signdesign-inc.com Open in urlscan Pro
2606:4700:3032::ac43:8fa6  Malicious Activity! Public Scan

Submitted URL: http://signdesign-inc.com/a0acfa46d86f7610b2c73dbb28f64701/
Effective URL: http://signdesign-inc.com/a0acfa46d86f7610b2c73dbb28f64701/login.php?user=true
Submission: On December 02 via automatic, source openphish — Scanned from DE

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 4 HTTP transactions. The main IP is 2606:4700:3032::ac43:8fa6, located in United States and belongs to CLOUDFLARENET, US. The main domain is signdesign-inc.com.
This is the only time signdesign-inc.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Sparkasse (Banking)

Domain & IP information

IP Address AS Autonomous System
1 5 2606:4700:303... 13335 (CLOUDFLAR...)
4 2
Apex Domain
Subdomains
Transfer
5 signdesign-inc.com
signdesign-inc.com
863 KB
4 1
Domain Requested by
5 signdesign-inc.com 1 redirects signdesign-inc.com
4 1
Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://signdesign-inc.com/a0acfa46d86f7610b2c73dbb28f64701/login.php?user=true
Frame ID: 9FBCA1B59EDDFB0F5EDC346D3D4BF088
Requests: 12 HTTP requests in this frame

Screenshot

Page Title

Login Online-Banking

Page URL History Show full URLs

  1. http://signdesign-inc.com/a0acfa46d86f7610b2c73dbb28f64701/ HTTP 302
    http://signdesign-inc.com/a0acfa46d86f7610b2c73dbb28f64701/login.php?user=true Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <div class="[^"]*parbase

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

4
Requests

0 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

1167 kB
Transfer

2212 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://signdesign-inc.com/a0acfa46d86f7610b2c73dbb28f64701/ HTTP 302
    http://signdesign-inc.com/a0acfa46d86f7610b2c73dbb28f64701/login.php?user=true Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request login.php
signdesign-inc.com/a0acfa46d86f7610b2c73dbb28f64701/
Redirect Chain
  • http://signdesign-inc.com/a0acfa46d86f7610b2c73dbb28f64701/
  • http://signdesign-inc.com/a0acfa46d86f7610b2c73dbb28f64701/login.php?user=true
624 KB
410 KB
Document
General
Full URL
http://signdesign-inc.com/a0acfa46d86f7610b2c73dbb28f64701/login.php?user=true
Protocol
HTTP/1.1
Server
2606:4700:3032::ac43:8fa6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1418097fae558c4e32614a97709640dcbd884c630ab67ad44e0db0d00d281797

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

CF-Cache-Status
DYNAMIC
CF-RAY
77302c841bdc92ba-FRA
Cache-Control
no-store, no-cache, must-revalidate
Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Fri, 02 Dec 2022 01:08:52 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Pragma
no-cache
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0K5dvT7aWdT96dYOYB4YzLj97cLTPROpisB%2BPDzuS5NtkAKW%2FuBxpnmCScB%2Fp2MjxR8RdRMIKXxQq8L4dk8qpd393A7%2BvQP8Z6LkVi9HK%2BNjjErevn49CiA9vNv3Fmy6y7J0RK6%2BOxuhIhgV7T1I2is%3D"}],"group":"cf-nel","max_age":604800}
Server
cloudflare
Transfer-Encoding
chunked
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400

Redirect headers

CF-Cache-Status
DYNAMIC
CF-RAY
77302c829a5892ba-FRA
Cache-Control
no-store, no-cache, must-revalidate
Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Date
Fri, 02 Dec 2022 01:08:52 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Location
login.php?user=true
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Pragma
no-cache
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rIINioLlZaQWgkjvTy4apUNfZS0SKwz%2FYIG8g5H5Ld1i%2FpERXkl0xLxiGYLpDC%2By9ovhMv%2FCPqjMPlDi%2F%2BT24It5GARj5an7Z6vh52W243IdX2yjv8qKjAoEncr2ek%2FfPTY8p3eVIN5ovyXYfipTFoU%3D"}],"group":"cf-nel","max_age":604800}
Server
cloudflare
Transfer-Encoding
chunked
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
l.css
signdesign-inc.com/a0acfa46d86f7610b2c73dbb28f64701/partial/css/
531 KB
292 KB
Stylesheet
General
Full URL
http://signdesign-inc.com/a0acfa46d86f7610b2c73dbb28f64701/partial/css/l.css
Requested by
Host: signdesign-inc.com
URL: http://signdesign-inc.com/a0acfa46d86f7610b2c73dbb28f64701/login.php?user=true
Protocol
HTTP/1.1
Server
2606:4700:3032::ac43:8fa6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
09b45f5918aab70e96f98c653ed15f892ee8ba85c8ffae9b36d567cddbd3196a

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://signdesign-inc.com/a0acfa46d86f7610b2c73dbb28f64701/login.php?user=true
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

Date
Fri, 02 Dec 2022 01:08:52 GMT
Content-Encoding
gzip
CF-Cache-Status
MISS
Last-Modified
Tue, 29 Nov 2022 15:12:08 GMT
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server
cloudflare
ETag
W/"63862148-84ae4"
Transfer-Encoding
chunked
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pONYgX32e9Od7n72vAXyr5Zjgx7wGZuC66TU6EhYzYKTUzG7FcE9lmVlkKWmWTnmmrdvgeR%2BlqjB%2BV3N7fS42xK29mR7mPWwg0b60BMTWyKENdE2%2BEqGvJywwurf2j0FR1hKD8V0iZJh%2FRSQyA8C1nQ%3D"}],"group":"cf-nel","max_age":604800}
Content-Type
text/css
Vary
Accept-Encoding
Cache-Control
max-age=14400
Connection
keep-alive
CF-RAY
77302c84ae899b9b-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
jquery.js
signdesign-inc.com/a0acfa46d86f7610b2c73dbb28f64701/partial/js/
266 KB
77 KB
Script
General
Full URL
http://signdesign-inc.com/a0acfa46d86f7610b2c73dbb28f64701/partial/js/jquery.js
Requested by
Host: signdesign-inc.com
URL: http://signdesign-inc.com/a0acfa46d86f7610b2c73dbb28f64701/login.php?user=true
Protocol
HTTP/1.1
Server
2606:4700:3032::ac43:8fa6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4ef5f864f89db7feaaaa5332c0a99d76076af49fef488806541ca2561e4cb379

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://signdesign-inc.com/a0acfa46d86f7610b2c73dbb28f64701/login.php?user=true
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

Date
Fri, 02 Dec 2022 01:08:52 GMT
Content-Encoding
gzip
CF-Cache-Status
MISS
Last-Modified
Tue, 29 Nov 2022 15:12:08 GMT
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server
cloudflare
ETag
W/"63862148-4271b"
Transfer-Encoding
chunked
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZCe221OWkdTTZruUWkxO%2BBeP6JYBTenKrZ8ZzO4v7s8wSHk4GXhc8h0gt%2BQWxbPO%2Bs0NM%2FtMWREZnJhuUVFiX9AezAo%2BoA9uA2nqA2A2nu19DgExqUvlios9m4FoNgtcWzAUmnFexS1TTzrjfOgXfoM%3D"}],"group":"cf-nel","max_age":604800}
Content-Type
application/javascript
Vary
Accept-Encoding
Cache-Control
max-age=14400
Connection
keep-alive
CF-RAY
77302c84acb39262-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
index.jpg
signdesign-inc.com/a0acfa46d86f7610b2c73dbb28f64701/partial/img/
83 KB
83 KB
Image
General
Full URL
http://signdesign-inc.com/a0acfa46d86f7610b2c73dbb28f64701/partial/img/index.jpg
Requested by
Host: signdesign-inc.com
URL: http://signdesign-inc.com/a0acfa46d86f7610b2c73dbb28f64701/login.php?user=true
Protocol
HTTP/1.1
Server
2606:4700:3032::ac43:8fa6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
281d0943765218606c764e99d16c2bcad4db7d3475ab596b00f9690cfa7c1f1e

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://signdesign-inc.com/a0acfa46d86f7610b2c73dbb28f64701/login.php?user=true
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

Date
Fri, 02 Dec 2022 01:08:53 GMT
CF-Cache-Status
MISS
Last-Modified
Tue, 29 Nov 2022 15:12:08 GMT
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server
cloudflare
ETag
"63862148-14a44"
Vary
Accept-Encoding
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AVJXBCGneE3lt%2BaN4RmJZzZaIgM%2F8v6Q42jDFmZeE8BvBLA8lQgMg2mNQIQJfJhXMHjOe8FU1IKLHT5k9L8NFapGdYQXOssj1WPfPSBnD6oswy0FdpKdfQA9L6kqBEHTfFuBNR%2FPvWxn6saCksKFY84%3D"}],"group":"cf-nel","max_age":604800}
Content-Type
image/jpeg
Cache-Control
max-age=14400
Connection
keep-alive
Accept-Ranges
bytes
CF-RAY
77302c867e269262-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length
84548
truncated
/
6 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3edc58dd505c594baa6bd39f1641072b5a072f16410c6d0c4bf65df2cdb1d356

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://signdesign-inc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
41 KB
41 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0e9eb66a1b33ae648ada3c56eb55fa149c4f1b88316b5a7255ca9b076740f451

Request headers

Referer
http://signdesign-inc.com/
Origin
http://signdesign-inc.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

Content-Type
font/woff
truncated
/
204 KB
204 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ee88f0851598c363b9b465dd2606efb934c3357aaed3274d0f4a2e6d40b86951

Request headers

Referer
http://signdesign-inc.com/
Origin
http://signdesign-inc.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

Content-Type
font/woff
truncated
/
164 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
25f042d00f4ce4bcff027d7b7e5c3874e48de1393b3c6172f4775b4ced48c3bc

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://signdesign-inc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
83 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d86fa09a2f9764c54486f84bb248963c9f074897cc923b794dbad6c661ddff10

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://signdesign-inc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
153 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ca7790436b9e9c5b04c082370a2c14ea074233b00056c855a741150ea3b7c648

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://signdesign-inc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
29 KB
29 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
eb726e7747d06812f1fd551161fb45b9aaa733f97e616eb1272ec9fc0501fa86

Request headers

Referer
http://signdesign-inc.com/
Origin
http://signdesign-inc.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

Content-Type
font/woff
truncated
/
30 KB
30 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
67284df54731fccb0b3c039cbeaab3474c057c5bc95accad964b13ef86eb1c8d

Request headers

Referer
http://signdesign-inc.com/
Origin
http://signdesign-inc.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

Content-Type
font/woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Sparkasse (Banking)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange function| $ function| jQuery

1 Cookies

Domain/Path Name / Value
signdesign-inc.com/ Name: PHPSESSID
Value: 1g4dflro92aq0qo8q4iq6o3j1r

1 Console Messages

Source Level URL
Text
security error URL: http://signdesign-inc.com/a0acfa46d86f7610b2c73dbb28f64701/login.php?user=true(Line 9)
Message:
X-Frame-Options may only be set via an HTTP header sent along with a document. It may not be set inside <meta>.