signdesign-inc.com Open in urlscan Pro
2606:4700:3032::6815:2748  Malicious Activity! Public Scan

URL: https://signdesign-inc.com/037399b04c9b761e58db6855183887ee/login.php?user=true
Submission: On December 01 via automatic, source openphish — Scanned from DE

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 4 HTTP transactions. The main IP is 2606:4700:3032::6815:2748, located in United States and belongs to CLOUDFLARENET, US. The main domain is signdesign-inc.com.
TLS certificate: Issued by GTS CA 1P5 on November 30th 2022. Valid for: 3 months.
This is the only time signdesign-inc.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Sparkasse (Banking)

Domain & IP information

IP Address AS Autonomous System
4 2606:4700:303... 13335 (CLOUDFLAR...)
4 2
Apex Domain
Subdomains
Transfer
4 signdesign-inc.com
signdesign-inc.com
451 KB
4 1
Domain Requested by
4 signdesign-inc.com signdesign-inc.com
4 1

This site contains links to these domains. Also see Links.

Domain
berliner-sparkasse.linda-chatbot.de
module.berliner-sparkasse.de
Subject Issuer Validity Valid
*.signdesign-inc.com
GTS CA 1P5
2022-11-30 -
2023-02-28
3 months crt.sh

This page contains 1 frames:

Primary Page: https://signdesign-inc.com/037399b04c9b761e58db6855183887ee/login.php?user=true
Frame ID: ADAE0AD20A013301EDBFB301E8BE373E
Requests: 11 HTTP requests in this frame

Screenshot

Page Title

Login Online-Banking

Detected technologies

Overall confidence: 100%
Detected patterns
  • <div class="[^"]*parbase

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

4
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

755 kB
Transfer

1978 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request login.php
signdesign-inc.com/037399b04c9b761e58db6855183887ee/
542 KB
0
Document
General
Full URL
https://signdesign-inc.com/037399b04c9b761e58db6855183887ee/login.php?user=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3032::6815:2748 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
no-store, no-cache, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
772c291449cd5b98-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Thu, 01 Dec 2022 13:27:28 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3bDM2i7MxFPzUFprM%2BSujlTbWKu7s6gTqC3X9MIlCtG6vAR9u%2FU3qYbTcm4VK9%2BJBYSlwym8eNT3jwyGUrUBfgHCyPlvbiCDMxmtV9DfSb7RnHxi74Git%2Fz7TiLp%2BkKXkGR%2BQQvXIVJSL89Q3sdst5A%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
l.css
signdesign-inc.com/037399b04c9b761e58db6855183887ee/partial/css/
531 KB
289 KB
Stylesheet
General
Full URL
https://signdesign-inc.com/037399b04c9b761e58db6855183887ee/partial/css/l.css
Requested by
Host: signdesign-inc.com
URL: https://signdesign-inc.com/037399b04c9b761e58db6855183887ee/login.php?user=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3032::6815:2748 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
09b45f5918aab70e96f98c653ed15f892ee8ba85c8ffae9b36d567cddbd3196a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://signdesign-inc.com/037399b04c9b761e58db6855183887ee/login.php?user=true
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date
Thu, 01 Dec 2022 13:27:29 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Tue, 29 Nov 2022 17:31:35 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"638641f7-84ae4"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SJbZVvD3gLHP3ZnQcQlrn4O6AvWLcaNCI4SGT%2FsVsGyjSpLVl%2Fl4qrHALXyaB%2F3tnD5HBg6q2NzrxUmx5lwMia7bs9Q3DAunrmhgifxk%2FizUvDWRCwiL0rk6Pb%2FSpegBY1I2PTC5HKuiosCWGn9IIis%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
772c29167cde5b98-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
jquery.js
signdesign-inc.com/037399b04c9b761e58db6855183887ee/partial/js/
266 KB
79 KB
Script
General
Full URL
https://signdesign-inc.com/037399b04c9b761e58db6855183887ee/partial/js/jquery.js
Requested by
Host: signdesign-inc.com
URL: https://signdesign-inc.com/037399b04c9b761e58db6855183887ee/login.php?user=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3032::6815:2748 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4ef5f864f89db7feaaaa5332c0a99d76076af49fef488806541ca2561e4cb379

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://signdesign-inc.com/037399b04c9b761e58db6855183887ee/login.php?user=true
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date
Thu, 01 Dec 2022 13:27:29 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Tue, 29 Nov 2022 17:31:35 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"638641f7-4271b"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uL7fCUvLwbeXTZLQ32LLhKkOTnlrVNAlwmqO7ivg1d6LoyCxCM1FTIdmZRipDvrcyRjzuUCEXSRedoVY4jolJd46mdixb%2BXLTx1h56TMiHwxv4HQEEiuklHID376oJkcXEWlcT385Wxq0T8WKwKNRqA%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
772c29167ce15b98-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
index.jpg
signdesign-inc.com/037399b04c9b761e58db6855183887ee/partial/img/
83 KB
83 KB
Image
General
Full URL
https://signdesign-inc.com/037399b04c9b761e58db6855183887ee/partial/img/index.jpg
Requested by
Host: signdesign-inc.com
URL: https://signdesign-inc.com/037399b04c9b761e58db6855183887ee/login.php?user=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::6815:2748 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
281d0943765218606c764e99d16c2bcad4db7d3475ab596b00f9690cfa7c1f1e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://signdesign-inc.com/037399b04c9b761e58db6855183887ee/login.php?user=true
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date
Thu, 01 Dec 2022 13:27:29 GMT
cf-cache-status
REVALIDATED
last-modified
Tue, 29 Nov 2022 17:31:35 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"638641f7-14a44"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PU%2B%2FAG3OyOfduS%2FKhoJnbbaT9LEwDdk3VM2d8JCKLUvCZ%2FBkDfGDz0%2BN%2BdBd2y1lymIy83XVWFsTnsaOCKnhuWnsi%2Bb6PEZFVGMOAumFBmT3IX62Hg%2B0g5crljgnfKolFJDAiotpdRxvLWQilyQ4l6w%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
772c29189e809b64-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
84548
truncated
/
6 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3edc58dd505c594baa6bd39f1641072b5a072f16410c6d0c4bf65df2cdb1d356

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
41 KB
41 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0e9eb66a1b33ae648ada3c56eb55fa149c4f1b88316b5a7255ca9b076740f451

Request headers

Referer
Origin
https://signdesign-inc.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

Content-Type
font/woff
truncated
/
204 KB
204 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ee88f0851598c363b9b465dd2606efb934c3357aaed3274d0f4a2e6d40b86951

Request headers

Referer
Origin
https://signdesign-inc.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

Content-Type
font/woff
truncated
/
164 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
25f042d00f4ce4bcff027d7b7e5c3874e48de1393b3c6172f4775b4ced48c3bc

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
83 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d86fa09a2f9764c54486f84bb248963c9f074897cc923b794dbad6c661ddff10

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
29 KB
29 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
eb726e7747d06812f1fd551161fb45b9aaa733f97e616eb1272ec9fc0501fa86

Request headers

Referer
Origin
https://signdesign-inc.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

Content-Type
font/woff
truncated
/
30 KB
30 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
67284df54731fccb0b3c039cbeaab3474c057c5bc95accad964b13ef86eb1c8d

Request headers

Referer
Origin
https://signdesign-inc.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

Content-Type
font/woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Sparkasse (Banking)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange function| $ function| jQuery

1 Cookies

Domain/Path Name / Value
signdesign-inc.com/ Name: PHPSESSID
Value: lvpdi3uq5b5l1qeb4d7vi6jsft

1 Console Messages

Source Level URL
Text
security error URL: https://signdesign-inc.com/037399b04c9b761e58db6855183887ee/login.php?user=true(Line 9)
Message:
X-Frame-Options may only be set via an HTTP header sent along with a document. It may not be set inside <meta>.