Scan report · 2 months agoPublic

md.qihqob.com

217.160.255.171AS8560 · DE

Submittedhttps://md.qihqob.com/ngx(2)/ngx(2)/ngx(2)/ngx(2)/ngx(1)/ngx/page.html

page delivers a ScreenConnect executable (https://moldinspections…=Bam&c=&c=&c=&c=&c=&c=)

brand impersonation (DocuSign, medium); document pretext ("docusign"); content suppressed for non-Windows visitors; presented as "Appraisal.msi", delivers "ScreenConnect.ClientSetup.msi"

Engine tags

Verdict

1 of 7 enginesSuspiciousAutomated

Own this site?

What happened

Step by step, from what the scanner recorded.

Load 1.2 s · 6 requests

01 · Visitor opensmd.qihqob.com/ngx(2)/ngx(2)/ngx(2)/ngx(2)/ngx(1)/ngx/page.html

02 · Page shown

Document Completed - DocuSignstyled as DocuSign · medium

03 · OutcomeA program on the machineAn executable or installer was handed to the visitor under a pretext.

Be careful — warning signs found

Automated

Its page title claims to be DocuSign, which this address is not associated with. This site shows signs commonly seen in scams or impersonation, but we could not confirm it for certain. It may be a real threat, or it may be a legitimate site that simply looks unusual to our automated checks.

What to do

Avoid entering passwords or payment details until you are sure it is genuine. Open the company directly from its known website or app instead of this link. Check the evidence below and escalate to your analyst if unsure.

"Suspicious" is a caution, not a confirmation — it can be a false alarm. The evidence below explains why it was flagged.

Findings

Strongest first

SupportingPage delivers a remote-management installer (ScreenConnect)

https://moldinspectionservice.screenconnect.com/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest&c=Bam&c=Bam&c=&c=&c=&c=&c=&c= · brand impersonation (DocuSign, medium); document pretext ("docusign"); content suppressed for non-Windows visitors; presented as "Appraisal.msi", delivers "ScreenConnect.ClientSetup.msi"

The page's download button hands the visitor ScreenConnect, a genuine remote-control product, while presenting itself as a document. Once run it gives an outsider live control of the machine. The installer is validly signed by its real vendor, so antivirus and file-analysis engines correctly see nothing wrong with the file — the attack is the pretext, not the payload.

Analyst noteRMM abuse: the payload is a legitimate signed ScreenConnect client, so file reputation will be clean by design — do not read that as a false positive. The tenant hostname and the query parameters in the target URL identify the attacker's relay and are the IOC + the abuse-report target (report to the RMM vendor, not only to the hosting provider).

InfoBrand impersonation detected

DocuSign · medium

The page presents itself as a known brand (brand keywords/branding detected).

Analyst noteLow/medium confidence (keyword only) — can be a news article or partner page. Corroborate before acting.

Infrastructure

IP: 217.160.255.171IONOS-AS - IONOS SE, DE · AS8560DE
TLS: CN=YR1, O=Let's Encrypt, C=US · expires Oct 16, 2026

WHOIS

Registrar: IONOS SE
Created: Jul 4, 2026
Expires: Jul 4, 2027
Nameservers: ns1.pxymrg.infons2.pxymrg.info

23 malicious76 suspicious

Hashes & fingerprints

Page Hash4ffb291d702d6fec88234dbe3e2f9857be28983ca0a62d5b7808a51731b1ad4f DOM Hash44810dd7e042f64a7ca8f593a44d0e5394cc5ee483419bc8be4b3ed8b7c3ed8f Screenshot pHash9fe0e01f1f581cc3 JARM15d3fd16d29d29d00042d43d0000001ae0802418786940cae38f1d9eed5b9b JA4Xa373a9f83c6b_7022c563de38_2e3757343cb0 Cert Thumbprint53023C98E65BFCA1EA2DE0CA9EF5D4ED621F454E Cert IssuerCN=YR1, O=Let's Encrypt, C=US

Page capture

Live

Title “Document Completed - DocuSign” · brand shown: DocuSign (medium)

Visit Site

Engines

7 · time to verdict