docusign-3qs.pages.dev
Open in
urlscan Pro
172.66.44.244
Malicious Activity!
Public Scan
Submission: On August 30 via api from JP — Scanned from JP
Summary
TLS certificate: Issued by GTS CA 1P5 on August 28th 2023. Valid for: 3 months.
This is the only time docusign-3qs.pages.dev was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer) Generic (Online) OneDrive (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 172.66.44.244 172.66.44.244 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 104.18.11.207 104.18.11.207 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 13.107.246.46 13.107.246.46 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 5 | 172.64.155.59 172.64.155.59 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 142.250.207.106 142.250.207.106 | 15169 (GOOGLE) (GOOGLE) | |
1 | 151.101.1.229 151.101.1.229 | 54113 (FASTLY) (FASTLY) | |
1 1 | 35.186.213.112 35.186.213.112 | 15169 (GOOGLE) (GOOGLE) | |
10 | 6 |
ASN13335 (CLOUDFLARENET, US)
maxcdn.bootstrapcdn.com | |
stackpath.bootstrapcdn.com |
ASN15169 (GOOGLE, US)
PTR: kix06s11-in-f10.1e100.net
ajax.googleapis.com |
ASN15169 (GOOGLE, US)
PTR: 112.213.186.35.bc.googleusercontent.com
gyazo.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
gyazo.com
2 redirects
i.gyazo.com — Cisco Umbrella Rank: 107458 gyazo.com — Cisco Umbrella Rank: 78586 |
626 KB |
2 |
bootstrapcdn.com
maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 982 stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 2782 |
37 KB |
1 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 334 |
1 KB |
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 366 |
30 KB |
1 |
msauth.net
logincdn.msauth.net — Cisco Umbrella Rank: 3601 |
2 KB |
1 |
pages.dev
docusign-3qs.pages.dev |
23 KB |
10 | 6 |
Domain | Requested by | |
---|---|---|
5 | i.gyazo.com |
1 redirects
docusign-3qs.pages.dev
|
1 | gyazo.com | 1 redirects |
1 | cdn.jsdelivr.net |
docusign-3qs.pages.dev
|
1 | stackpath.bootstrapcdn.com |
docusign-3qs.pages.dev
|
1 | ajax.googleapis.com |
docusign-3qs.pages.dev
|
1 | logincdn.msauth.net |
docusign-3qs.pages.dev
|
1 | maxcdn.bootstrapcdn.com |
docusign-3qs.pages.dev
|
1 | docusign-3qs.pages.dev | |
10 | 8 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
docusign-3qs.pages.dev GTS CA 1P5 |
2023-08-28 - 2023-11-26 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-12-30 - 2023-12-30 |
a year | crt.sh |
identitycdn.msauth.net Microsoft Azure TLS Issuing CA 02 |
2023-06-24 - 2024-06-18 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-08-07 - 2023-10-30 |
3 months | crt.sh |
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2022 Q4 |
2022-12-23 - 2024-01-24 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://docusign-3qs.pages.dev/
Frame ID: 5F824BF633232AF6341E374DD9F70AB3
Requests: 10 HTTP requests in this frame
Screenshot
Page Title
OneDrive Document CloudDetected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jsDelivr (CDN) Expand
Detected patterns
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 8- https://i.gyazo.com/16b6488b3e7d6162a99753938f508d7e.pngquot;);background-repeat:no-repeat;background-size:1280px%20640px HTTP 302
- https://gyazo.com/16b6488b3e7d6162a99753938f508d7e.pngquot;);background-repeat:no-repeat;background-size:1280px%20640px HTTP 302
- https://i.gyazo.com/16b6488b3e7d6162a99753938f508d7e.png
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
docusign-3qs.pages.dev/ |
107 KB 23 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/ |
141 KB 22 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
logincdn.msauth.net/shared/1.0/content/images/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6eae75d87eebc05d2e882397e5ef8480.png
i.gyazo.com/ |
18 KB 18 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6a6271e3e40ab27f2c950c82f50136df.png
i.gyazo.com/ |
21 KB 22 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6696ea0b401cbe3fb90177b597c2c051.png
i.gyazo.com/ |
11 KB 12 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ |
84 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/ |
50 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.session.min.js
cdn.jsdelivr.net/npm/jquery.session@1.0.0/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
16b6488b3e7d6162a99753938f508d7e.png
i.gyazo.com/ Redirect Chain
|
573 KB 574 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer) Generic (Online) OneDrive (Online)7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture function| $ function| jQuery object| bootstrap function| _0x3552 function| _0x5eae function| _0x5eeba82 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
i.gyazo.com/ | Name: Gyazo_cfwoker Value: i |
|
docusign-3qs.pages.dev/ | Name: __session:0.05079982012338058: Value: https: |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
cdn.jsdelivr.net
docusign-3qs.pages.dev
gyazo.com
i.gyazo.com
logincdn.msauth.net
maxcdn.bootstrapcdn.com
stackpath.bootstrapcdn.com
104.18.11.207
13.107.246.46
142.250.207.106
151.101.1.229
172.64.155.59
172.66.44.244
35.186.213.112
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
19dc2ba4d1d797275f5b9a683aa8f4cbc835336d89f03e80b21a24961a8be9ba
2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d
3a9b144d6482b78afc4e0a940a1d3c22240f14fa535b808cf4dab9635339569f
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
71e729939e175f4ae9d3fcc645d6b7389ec341a47a84950e047197331fdc22f1
76ad6584ac5bdd459939dc7532fae7c2bdd8e22d773ff16d2306f42a1ffc569c
ddf5887ce15778102013d5527ec1fd09bc400fa19b91416b36b828ecdbd76ca8
e622fe56b8613e99653c109bc69a14ca6119ccec9909a168ab8f5f49891b16df