kingoffadesbarber.com Open in urlscan Pro
199.191.56.114  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
7 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request index Show response kingoffadesbarber.com/cgi/docusign/docusign/	4 KB 4 KB	1031ms 160ms	Document text/html	199.191.56.114 DACEN-2
General Check archive.org Show headers Download Go to Full URL https://kingoffadesbarber.com/cgi/docusign/docusign/index Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.191.56.114 , United States, ASN31863 (DACEN-2, US), Reverse DNS Software Apache / Resource Hash 1337d8e28e5a804634fac3c77cc5bd3c27eff88b8e6dda8aca25bc960f09f2c0 Request headers Host kingoffadesbarber.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 08 Apr 2021 07:08:26 GMT Server Apache Content-Location index.html Vary negotiate TCN choice Last-Modified Wed, 22 Apr 2020 16:20:44 GMT Accept-Ranges bytes Content-Length 4052 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html
GET H/1.1	200 OK	css.css kingoffadesbarber.com/cgi/docusign/docusign/files/	2 KB 3 KB	150ms 149ms	Stylesheet text/css	199.191.56.114 DACEN-2
General Check archive.org Show headers Download Go to Full URL https://kingoffadesbarber.com/cgi/docusign/docusign/files/css.css Requested by Host: kingoffadesbarber.com URL: https://kingoffadesbarber.com/cgi/docusign/docusign/index Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.191.56.114 , United States, ASN31863 (DACEN-2, US), Reverse DNS Software Apache / Resource Hash 50711cc910689fd84cad5aab51be5fbd516958fb5e42183056d83430960abd5c Request headers Referer https://kingoffadesbarber.com/cgi/docusign/docusign/index User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 08 Apr 2021 07:08:27 GMT Last-Modified Wed, 22 Apr 2020 16:20:48 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 2424
GET H/1.1	200 OK	style.css kingoffadesbarber.com/cgi/docusign/docusign/files/	946 KB 947 KB	299ms 149ms	Stylesheet text/css	199.191.56.114 DACEN-2
General Check archive.org Show headers Download Go to Full URL https://kingoffadesbarber.com/cgi/docusign/docusign/files/style.css Requested by Host: kingoffadesbarber.com URL: https://kingoffadesbarber.com/cgi/docusign/docusign/index Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.191.56.114 , United States, ASN31863 (DACEN-2, US), Reverse DNS Software Apache / Resource Hash c67e87e44481b22bbd3f2da8355ee5d6940eb7012ab5a8855daf3263c51d0584 Request headers Referer https://kingoffadesbarber.com/cgi/docusign/docusign/index User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 08 Apr 2021 07:08:27 GMT Last-Modified Wed, 22 Apr 2020 16:20:48 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 969088
GET H/1.1	200 OK	css.css kingoffadesbarber.com/cgi/docusign/docusign/files/	0 3 KB	280ms 155ms	Other text/css	199.191.56.114 DACEN-2
General Check archive.org Show headers Download Go to Full URL https://kingoffadesbarber.com/cgi/docusign/docusign/files/css.css Requested by Host: kingoffadesbarber.com URL: https://kingoffadesbarber.com/cgi/docusign/docusign/index Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.191.56.114 , United States, ASN31863 (DACEN-2, US), Reverse DNS Software Apache / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://kingoffadesbarber.com/cgi/docusign/docusign/index User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 08 Apr 2021 07:08:27 GMT Last-Modified Wed, 22 Apr 2020 16:20:48 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 2424
GET DATA	200 OK	truncated /	693 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 29af1538e8e76ea4999023fcc047561177af89ff1b9ba021668044dea47f4611 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/png
GET H/1.1	200 OK	docusign_logo_small.png account.docusign.com/LoginAppNext/images/	4 KB 4 KB	303ms 32ms	Image image/png	185.81.101.38 DOCUS-6-PROD
General Check archive.org Show headers Download Go to Show image Full URL https://account.docusign.com/LoginAppNext/images/docusign_logo_small.png Requested by Host: kingoffadesbarber.com URL: https://kingoffadesbarber.com/cgi/docusign/docusign/files/style.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.81.101.38 , United States, ASN62856 (DOCUS-6-PROD, US), Reverse DNS Software / Resource Hash e83f8d0b4a78d14185abfca96ee2fbaf18e396a047f725d944ff27a845787279 Request headers Referer https://kingoffadesbarber.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 08 Apr 2021 07:08:27 GMT ETag "eada13a1da25d71:0" Last-Modified Wed, 31 Mar 2021 03:04:56 GMT Accept-Ranges bytes X-DocuSign-Node AM1FE22 Content-Length 4064 Content-Type image/png
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash f5abe79538714148a390de1c7d7d568746510a32e14b37feacc4812155825558 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	1 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 685f77342ca77f562bb319cf666966ebd283ba9ad568148bf4d6f66d5fa08eb5 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 3a108a7df48da361bd9f5217fd4fd21a70888d5b324b4e13ab80370804cd3b7d Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 8ebb311bb3652ddc5c78025cef665618b0c979098c9f5eacb9c452a5fdceb3c9 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash baad0cc991ef1ca7a4405615b827746e6a97dc6cb7045b544118c874ff1760ff Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash a2b00dc7e4ff8539cf742bf8d295c111dea08acf46328483d68640135887e70a Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/png
GET H2	200	mem5YaGs126MiZpBA-UNirkOUuhp.woff2 fonts.gstatic.com/s/opensans/v16/	15 KB 15 KB	7ms 7ms	Font font/woff2	2a00:1450:4001:802::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v16/mem5YaGs126MiZpBA-UNirkOUuhp.woff2 Requested by Host: kingoffadesbarber.com URL: https://kingoffadesbarber.com/cgi/docusign/docusign/files/css.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 1491de1b31182d38593bcf660c99bc6018af8e192d91663f67ec9d045a3b5ccc Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://kingoffadesbarber.com Referer https://kingoffadesbarber.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 02 Apr 2021 10:03:37 GMT x-content-type-options nosniff last-modified Mon, 25 Mar 2019 20:12:08 GMT server sffe age 507890 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 14880 x-xss-protection 0 expires Sat, 02 Apr 2022 10:03:37 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DocuSign (Online) OneDrive (Online)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| popupwnd

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

account.docusign.com
fonts.gstatic.com
kingoffadesbarber.com
185.81.101.38
199.191.56.114
2a00:1450:4001:802::2003
1337d8e28e5a804634fac3c77cc5bd3c27eff88b8e6dda8aca25bc960f09f2c0
1491de1b31182d38593bcf660c99bc6018af8e192d91663f67ec9d045a3b5ccc
29af1538e8e76ea4999023fcc047561177af89ff1b9ba021668044dea47f4611
3a108a7df48da361bd9f5217fd4fd21a70888d5b324b4e13ab80370804cd3b7d
50711cc910689fd84cad5aab51be5fbd516958fb5e42183056d83430960abd5c
685f77342ca77f562bb319cf666966ebd283ba9ad568148bf4d6f66d5fa08eb5
8ebb311bb3652ddc5c78025cef665618b0c979098c9f5eacb9c452a5fdceb3c9
a2b00dc7e4ff8539cf742bf8d295c111dea08acf46328483d68640135887e70a
baad0cc991ef1ca7a4405615b827746e6a97dc6cb7045b544118c874ff1760ff
c67e87e44481b22bbd3f2da8355ee5d6940eb7012ab5a8855daf3263c51d0584
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e83f8d0b4a78d14185abfca96ee2fbaf18e396a047f725d944ff27a845787279
f5abe79538714148a390de1c7d7d568746510a32e14b37feacc4812155825558