scandocusign.glitch.me Open in urlscan Pro
34.197.3.188 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://clt1377243.bmetrack.com/c/l?u=CC63B15&e=1302BE7&c=1503DB&t=1&l=62D93B41&1
Effective URL:
https://scandocusign.glitch.me/?ioxwrxnaerll&auth=&7589cf-3ac6-4e1c-9e2a-babd0161c3c4&utm_source=BenchmarkEmail&utm_campaign=Se...
Submission Tags: falconsandbox
Submission: On September 07 via api (September 7th 2021, 2:02:46 pm UTC) from US

Summary HTTP 18 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 8 IPs in 3 countries across 8 domains to perform 18 HTTP transactions. The main IP is 34.197.3.188, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is scandocusign.glitch.me.
TLS certificate: Issued by Amazon on January 18th 2021. Valid for: a year.

This is the only time scandocusign.glitch.me was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DocuSign (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	34.210.35.182 34.210.35.182	16509 (AMAZON-02) (AMAZON-02)
1	34.197.3.188 34.197.3.188	14618 (AMAZON-AES) (AMAZON-AES)
2	2a00:1450:400... 2a00:1450:4001:827::200a	15169 (GOOGLE) (GOOGLE)
2	185.81.100.38 185.81.100.38	62856 (DOCUS-6-PROD) (DOCUS-6-PROD)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:1b	20446 (HIGHWINDS3) (HIGHWINDS3)
1	2606:4700::68... 2606:4700::6810:125e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6812:acf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:82f::2003	15169 (GOOGLE) (GOOGLE)
18	8

1 34.210.35.182 (Boardman, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-210-35-182.us-west-2.compute.amazonaws.com

clt1377243.bmetrack.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.197.3.188 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-197-3-188.compute-1.amazonaws.com

scandocusign.glitch.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:827::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.81.100.38 (United States)

ASN62856 (DOCUS-6-PROD, US)

account.docusign.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:1b (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:125e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:acf (United States)

ASN13335 (CLOUDFLARENET, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
stackpath.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	bootstrapcdn.com maxcdn.bootstrapcdn.com stackpath.bootstrapcdn.com	28 KB
2	docusign.com account.docusign.com	241 KB
2	googleapis.com fonts.googleapis.com ajax.googleapis.com	30 KB
1	gstatic.com fonts.gstatic.com	14 KB
1	cloudflare.com cdnjs.cloudflare.com	6 KB
1	jquery.com code.jquery.com	24 KB
1	glitch.me scandocusign.glitch.me	73 KB
1	bmetrack.com 1 redirects clt1377243.bmetrack.com	520 B
18	8

	Domain	Requested by
2	account.docusign.com	scandocusign.glitch.me account.docusign.com
1	fonts.gstatic.com	fonts.googleapis.com
1	stackpath.bootstrapcdn.com	scandocusign.glitch.me
1	ajax.googleapis.com	scandocusign.glitch.me
1	maxcdn.bootstrapcdn.com	scandocusign.glitch.me
1	cdnjs.cloudflare.com	scandocusign.glitch.me
1	code.jquery.com	scandocusign.glitch.me
1	fonts.googleapis.com	scandocusign.glitch.me
1	scandocusign.glitch.me
1	clt1377243.bmetrack.com	1 redirects
18	10

This site contains links to these domains. Also see Links.

Domain
www.docusign.com

Subject Issuer	Validity	Valid
glitch.com Amazon	`2021-01-18` - `2022-02-15`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2021-08-23` - `2021-11-15`	3 months	crt.sh
account.docusign.com DigiCert SHA2 Extended Validation Server CA	`2020-01-09` - `2022-03-26`	2 years	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2021-07-14` - `2022-08-14`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-10-21` - `2021-10-20`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2021-08-16` - `2021-11-08`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://scandocusign.glitch.me/?ioxwrxnaerll&auth=&7589cf-3ac6-4e1c-9e2a-babd0161c3c4&utm_source=BenchmarkEmail&utm_campaign=Sep_07_2021_Email&utm_medium=email
Frame ID: 7CDB358F9061FF3FB433201B3C4E68F1
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

DocuSign Login - Enter your password to sign in

Page URL History Show full URLs

https://clt1377243.bmetrack.com/c/l?u=CC63B15&e=1302BE7&c=1503DB&t=1&l=62D93B41&1 HTTP 302
https://scandocusign.glitch.me/?ioxwrxnaerll&auth=&7589cf-3ac6-4e1c-9e2a-babd0161c3c4&utm_source=BenchmarkE... Page URL

Page Statistics

18
Requests

56 %
HTTPS

63 %
IPv6

8
Domains

10
Subdomains

8
IPs

3
Countries

417 kB
Transfer

597 kB
Size

0
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: http://www.docusign.com/support
Title: Help

Search URL Search Domain Scan URL

URL: https://www.docusign.com/company/terms-and-conditions/web
Title: Terms

Search URL Search Domain Scan URL

URL: https://www.docusign.com/IP
Title: Intellectual Property

Search URL Search Domain Scan URL

URL: https://www.docusign.com/company/privacy-policy
Title: Privacy Policy

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://clt1377243.bmetrack.com/c/l?u=CC63B15&e=1302BE7&c=1503DB&t=1&l=62D93B41&1 HTTP 302
https://scandocusign.glitch.me/?ioxwrxnaerll&auth=&7589cf-3ac6-4e1c-9e2a-babd0161c3c4&utm_source=BenchmarkEmail&utm_campaign=Sep_07_2021_Email&utm_medium=email Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
scandocusign.glitch.me/
Redirect Chain

https://clt1377243.bmetrack.com/c/l?u=CC63B15&e=1302BE7&c=1503DB&t=1&l=62D93B41&1
https://scandocusign.glitch.me/?ioxwrxnaerll&auth=&7589cf-3ac6-4e1c-9e2a-babd0161c3c4&utm_source=BenchmarkEmail&utm_campaign=Sep_07_2021_Email&utm_medium=email

73 KB
73 KB

392ms
150ms

Document
text/html

34.197.3.188
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://scandocusign.glitch.me/?ioxwrxnaerll&auth=&7589cf-3ac6-4e1c-9e2a-babd0161c3c4&utm_source=BenchmarkEmail&utm_campaign=Sep_07_2021_Email&utm_medium=email
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.197.3.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-197-3-188.compute-1.amazonaws.com
Software: /
Resource Hash: 326e254851dd5b00564c9f62bcc23c59be43fa8d713ffa6d7a35fb2fa4379021

Request headers

:method: GET
:authority: scandocusign.glitch.me
:scheme: https
:path: /?ioxwrxnaerll&auth=&7589cf-3ac6-4e1c-9e2a-babd0161c3c4&utm_source=BenchmarkEmail&utm_campaign=Sep_07_2021_Email&utm_medium=email
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 14:02:29 GMT
content-type: text/html; charset=utf-8
content-length: 74751
vary: Origin
accept-ranges: bytes
last-modified: Tue, 07 Sep 2021 13:39:38 GMT
cache-control: max-age=0
etag: W/"123ff-17bc07c5190"

Redirect headers

date: Tue, 07 Sep 2021 14:02:28 GMT
content-type: text/html; charset=utf-8
content-length: 296
location: https://scandocusign.glitch.me/?ioxwrxnaerll&auth=&7589cf-3ac6-4e1c-9e2a-babd0161c3c4&utm_source=BenchmarkEmail&utm_campaign=Sep_07_2021_Email&utm_medium=email
cache-control: private
server: Microsoft-IIS/10.0
set-cookie: ASP.NET_SessionId=5ihqpvdrdqwvyyl3v5jkhqqi; domain=bmetrack.com; path=/; SameSite=Lax sourcetracking=sourceid=0&phrase=%2fc%2fl%3fu%3dCC63B15%26e%3d1302BE7%26c%3d1503DB%26t%3d1%26l%3d62D93B41%261&refurl=&searchphrase=u%3dCC63B15%26e%3d1302BE7%26c%3d1503DB%26t%3d1%26l%3d62D93B41%261; expires=Wed, 05-Jan-2022 15:02:28 GMT; path=/
x-aspnet-version: 4.0.30319
x-xss-protection: 0

GET
H2 200 css2
fonts.googleapis.com/ 1 KB
541 B 17ms
16ms Stylesheet
text/css 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Glory:wght@600&display=swap

Requested by

Host: scandocusign.glitch.me
URL: https://scandocusign.glitch.me/?ioxwrxnaerll&auth=&7589cf-3ac6-4e1c-9e2a-babd0161c3c4&utm_source=BenchmarkEmail&utm_campaign=Sep_07_2021_Email&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c673f6df8a66df8cf930ccc5d3f8f49c2b85b9aea917daec578fdba3fc3f479c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://scandocusign.glitch.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 07 Sep 2021 14:02:29 GMT
server: ESF
date: Tue, 07 Sep 2021 14:02:29 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 07 Sep 2021 14:02:29 GMT

GET
H/1.1 200
OK app
account.docusign.com/LoginAppNext/styles/olive/and/ 237 KB
237 KB 198ms
24ms Stylesheet
text/css 185.81.100.38
DOCUS-6-PROD

General

Check archive.org

Show headers Download Go to

Full URL

https://account.docusign.com/LoginAppNext/styles/olive/and/app?v=tiqsr6oBo-_Knk4cFQLuhKBfb9ovqa3UGyqEd2nB4pk1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.81.100.38 , United States, ASN62856 (DOCUS-6-PROD, US),

Reverse DNS

Software

Resource Hash

f74660ffb85982c6110b73115e537af60a88c4b4209915af614574452015819d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://scandocusign.glitch.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Last-Modified: Tue, 07 Sep 2021 14:02:29 GMT
Date: Tue, 07 Sep 2021 14:02:29 GMT
Vary: User-Agent
Content-Type: text/css; charset=utf-8
Cache-Control: public
X-DocuSign-Node: FR2FE22
Content-Length: 242202
Expires: Wed, 07 Sep 2022 14:02:29 GMT

GET
H2 200 jquery-3.2.1.slim.min.js Show response
code.jquery.com/ 68 KB
24 KB 32ms
12ms Script
application/javascript 2001:4de0:ac18::1:a:1b
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.2.1.slim.min.js
Requested by: Host: scandocusign.glitch.me
URL: https://scandocusign.glitch.me/?ioxwrxnaerll&auth=&7589cf-3ac6-4e1c-9e2a-babd0161c3c4&utm_source=BenchmarkEmail&utm_campaign=Sep_07_2021_Email&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:1b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398

Request headers

Referer: https://scandocusign.glitch.me/
Origin: https://scandocusign.glitch.me
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Tue, 07 Sep 2021 14:02:29 GMT
content-encoding: gzip
last-modified: Mon, 20 Mar 2017 19:01:15 GMT
server: nginx
etag: W/"58d026fb-10fdd"
vary: Accept-Encoding
x-hw: 1631023349.dop246.fr8.t,1631023349.cds274.fr8.hc,1631023349.cds257.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 23856

GET
H2 200 popper.min.js Show response
cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/ 19 KB
6 KB 16ms
14ms Script
application/javascript 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://scandocusign.glitch.me/
Origin: https://scandocusign.glitch.me
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Tue, 07 Sep 2021 14:02:29 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 486316
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 6157
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:15:37 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03fa9-4af4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dDCQap7SoZV3Ydh%2BoyExubxx6W3gmWW1OprWmkGpGLnMvM7TZ9RZkhaJfMg8F87Ap3P2r%2Fza5fi%2Feukho60eDAhiT0sWDVu%2Fp6z3oyMHezmIa21QEOsG1xfLvekXxwZSb6TtH%2Bdc8b7xnjB0fOOBjJKQ"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 68b0799daab34ee6-FRA
expires: Sun, 28 Aug 2022 14:02:29 GMT

GET
H2 200 bootstrap.min.js Show response
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/ 48 KB
13 KB 22ms
21ms Script
application/javascript 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://scandocusign.glitch.me/
Origin: https://scandocusign.glitch.me
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Tue, 07 Sep 2021 14:02:29 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 601
age: 7152
cdn-cachedat: 08/04/2021 00:04:37
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cdn-proxyver: 1.0
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:04 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: 6fef9250a73dc003d5ad9a16e7fc90e7
cf-ray: 68b0799dacd0434b-FRA
cdn-requestcountrycode: DE
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ 84 KB
29 KB 11ms
9ms Script
text/javascript 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://scandocusign.glitch.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Tue, 07 Sep 2021 11:07:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 10477
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30028
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 07 Sep 2022 11:07:52 GMT

GET
H2 200 bootstrap.min.js Show response
stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/ 50 KB
15 KB 34ms
15ms Script
application/javascript 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://scandocusign.glitch.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Tue, 07 Sep 2021 14:02:29 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 723, 718
age: 14576066
cdn-cachedat: 2021-03-11 11:57:52
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:06 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: 48f4598378fe1b699fcee6ac68d6cc25
cf-ray: 68b0799dcbe9061c-FRA
cdn-requestcountrycode: DE
cdn-requestpullsuccess: True

GET
H/1.1 200
OK docusign_logo_small.png
account.docusign.com/LoginAppNext/images/ 4 KB
4 KB 195ms
22ms Image
image/png 185.81.100.38
DOCUS-6-PROD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://account.docusign.com/LoginAppNext/images/docusign_logo_small.png

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.81.100.38 , United States, ASN62856 (DOCUS-6-PROD, US),

Reverse DNS

Software

Resource Hash

e83f8d0b4a78d14185abfca96ee2fbaf18e396a047f725d944ff27a845787279

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://scandocusign.glitch.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Last-Modified: Fri, 13 Aug 2021 20:18:15 GMT
ETag: "314941598090d71:0"
Content-Type: image/png
Date: Tue, 07 Sep 2021 14:02:29 GMT
Accept-Ranges: bytes
X-DocuSign-Node: FR2FE21
Content-Length: 4064

GET HelveticaNeueW01-55Roma.woff
account.docusign.com/LoginAppNext/styles/olive/fonts/ 0
0

GET
H2 200 q5uasoi9Lf1w5t3Est24nq9blIRQHo6zoXWc.woff2
fonts.gstatic.com/s/glory/v2/ 14 KB
14 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/glory/v2/q5uasoi9Lf1w5t3Est24nq9blIRQHo6zoXWc.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Glory:wght@600&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

736e2d67ef5cd2c63ab6148685d66db06dc9829dd78a4d3acae66c18586e2ee1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://scandocusign.glitch.me
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 03 Sep 2021 18:16:40 GMT
x-content-type-options: nosniff
age: 330349
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14604
x-xss-protection: 0
last-modified: Wed, 18 Aug 2021 22:55:20 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 03 Sep 2022 18:16:40 GMT

GET maven_pro_bold.woff
account.docusign.com/LoginAppNext/styles/olive/fonts/ 0
0

GET olive-icons.woff
account.docusign.com/LoginAppNext/styles/olive/fonts/ 0
0

GET HelveticaNeueW01-55Roma.ttf
account.docusign.com/LoginAppNext/styles/olive/fonts/ 0
0

GET maven_pro_bold.ttf
account.docusign.com/LoginAppNext/styles/olive/fonts/ 0
0

GET olive-icons.ttf
account.docusign.com/LoginAppNext/styles/olive/fonts/ 0
0

GET HelveticaNeueW01-75Bold.woff
account.docusign.com/LoginAppNext/styles/olive/fonts/ 0
0

GET HelveticaNeueW01-75Bold.ttf
account.docusign.com/LoginAppNext/styles/olive/fonts/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: account.docusign.com
URL: https://account.docusign.com/LoginAppNext/styles/olive/fonts/HelveticaNeueW01-55Roma.woff

Domain: account.docusign.com
URL: https://account.docusign.com/LoginAppNext/styles/olive/fonts/maven_pro_bold.woff

Domain: account.docusign.com
URL: https://account.docusign.com/LoginAppNext/styles/olive/fonts/olive-icons.woff

Domain: account.docusign.com
URL: https://account.docusign.com/LoginAppNext/styles/olive/fonts/HelveticaNeueW01-55Roma.ttf

Domain: account.docusign.com
URL: https://account.docusign.com/LoginAppNext/styles/olive/fonts/maven_pro_bold.ttf

Domain: account.docusign.com
URL: https://account.docusign.com/LoginAppNext/styles/olive/fonts/olive-icons.ttf

Domain: account.docusign.com
URL: https://account.docusign.com/LoginAppNext/styles/olive/fonts/HelveticaNeueW01-75Bold.woff

Domain: account.docusign.com
URL: https://account.docusign.com/LoginAppNext/styles/olive/fonts/HelveticaNeueW01-75Bold.ttf

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DocuSign (Online)

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

account.docusign.com
ajax.googleapis.com
cdnjs.cloudflare.com
clt1377243.bmetrack.com
code.jquery.com
fonts.googleapis.com
fonts.gstatic.com
maxcdn.bootstrapcdn.com
scandocusign.glitch.me
stackpath.bootstrapcdn.com
account.docusign.com
185.81.100.38
2001:4de0:ac18::1:a:1b
2606:4700::6810:125e
2606:4700::6812:acf
2a00:1450:4001:827::200a
2a00:1450:4001:82f::2003
34.197.3.188
34.210.35.182
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
326e254851dd5b00564c9f62bcc23c59be43fa8d713ffa6d7a35fb2fa4379021
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
736e2d67ef5cd2c63ab6148685d66db06dc9829dd78a4d3acae66c18586e2ee1
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
c673f6df8a66df8cf930ccc5d3f8f49c2b85b9aea917daec578fdba3fc3f479c
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b
e83f8d0b4a78d14185abfca96ee2fbaf18e396a047f725d944ff27a845787279
f74660ffb85982c6110b73115e537af60a88c4b4209915af614574452015819d

scandocusign.glitch.me Open in urlscan Pro 34.197.3.188 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

18 Requests

56 %HTTPS

63 %IPv6

8 Domains

10 Subdomains

8 IPs

3 Countries

417 kBTransfer

597 kBSize

0 Cookies

4 Outgoing links

Page URL History

Redirected requests

18 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

18 JavaScript Global Variables

0 Cookies

Indicators

scandocusign.glitch.me Open in urlscan Pro
34.197.3.188 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

18
Requests

56 %
HTTPS

63 %
IPv6

8
Domains

10
Subdomains

8
IPs

3
Countries

417 kB
Transfer

597 kB
Size

0
Cookies

18 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!