signdesign-inc.com Open in urlscan Pro
2606:4700:3032::6815:2748  Malicious Activity! Public Scan

URL: https://signdesign-inc.com/f75717b1518dcba29430776587a757fa/login.php?user=true
Submission: On December 01 via automatic, source openphish — Scanned from DE

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 4 HTTP transactions. The main IP is 2606:4700:3032::6815:2748, located in United States and belongs to CLOUDFLARENET, US. The main domain is signdesign-inc.com.
TLS certificate: Issued by GTS CA 1P5 on November 30th 2022. Valid for: 3 months.
This is the only time signdesign-inc.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Sparkasse (Banking)

Domain & IP information

IP Address AS Autonomous System
4 2606:4700:303... 13335 (CLOUDFLAR...)
4 2
Apex Domain
Subdomains
Transfer
4 signdesign-inc.com
signdesign-inc.com
862 KB
4 1
Domain Requested by
4 signdesign-inc.com signdesign-inc.com
4 1
Subject Issuer Validity Valid
*.signdesign-inc.com
GTS CA 1P5
2022-11-30 -
2023-02-28
3 months crt.sh

This page contains 1 frames:

Primary Page: https://signdesign-inc.com/f75717b1518dcba29430776587a757fa/login.php?user=true
Frame ID: 192D96D2D8FFA8C3D6B88331D97BCEAB
Requests: 12 HTTP requests in this frame

Screenshot

Page Title

Login Online-Banking

Detected technologies

Overall confidence: 100%
Detected patterns
  • <div class="[^"]*parbase

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

4
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

1167 kB
Transfer

2212 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request login.php
signdesign-inc.com/f75717b1518dcba29430776587a757fa/
624 KB
411 KB
Document
General
Full URL
https://signdesign-inc.com/f75717b1518dcba29430776587a757fa/login.php?user=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3032::6815:2748 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e26922445fd52bd6efc2ace9f45fbad53709c26e2615649f27ad83920cc00051

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
no-store, no-cache, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
772c2d205fa421bd-DUS
content-encoding
br
content-type
text/html; charset=UTF-8
date
Thu, 01 Dec 2022 13:30:14 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L6HXDQq4e38TOSdrkdz0LWti2BKJrw9BZp1uUv1bZIAsc8wzf4UbUXmC36Ku8xusNdVYRUPk777WCojDIu6hiSvM6Et2B7NlxUPz%2Bi5vT2wd8Kgvdhyg%2FMQ3VZHQTJmGHPq3blBS5BKW5ZPPCwbXtVA%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
l.css
signdesign-inc.com/f75717b1518dcba29430776587a757fa/partial/css/
531 KB
289 KB
Stylesheet
General
Full URL
https://signdesign-inc.com/f75717b1518dcba29430776587a757fa/partial/css/l.css
Requested by
Host: signdesign-inc.com
URL: https://signdesign-inc.com/f75717b1518dcba29430776587a757fa/login.php?user=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3032::6815:2748 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
09b45f5918aab70e96f98c653ed15f892ee8ba85c8ffae9b36d567cddbd3196a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://signdesign-inc.com/f75717b1518dcba29430776587a757fa/login.php?user=true
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date
Thu, 01 Dec 2022 13:30:14 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 29 Nov 2022 18:58:54 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
4487
etag
W/"6386566e-84ae4"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aVzDgT5FaBgJgAr63FyoJh3weeP9ANts%2F43rD2DEgo0UtjPaOw5qiJaRVAiFmYbt5wbm6JSD14Gxl%2Fg6UW%2FaUwrPEl0z%2F9omk2p5KYkkmQVngWtStg3nse1%2F9f9oobgIMDW4CxVFir%2Fl1L6K3KT%2Fuj4%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
772c2d21fab221bd-DUS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
jquery.js
signdesign-inc.com/f75717b1518dcba29430776587a757fa/partial/js/
266 KB
79 KB
Script
General
Full URL
https://signdesign-inc.com/f75717b1518dcba29430776587a757fa/partial/js/jquery.js
Requested by
Host: signdesign-inc.com
URL: https://signdesign-inc.com/f75717b1518dcba29430776587a757fa/login.php?user=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3032::6815:2748 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4ef5f864f89db7feaaaa5332c0a99d76076af49fef488806541ca2561e4cb379

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://signdesign-inc.com/f75717b1518dcba29430776587a757fa/login.php?user=true
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date
Thu, 01 Dec 2022 13:30:14 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 29 Nov 2022 18:58:54 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
4487
etag
W/"6386566e-4271b"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=slLdikc5jCbmRbSnreJoPJZZdxCB15617fbJWCeNob6Kns1FnnsP7pgA%2BpZl0L%2Bj29yim3HDHzh7KYbRmCTKTN1rYsAwWYn6Ics1ofFYzG6x26luq8nuJoxBEsLFCK1JVm079OJ6NL55WWRqucr5Jq4%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
772c2d21fab921bd-DUS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
index.jpg
signdesign-inc.com/f75717b1518dcba29430776587a757fa/partial/img/
83 KB
83 KB
Image
General
Full URL
https://signdesign-inc.com/f75717b1518dcba29430776587a757fa/partial/img/index.jpg
Requested by
Host: signdesign-inc.com
URL: https://signdesign-inc.com/f75717b1518dcba29430776587a757fa/login.php?user=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::6815:2748 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
281d0943765218606c764e99d16c2bcad4db7d3475ab596b00f9690cfa7c1f1e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://signdesign-inc.com/f75717b1518dcba29430776587a757fa/login.php?user=true
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date
Thu, 01 Dec 2022 13:30:14 GMT
cf-cache-status
HIT
last-modified
Tue, 29 Nov 2022 18:58:54 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
4486
etag
"6386566e-14a44"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HV%2FOxRCq44Gi6BVOKz80n3gQqqDfENQN3nt2%2F7vnod4lhZlVMrg9hj5xn5UbCqIz9V6nPOjkY%2F9R4bynO48NaK1%2BJrCgoaPZV5iuxlLR%2BVcKP2bAT1RjE2nZtwOThAJrmWGyCmyZu3k5nPBH9WqYYnI%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
772c2d224b64c4ae-DUS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
84548
truncated
/
6 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3edc58dd505c594baa6bd39f1641072b5a072f16410c6d0c4bf65df2cdb1d356

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
41 KB
41 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0e9eb66a1b33ae648ada3c56eb55fa149c4f1b88316b5a7255ca9b076740f451

Request headers

Referer
Origin
https://signdesign-inc.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

Content-Type
font/woff
truncated
/
204 KB
204 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ee88f0851598c363b9b465dd2606efb934c3357aaed3274d0f4a2e6d40b86951

Request headers

Referer
Origin
https://signdesign-inc.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

Content-Type
font/woff
truncated
/
164 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
25f042d00f4ce4bcff027d7b7e5c3874e48de1393b3c6172f4775b4ced48c3bc

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
83 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d86fa09a2f9764c54486f84bb248963c9f074897cc923b794dbad6c661ddff10

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
153 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ca7790436b9e9c5b04c082370a2c14ea074233b00056c855a741150ea3b7c648

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
29 KB
29 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
eb726e7747d06812f1fd551161fb45b9aaa733f97e616eb1272ec9fc0501fa86

Request headers

Referer
Origin
https://signdesign-inc.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

Content-Type
font/woff
truncated
/
30 KB
30 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
67284df54731fccb0b3c039cbeaab3474c057c5bc95accad964b13ef86eb1c8d

Request headers

Referer
Origin
https://signdesign-inc.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

Content-Type
font/woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Sparkasse (Banking)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange function| $ function| jQuery

1 Cookies

Domain/Path Name / Value
signdesign-inc.com/ Name: PHPSESSID
Value: jpnra27ro5imeh18bbndtfbi88

1 Console Messages

Source Level URL
Text
security error URL: https://signdesign-inc.com/f75717b1518dcba29430776587a757fa/login.php?user=true(Line 9)
Message:
X-Frame-Options may only be set via an HTTP header sent along with a document. It may not be set inside <meta>.