Name: xyz_trk_cr_666 Value: tp=i-16D9-Ak-Dd7-C0Cn1s-24-urf45-1c-l80th8gw79-WSYPS
.hilton.com/	1970-01-20 14:53:57	Name: xyz_trk_we_grp_group_hilton_hotels Value: tp=i-16D9-Ak-Dd7-C0Cn1s-24-urf45-1c-l80th8gw79-WSYPS
s.h1.hilton.com/	1969-12-31 23:59:59	Name: BIGipServercnv_ats_ssl_pool Value: !c9N/gPvBfcClZhqq0v/hGslLrah/S+nhkeSVCdAsNL9pgABHHIg5JkCvTjfX6uLcMfc5Z2jOfMcEgwU=

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

edoc-signature.officialcountdown11.com
l.h4.hilton.com
s.h1.hilton.com
wadeinuae.com
162.19.135.142
173.213.4.175
192.185.24.45
19b8ee66ab60c45d5d24988d090b61c938b44c2ee9a5f8558335b27a2f315072
64c2019b369b4f3b45009d1740f4c7ae0856bb2608aea7d7628b78f43cecb3fa
7c7963f08a220ee66b79f482f96256daf84eb5fc533b8cc63ae2e7ae42d40979
8a4e231d701b237ef84df0494e8b3882c702de0ab8f5cedbf3bfcba339c84016

edoc-signature.officialcountdown11.com Open in urlscan Pro 162.19.135.142 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

4 Requests

100 %HTTPS

0 %IPv6

3 Domains

4 Subdomains

4 IPs

2 Countries

132 kBTransfer

361 kBSize

6 Cookies

0 Outgoing links

Page URL History

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

6 Cookies

Indicators

edoc-signature.officialcountdown11.com Open in urlscan Pro
162.19.135.142 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

4
IPs

2
Countries

132 kB
Transfer

361 kB
Size

6
Cookies

4 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!