gunzeys.com
Open in
urlscan Pro
198.143.149.146
Malicious Activity!
Public Scan
URL:
https://gunzeys.com/docc/docusi/b6e65d38ac343f9834dfe612bd03ab13/login.php?cmd=login_submit&id=75ef34c6df046f6e3691b...
Submission: On April 27 via api from US
Submission: On April 27 via api from US
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 12 HTTP transactions.
The main IP is 198.143.149.146, located in
Chicago, United States and
belongs to SINGLEHOP-LLC - SingleHop LLC, US.
The main domain is gunzeys.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on March 11th 2018. Valid for: 3 months.
This is the only time gunzeys.com was scanned on urlscan.io!
TLS certificate: Issued by cPanel, Inc. Certification Authority on March 11th 2018. Valid for: 3 months.
This is the only time gunzeys.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: DocuSign (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 12 | 198.143.149.146 198.143.149.146 | 32475 (SINGLEHOP...) (SINGLEHOP-LLC - SingleHop LLC) | |
| 12 | 1 |
12
198.143.149.146
(Chicago, United States)
ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US)
PTR: shared.reliabledns.org
ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US)
PTR: shared.reliabledns.org
| gunzeys.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 12 |
gunzeys.com
gunzeys.com |
85 KB |
| 12 | 1 |
| Domain | Requested by | |
|---|---|---|
| 12 | gunzeys.com |
gunzeys.com
|
| 12 | 1 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| gunzeys.com cPanel, Inc. Certification Authority |
2018-03-11 - 2018-06-09 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://gunzeys.com/docc/docusi/b6e65d38ac343f9834dfe612bd03ab13/login.php?cmd=login_submit&id=75ef34c6df046f6e3691b5fe890e26c175ef34c6df046f6e3691b5fe890e26c1&session=75ef34c6df046f6e3691b5fe890e26c175ef34c6df046f6e3691b5fe890e26c1
Frame ID: 60132F27D4087F861FEF1016D6E85CC
Requests: 12 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
login.php
gunzeys.com/docc/docusi/b6e65d38ac343f9834dfe612bd03ab13/ |
4 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bg_2.png
gunzeys.com/docc/docusi/b6e65d38ac343f9834dfe612bd03ab13/images/ |
12 KB 12 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bgt_1.png
gunzeys.com/docc/docusi/b6e65d38ac343f9834dfe612bd03ab13/images/ |
30 KB 30 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
log_1.png
gunzeys.com/docc/docusi/b6e65d38ac343f9834dfe612bd03ab13/images/ |
10 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
al.png
gunzeys.com/docc/docusi/b6e65d38ac343f9834dfe612bd03ab13/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
ght_1.png
gunzeys.com/docc/docusi/b6e65d38ac343f9834dfe612bd03ab13/images/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
link.png
gunzeys.com/docc/docusi/b6e65d38ac343f9834dfe612bd03ab13/images/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
gml_1.png
gunzeys.com/docc/docusi/b6e65d38ac343f9834dfe612bd03ab13/images/ |
8 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
aol_1.png
gunzeys.com/docc/docusi/b6e65d38ac343f9834dfe612bd03ab13/images/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
out_1.png
gunzeys.com/docc/docusi/b6e65d38ac343f9834dfe612bd03ab13/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
yhoo_1.png
gunzeys.com/docc/docusi/b6e65d38ac343f9834dfe612bd03ab13/images/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
othr_1.png
gunzeys.com/docc/docusi/b6e65d38ac343f9834dfe612bd03ab13/images/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: DocuSign (Online)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| unhideBody function| popupwnd0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
| Header | Value |
|---|---|
| X-Content-Type-Options | nosniff |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
gunzeys.com
198.143.149.146
005101fe64038dbce27c6ea43572753c01558afe91aa0559cf6d454f66467dcb
119a3fa21f30bccd9eb68cc950e98ec8e3127eaec82635b5cf9cc10dc6f19331
456bb08d54fc6d1b5845973af0c5e70f371a3bed73ff772f90d068286c77b47e
45905ef26f1e94cf62c1103afad0fa1578970c1f82cbc9dbe41f9efd5a6e7274
49bc720e83f1973af99faad469f4266d2a8fb327bd4f1d43b3305f6cb7455606
4c55a3172ff4df1893668154d1e9e6fa191feda7c6187c8f3c5d4c927a3baf27
4d82d2a5fa1c5cc84a29e1b71eb00372b7de63f4833afc7c706bdcda181c783a
4fc98691bc60282e1de72ae31efd4a1f81f2982574d45160db3b5deee3c07a1a
a649a7312cbe91e720c59fc5f2fb9fbaf9f8738aee0c8e4c04f00b18e43f7685
b24f0a767aaa4c6d6fff76b17a8e19789c5d5f61a54dd5c0b521a75981fc526f
c19d43c5256b6cd31644f0ac74ba6bf1d2c364ba0c07010cce4a2d06f64a42d4
e3be02d02217991ffee3031ab79bb29a545343f47fbfccfcbdeeb76a7d0b0676