![](/screenshots/abe5d16c-4b29-491c-bdab-eb347a667ef4.png)
1signdoc.cloud
Open in
urlscan Pro
185.61.153.110
Malicious Activity!
Public Scan
Submission: On October 13 via manual from US — Scanned from GB
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on October 12th 2022. Valid for: a year.
This is the only time 1signdoc.cloud was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 185.61.153.110 185.61.153.110 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
10 | 185.61.153.108 185.61.153.108 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
1 | 2a02:26f0:350... 2a02:26f0:3500:592::35c1 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
12 | 3 |
ASN22612 (NAMECHEAP-NET, US)
PTR: server257-4.web-hosting.com
1signdoc.cloud |
ASN22612 (NAMECHEAP-NET, US)
PTR: server257-3.web-hosting.com
signone.cloud |
ASN20940 (AKAMAI-ASN1, NL)
secure.aadcdn.microsoftonline-p.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
signone.cloud
signone.cloud |
38 KB |
1 |
microsoftonline-p.com
secure.aadcdn.microsoftonline-p.com — Cisco Umbrella Rank: 11706 |
2 KB |
1 |
1signdoc.cloud
1signdoc.cloud |
891 B |
12 | 3 |
Domain | Requested by | |
---|---|---|
10 | signone.cloud |
1signdoc.cloud
signone.cloud |
1 | secure.aadcdn.microsoftonline-p.com |
signone.cloud
|
1 | 1signdoc.cloud | |
12 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
1signdoc.cloud Sectigo RSA Domain Validation Secure Server CA |
2022-10-12 - 2023-10-12 |
a year | crt.sh |
signone.cloud Sectigo RSA Domain Validation Secure Server CA |
2022-10-12 - 2023-10-12 |
a year | crt.sh |
secure.aadcdn.microsoftonline-p.com Microsoft RSA TLS CA 02 |
2021-11-18 - 2022-11-18 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://1signdoc.cloud/?cloaking=offer&c=E,1,07YBZVNi6hoUC8-Yaj37JcorJVmzArGRk_PP_rsv3ipOK70Bi8QaVMXkrHxfDSvq5tvLKCmYzo95BzWmOkm548IyBm-jaZI_8KTZ8GxF0E7t37sl&typo=1
Frame ID: 7C203D781639B18ACAED5FF58EFB69C1
Requests: 1 HTTP requests in this frame
Frame:
https://signone.cloud/O%20V%206/page/verify?L08lMjBWJTIwNi81NjdhZDZhMDRlYzU3MDQ3NGRiN2ExYjE3NjViY2FlNzAyYjNlNjU1MDE1NDAxMjAwODQwMTYwMzllMGM3NGYyN2RiOWNlYmJjZTM0ZWRlZTNiOWViNGY1OTc4NzQ1NjAxNTQwMTIwMDg0MDE2MGQzMzZjMjBiZTEyMGI4OWM3NTExYmY0NmI1NmNiMDQzMWU3OTNmNDUwMTU0MDEyMDA4NDAxNjBhOWRiZWQxZjc5MjcwOTJiN2QwODliNjRiODVhYTdkMWFlNjk0Zjk3MDE1NDAxMjAwODQwMTYwL3BhZ2UvdmVyaWZ5KEQSwkCg-u1cQ-bjSU-hCz6-tm4VvFEqYjB6_wnRWTXbDHphQ9CG4vz1gcFmfiB3VjIlNOUeSMsP6JqKdo5uLaZu13amon0WGNKRjz82VTZAB4cCYitJXUEQq5xfHMwIsSkh9l6DgGzvPa2lWqKnIrChm4ESbwOcftV0BJAN5Yk38QpTM9Ld6sgDHu1&status=putuser
Frame ID: 843E864C81EA84F2C7ADA9983B5A93A1
Requests: 11 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
1signdoc.cloud/ |
1 KB 891 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
verify
signone.cloud/O%20V%206/page/ Frame 843E |
19 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
signone.cloud/O%20V%206/page/css/ Frame 843E |
94 KB 15 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
microsoft_logo.svg
secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/ Frame 843E |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sigin2.png
signone.cloud/O%20V%206/page/images/ Frame 843E |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
firstmsg1.png
signone.cloud/O%20V%206/page/images/ Frame 843E |
8 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
noacc.png
signone.cloud/O%20V%206/page/images/ Frame 843E |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cantacces.png
signone.cloud/O%20V%206/page/images/ Frame 843E |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sigopt.png
signone.cloud/O%20V%206/page/images/ Frame 843E |
1023 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ellipsis_grey.svg
signone.cloud/O%20V%206/page/images/ Frame 843E |
915 B 448 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
continue.png
signone.cloud/O%20V%206/page/images/ Frame 843E |
495 B 695 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
putmail.png
signone.cloud/O%20V%206/page/images/ Frame 843E |
607 B 807 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)10 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
1signdoc.cloud
secure.aadcdn.microsoftonline-p.com
signone.cloud
185.61.153.108
185.61.153.110
2a02:26f0:3500:592::35c1
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
16c3f6531d0fa5b4d16e82abf066233b2a9f284c068c663699313c09f5e8d6e6
1cf4b3ad7abf3189e78c1b3bd07308c92a03fa795fdbc5821fcde24030cfead0
31d00cffecdca4b5ffb112c7f4a0f3f4734954ce22e13da32f670b897f3a87ed
37b9fc582daf62db4435d5e57a767e9f66de99e8f9d138c7376b3c7c59a2e7be
45bcfbb3d06eacae315e8f641dfcfa11af31da7d6a8e3dc002f00cbe193708e9
4e50e37d29c6a3c1f0f1ae57cb0ccb78d2c2f518ad53d8df37f3baae76e9c08a
52437f983f1667f1d4043ea60d89e5f0f38acd4ca794eb77585b714490fbcea1
8f5537fcea8ad9835744175e3e6f04e5999c8fe1b98a032b7ffe8e1ce9835e58
97a4488434a10d406081498268d1c4452209922cf1c5802134ad9d3693c41112
e8e72e2c893d40d8e2cf857de7d3b586aa5521695fd1dc6a0fc2c20ddf9d5a35
f7bb8c87c9ab76081f182ccf8fbebd8d43da4e9b94cdbcaedfd2697c057c61ba