Scan report · 2 months agoPublic

md.qihqob.com

217.160.255.171AS8560 · DE

Submittedhttps://md.qihqob.com/ngx(2)/ngx(2)/ngx(2)/ngx(2)/ngx(1)/ngx/

Landed onhttps://md.qihqob.com/ngx(2)/ngx(2)/ngx(2)/ngx(2)/ngx(1)/ngx/page.html· 1 redirect

page delivers a ScreenConnect executable (https://moldinspections…=Bam&c=&c=&c=&c=&c=&c=)

brand impersonation (DocuSign, medium); document pretext ("docusign"); content suppressed for non-Windows visitors; presented as "Appraisal.msi", delivers "ScreenConnect.ClientSetup.msi"

Engine tags

Verdict

1 of 7 enginesSuspiciousAutomated

Own this site?

What happened

Step by step, from what the scanner recorded.

Load 2.9 s · 12 requests

01 · Visitor opensmd.qihqob.com/ngx(2)/ngx(2)/ngx(2)/ngx(2)/ngx(1)/ngx/

02 · Redirected · 1 hopSame host, another address/ngx(2)/ngx(2)/ngx(2)/ngx(2)/ngx(1)/ngx/page.html

03 · Page shown

Document Completed - DocuSignstyled as DocuSign · medium

04 · OutcomeA program on the machineAn executable or installer was handed to the visitor under a pretext.

Be careful — warning signs found

Automated

Its page title claims to be DocuSign, which this address is not associated with. This site shows signs commonly seen in scams or impersonation, but we could not confirm it for certain. It may be a real threat, or it may be a legitimate site that simply looks unusual to our automated checks.

What to do

Avoid entering passwords or payment details until you are sure it is genuine. Open the company directly from its known website or app instead of this link. Check the evidence below and escalate to your analyst if unsure.

"Suspicious" is a caution, not a confirmation — it can be a false alarm. The evidence below explains why it was flagged.

Findings

Strongest first

SupportingPage delivers a remote-management installer (ScreenConnect)

https://moldinspectionservice.screenconnect.com/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest&c=Bam&c=Bam&c=&c=&c=&c=&c=&c= · brand impersonation (DocuSign, medium); document pretext ("docusign"); content suppressed for non-Windows visitors; presented as "Appraisal.msi", delivers "ScreenConnect.ClientSetup.msi"

The page's download button hands the visitor ScreenConnect, a genuine remote-control product, while presenting itself as a document. Once run it gives an outsider live control of the machine. The installer is validly signed by its real vendor, so antivirus and file-analysis engines correctly see nothing wrong with the file — the attack is the pretext, not the payload.

Analyst noteRMM abuse: the payload is a legitimate signed ScreenConnect client, so file reputation will be clean by design — do not read that as a false positive. The tenant hostname and the query parameters in the target URL identify the attacker's relay and are the IOC + the abuse-report target (report to the RMM vendor, not only to the hosting provider).

InfoBrand impersonation detected

DocuSign · medium

The page presents itself as a known brand (brand keywords/branding detected).

Analyst noteLow/medium confidence (keyword only) — can be a news article or partner page. Corroborate before acting.

Infrastructure

IP: 217.160.255.171IONOS-AS - IONOS SE, DE · AS8560DE
TLS: CN=YR1, O=Let's Encrypt, C=US · expires Oct 16, 2026
Redirects: 1 hop · /ngx(2)/ngx(2)/ngx(2)/ngx(2)/ngx(1)/ngx/ → /ngx(2)/ngx(2)/ngx(2)/ngx(2)/ngx(1)/ngx/page.html

WHOIS

Registrar: IONOS SE
Created: Jul 4, 2026
Expires: Jul 4, 2027
Nameservers: ns1.pxymrg.infons2.pxymrg.info

30 malicious41 suspicious

Hashes & fingerprints

Page Hash4cd7b4962ede707282508e540d03bf3d6937cd43800515df5f4e135fa5e8a2ad DOM Hash44810dd7e042f64a7ca8f593a44d0e5394cc5ee483419bc8be4b3ed8b7c3ed8f Screenshot pHash9fe0e01f1f181ce3 JARM15d3fd16d29d29d00042d43d0000001ae0802418786940cae38f1d9eed5b9b JA4Xa373a9f83c6b_7022c563de38_2e3757343cb0 Cert Thumbprint53023C98E65BFCA1EA2DE0CA9EF5D4ED621F454E Cert IssuerCN=YR1, O=Let's Encrypt, C=US

Page capture

Live

Title “Document Completed - DocuSign” · brand shown: DocuSign (medium)

Visit Site

Engines

7 · time to verdict