![](/screenshots/a542033a-256f-4cbb-bdd2-446b30ae44fd.png)
naturelle-water.com
Open in
urlscan Pro
216.55.182.65
Malicious Activity!
Public Scan
Effective URL: https://naturelle-water.com/sync/folders/cloud/40528d29df18715f24d604c01e2a417d/fu92d712v3pqxu8beemtxdsa7fub6onkyk577n$64011...
Submission: On September 05 via manual from SE
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on August 21st 2018. Valid for: 3 months.
This is the only time naturelle-water.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: DocuSign (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 7 | 216.55.182.65 216.55.182.65 | 18501 (CODERO-DFW) (CODERO-DFW - Codero) | |
1 | 2.16.106.58 2.16.106.58 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
3 | 162.248.184.27 162.248.184.27 | 62856 (DOCUS-6-PROD) (DOCUS-6-PROD - Docusign) | |
1 | 52.222.161.13 52.222.161.13 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
1 | 2a02:26f0:6c0... 2a02:26f0:6c00:28e::38f3 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 | 2a00:1450:400... 2a00:1450:4001:819::2003 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
2 | 151.101.132.193 151.101.132.193 | 54113 (FASTLY) (FASTLY - Fastly) | |
1 | 2a00:1288:110... 2a00:1288:110:c104::3000 | 34010 (YAHOO-IRD) (YAHOO-IRD) | |
1 | 172.227.98.73 172.227.98.73 | 16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies) | |
1 | 143.204.101.124 143.204.101.124 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
2 | 2.16.106.88 2.16.106.88 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
18 | 11 |
ASN18501 (CODERO-DFW - Codero, US)
PTR: host.mindfield.co
naturelle-water.com |
ASN20940 (AKAMAI-ASN1, US)
PTR: a2-16-106-58.deploy.static.akamaitechnologies.com
docucdn-a.akamaihd.net |
ASN62856 (DOCUS-6-PROD - Docusign, Inc, US)
PTR: www.docusign.net
www.docusign.net |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-52-222-161-13.fra54.r.cloudfront.net
d3hmp0045zy3cs.cloudfront.net |
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a172-227-98-73.deploy.static.akamaitechnologies.com
img1.wsimg.com |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-143-204-101-124.fra50.r.cloudfront.net
docj27ko03fnu.cloudfront.net |
ASN20940 (AKAMAI-ASN1, US)
PTR: a2-16-106-88.deploy.static.akamaitechnologies.com
docucdn-a.akamaihd.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
naturelle-water.com
3 redirects
naturelle-water.com |
41 KB |
3 |
docusign.net
www.docusign.net |
110 KB |
3 |
akamaihd.net
docucdn-a.akamaihd.net |
81 KB |
2 |
imgur.com
i.imgur.com |
14 KB |
2 |
cloudfront.net
d3hmp0045zy3cs.cloudfront.net docj27ko03fnu.cloudfront.net |
2 KB |
1 |
wsimg.com
img1.wsimg.com |
1 KB |
1 |
yahoo.com
login.yahoo.com |
7 KB |
1 |
google.com.gh
www.google.com.gh |
2 KB |
1 |
msocdn.com
officehome.msocdn.com |
9 KB |
18 | 9 |
Domain | Requested by | |
---|---|---|
7 | naturelle-water.com |
3 redirects
naturelle-water.com
|
3 | www.docusign.net |
naturelle-water.com
|
3 | docucdn-a.akamaihd.net |
naturelle-water.com
|
2 | i.imgur.com |
naturelle-water.com
|
1 | docj27ko03fnu.cloudfront.net |
naturelle-water.com
|
1 | img1.wsimg.com |
naturelle-water.com
|
1 | login.yahoo.com |
naturelle-water.com
|
1 | www.google.com.gh |
naturelle-water.com
|
1 | officehome.msocdn.com |
naturelle-water.com
|
1 | d3hmp0045zy3cs.cloudfront.net |
naturelle-water.com
|
18 | 10 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
naturelle-water.com cPanel, Inc. Certification Authority |
2018-08-21 - 2018-11-19 |
3 months | crt.sh |
a248.e.akamai.net DigiCert ECC Secure Server CA |
2018-01-23 - 2019-01-19 |
a year | crt.sh |
www.docusign.net DigiCert SHA2 Extended Validation Server CA |
2018-06-27 - 2019-06-23 |
a year | crt.sh |
*.cloudfront.net DigiCert Global CA G2 |
2017-11-22 - 2018-11-21 |
a year | crt.sh |
*.msocdn.com Microsoft IT TLS CA 4 |
2018-01-02 - 2020-01-02 |
2 years | crt.sh |
*.google.com.gh Google Internet Authority G3 |
2018-08-14 - 2018-10-23 |
2 months | crt.sh |
*.imgur.com DigiCert SHA2 Secure Server CA |
2017-11-15 - 2019-01-09 |
a year | crt.sh |
*.login.yahoo.com DigiCert SHA2 High Assurance Server CA |
2018-08-31 - 2019-03-03 |
6 months | crt.sh |
*.wsimg.com Starfield Secure Certificate Authority - G2 |
2015-11-13 - 2018-11-13 |
3 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://naturelle-water.com/sync/folders/cloud/40528d29df18715f24d604c01e2a417d/fu92d712v3pqxu8beemtxdsa7fub6onkyk577n$64011zcqa3ea@gdt4lffxbiy0ls0fz23s2491hlhc&=eyibbetx@978dozxpgxw5x0264lobvprsp0b5lp=gq0dvlcx=ag=zu3p&0$$qxyl3gj9jp1az@&o6&k0t5rqj$8ifc$47ds146lzf2ni$aievno@jabk5nf4ylho&acar&ivuuuip1ime0@y&lbucriolx13oiwdbga0uh85.php?login=kristoffer.housset@westander.se&.verify?service=mail&data:text/html;js6/main.jsp?sid=CAgbePXXjcVpfthPNgXXCcgDQZImqqTE&df=webmail126
Frame ID: 85DF4D2279D8F4848B4CBF4EDE83631A
Requests: 18 HTTP requests in this frame
Screenshot
![](/screenshots/a542033a-256f-4cbb-bdd2-446b30ae44fd.png)
Page URL History Show full URLs
-
https://naturelle-water.com/sync/folders/cloud/?login=kristoffer.housset@westander.se
HTTP 302
https://naturelle-water.com/sync/folders/cloud/40528d29df18715f24d604c01e2a417d?login=kristoffer.housset... HTTP 301
https://naturelle-water.com/sync/folders/cloud/40528d29df18715f24d604c01e2a417d/?login=kristoffer.housse... HTTP 302
https://naturelle-water.com/sync/folders/cloud/40528d29df18715f24d604c01e2a417d/fu92d712v3pqxu8beemtxdsa... Page URL
Detected technologies
Detected patterns
- headers server /php\/?([\d.]+)?/i
![](/vendor/wappa/icons/OpenSSL.png)
Detected patterns
- headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Detected patterns
- env /^jQuery$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://naturelle-water.com/sync/folders/cloud/?login=kristoffer.housset@westander.se
HTTP 302
https://naturelle-water.com/sync/folders/cloud/40528d29df18715f24d604c01e2a417d?login=kristoffer.housset@westander.se&.login?c=aHR0cDovL3d3dy5hcHBsZS5jb20vc2hvcHwxYW9zNGJjMzU3MDM3ZTc1NmQ3NGY4MTI3ZGZhMWNkNDBlNWZkNGY0MWNhZQ&r=SDHCD9JUYKX777H9KT9JT7JJTAPAXHFKH&s=aHR0cHM6Ly9zZWN1cmUyLnN0b3JlLmFwcGxlLmNvbS9zaG9wL2FjY291bnQvc2V0dXAvc3RhcnQ_c= HTTP 301
https://naturelle-water.com/sync/folders/cloud/40528d29df18715f24d604c01e2a417d/?login=kristoffer.housset@westander.se&.login?c=aHR0cDovL3d3dy5hcHBsZS5jb20vc2hvcHwxYW9zNGJjMzU3MDM3ZTc1NmQ3NGY4MTI3ZGZhMWNkNDBlNWZkNGY0MWNhZQ&r=SDHCD9JUYKX777H9KT9JT7JJTAPAXHFKH&s=aHR0cHM6Ly9zZWN1cmUyLnN0b3JlLmFwcGxlLmNvbS9zaG9wL2FjY291bnQvc2V0dXAvc3RhcnQ_c= HTTP 302
https://naturelle-water.com/sync/folders/cloud/40528d29df18715f24d604c01e2a417d/fu92d712v3pqxu8beemtxdsa7fub6onkyk577n$64011zcqa3ea@gdt4lffxbiy0ls0fz23s2491hlhc&=eyibbetx@978dozxpgxw5x0264lobvprsp0b5lp=gq0dvlcx=ag=zu3p&0$$qxyl3gj9jp1az@&o6&k0t5rqj$8ifc$47ds146lzf2ni$aievno@jabk5nf4ylho&acar&ivuuuip1ime0@y&lbucriolx13oiwdbga0uh85.php?login=kristoffer.housset@westander.se&.verify?service=mail&data:text/html;js6/main.jsp?sid=CAgbePXXjcVpfthPNgXXCcgDQZImqqTE&df=webmail126 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
18 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
fu92d712v3pqxu8beemtxdsa7fub6onkyk577n$64011zcqa3ea@gdt4lffxbiy0ls0fz23s2491hlhc&=eyibbetx@978dozxpgxw5x0264lobvprsp0b5lp=gq0dvlcx=ag=zu3p&0$$qxyl3gj9jp1az@&o6&k0t5rqj$8ifc$47ds146lzf2ni$aievno@jab...
naturelle-water.com/sync/folders/cloud/40528d29df18715f24d604c01e2a417d/ Redirect Chain
|
71 KB 15 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
font-faces.css
docucdn-a.akamaihd.net/signing/1.9.0/css/ |
6 KB 866 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
XmlHttp.js
www.docusign.net/Member/script/ |
14 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-1.10.2.min.js
www.docusign.net/Member/client_scripts/JQuery/ |
91 KB 91 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
framework.css
naturelle-water.com/sync/folders/cloud/40528d29df18715f24d604c01e2a417d/assets/css/ |
4 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
activate.css
naturelle-water.com/sync/folders/cloud/40528d29df18715f24d604c01e2a417d/assets/css/ |
6 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
adobe-cloud.png
naturelle-water.com/sync/folders/cloud/40528d29df18715f24d604c01e2a417d/assets/img/ |
21 KB 21 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
live_id.png
d3hmp0045zy3cs.cloudfront.net/2.2.25/icons/janrain-providers/24/ |
338 B 859 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
favicon_metro.ico
officehome.msocdn.com/s/7047452e/Images/ |
9 KB 9 KB |
Image
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
googleg_lodp.ico
www.google.com.gh/images/branding/product/ico/ |
5 KB 2 KB |
Image
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
9PMuIdF.png
i.imgur.com/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
favicon.ico
login.yahoo.com/ |
5 KB 7 KB |
Image
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
%7B3A44F70D-6D11-4C14-B611-A1F191704047%7Dgodaddy.ico
img1.wsimg.com/Sitecore/3/A/4/ |
2 KB 1 KB |
Image
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
mPIx1Ca.png
i.imgur.com/ |
12 KB 12 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
btn_arrow_u.png
www.docusign.net/Member/Images/controls/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ee9d3aa7c5896c69488b5941ef31c7bc.png
docj27ko03fnu.cloudfront.net/rel/img/ |
993 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
HelveticaNeue.ttf
docucdn-a.akamaihd.net/signing/1.9.0/fonts/helvetica-neue/ |
103 KB 48 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
MavenPro-Bold.ttf
docucdn-a.akamaihd.net/signing/1.9.0/fonts/maven-pro/ |
97 KB 33 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: DocuSign (Online)56 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| timeInfo function| DSLogEvent number| XmlLoaderCount function| XmlLoader function| IEXmlLoader function| MoXmlLoader number| currBrowserVer undefined| ua undefined| re function| XmlWrapper function| XmlWrapperFromXml function| IEXmlWrapper function| IEXmlWrapperFromXml function| MOXmlWrapper function| intro function| MOXmlWrapperFromXml function| WindowTracer function| SpanTracer function| GetURLTimeStamp function| xDom function| SingleNode function| SingleNodeT function| xSelectNodes function| $ function| jQuery string| bdyId string| formbodyId string| borderId string| headertabsId string| headerId string| footerId string| tiId string| headerContentId string| hldrOutside string| masterIsMobile string| masterIsSafari boolean| leavemastermenuopen function| BtnCancelMD function| ChangeSelectedAccount function| CE function| MasterPageAction function| ChangeSite function| CloseMasterPageMenus function| OpenMasterPageMenu function| ShowAccounts function| LogoSizePage function| MasterPageBrowserWidth function| MasterPageScrollLeft function| upgradeClick function| linkClick_TermsOfUse function| linkClick_CorporateSupport function| linkClick_Feedback function| linkClick_IntellectualProp function| linkClick_PrivacyPolicy undefined| pm undefined| bdy0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
d3hmp0045zy3cs.cloudfront.net
docj27ko03fnu.cloudfront.net
docucdn-a.akamaihd.net
i.imgur.com
img1.wsimg.com
login.yahoo.com
naturelle-water.com
officehome.msocdn.com
www.docusign.net
www.google.com.gh
143.204.101.124
151.101.132.193
162.248.184.27
172.227.98.73
2.16.106.58
2.16.106.88
216.55.182.65
2a00:1288:110:c104::3000
2a00:1450:4001:819::2003
2a02:26f0:6c00:28e::38f3
52.222.161.13
015a8b230071ba12f8d35bc401908c7fdf9a27af371c235e253db9cfc738f732
0ec1a6dd2c20f6c2387507514ce2f882c795aa582028c0d75eb757de92d59c34
129f4c25b5ec38ba815cbdf948a6f73c388b12774b32ed200eed51318dd06bde
24db21fae57bd5aa0c40df6fd9c90b4bd152a5da86dd1e15020359279bec9c38
29c9e8752f25b17961e3c6ff72de34b1f1a157dfc5fabb68bd148b8ec9002b17
316edc0bf34bd527c50793eb5c134ad5582060f7743ae28b6ee2c07ac391de93
5068173ee4b00352feadd5b45c46e81a2f9c74ff40a8fd7d592e2f83effc7026
51d1e3001eca5e8bd28cc400fec6599d322d693e46785a07925f4ed3019ab121
6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
74368197cb53191e522e3a73aab974d53eae8e38da694a1ed2cfa06f39176e58
ace1d6f5c97c7945d09b1433aa8543eb578dc77cee661965546ede3d91d23df3
b4e7feeac800a7a9c0b9eb93259ec10d72302264d6614f5af0e04c81d592032e
d8f950f48e3ecababede8064265c1d3c66a80dd88db5ed9c404365e167282f12
ddad9ef041e5dc44b47787c6cea1ea85fada60fe99a9b1fe83f0ce0d8b9941e0
e0d14d61d5d0f898acd9dbcd4b579a91f8372a9d60b0f0f6b2095a2b749fb317
e1b12e36c2e781fdbe301bc99c4638adf0747fb3dbda8df5add226acac0bcc73
e4577fd482656cedae01184f825a73987d1191da07eeb446bb4e177762a0a216
fd570b7c764302cc607e5d1bfffa5effdf6f55ca23fe65092599f52ff49d90ae