dhakaparivar.com Open in urlscan Pro
162.144.64.241  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://www.hearinghealthcareclinics.com/.well-known/businessfile/DocumentFile.php Page URL
2. https://dhakaparivar.com/.well-known/businessfile/qsurve/qsurve/index.php Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	DocumentFile.php www.hearinghealthcareclinics.com/.well-known/businessfile/	344 B 484 B	542ms 209ms	Document text/html	101.53.144.229 NETMAGIC-AP Netma...
General Check archive.org Show headers Download Go to Full URL https://www.hearinghealthcareclinics.com/.well-known/businessfile/DocumentFile.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 101.53.144.229 , India, ASN17439 (NETMAGIC-AP Netmagic Datacenter Mumbai, IN), Reverse DNS host.gdigitalindia.in Software Apache / Resource Hash Request headers Host www.hearinghealthcareclinics.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 04 Mar 2021 20:28:29 GMT Server Apache Content-Encoding gzip Vary Accept-Encoding,User-Agent Keep-Alive timeout=5, max=100 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET		index.php dhakaparivar.com/.well-known/businessfile/qsurve/qsurve/	0 0
GET H/1.1	200 OK	Primary Request index.php Show response dhakaparivar.com/.well-known/businessfile/qsurve/qsurve/	6 KB 6 KB	513ms 197ms	Document text/html	162.144.64.241 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://dhakaparivar.com/.well-known/businessfile/qsurve/qsurve/index.php Requested by Host: www.hearinghealthcareclinics.com URL: https://www.hearinghealthcareclinics.com/.well-known/businessfile/DocumentFile.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.144.64.241 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS server.websitedesignfaridabad.com Software Apache / Resource Hash 900c0c8b9be5a9404758dc2c5538e6cf059892fef129f1727a14be4e74c6e142 Request headers Host dhakaparivar.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Sec-Fetch-Dest document Referer https://www.hearinghealthcareclinics.com/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.hearinghealthcareclinics.com/ Response headers Date Thu, 04 Mar 2021 20:28:29 GMT Server Apache Keep-Alive timeout=5, max=100 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.5.1/	87 KB 30 KB	7ms 6ms	Script text/javascript	2a00:1450:4001:829::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js Requested by Host: dhakaparivar.com URL: https://dhakaparivar.com/.well-known/businessfile/qsurve/qsurve/index.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://dhakaparivar.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 01 Mar 2021 07:42:58 GMT content-encoding gzip x-content-type-options nosniff age 305132 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 31021 x-xss-protection 0 last-modified Fri, 08 May 2020 07:05:03 GMT server sffe vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Tue, 01 Mar 2022 07:42:58 GMT
GET H/1.1	200 OK	rui-core.min.css dhakaparivar.com/.well-known/businessfile/qsurve/qsurve/root/	69 KB 70 KB	155ms 155ms	Stylesheet text/css	162.144.64.241 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://dhakaparivar.com/.well-known/businessfile/qsurve/qsurve/root/rui-core.min.css Requested by Host: dhakaparivar.com URL: https://dhakaparivar.com/.well-known/businessfile/qsurve/qsurve/index.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.144.64.241 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS server.websitedesignfaridabad.com Software Apache / Resource Hash ae7201b3cbcdee4d90a5ac451789bf02d4095d08207aad62be33c2e1ea07991e Request headers Referer https://dhakaparivar.com/.well-known/businessfile/qsurve/qsurve/index.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 04 Mar 2021 20:28:30 GMT Last-Modified Thu, 28 Jan 2021 16:48:42 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 70968
GET H/1.1	200 OK	rui-forms-all.min.css dhakaparivar.com/.well-known/businessfile/qsurve/qsurve/root/	198 KB 198 KB	461ms 156ms	Stylesheet text/css	162.144.64.241 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://dhakaparivar.com/.well-known/businessfile/qsurve/qsurve/root/rui-forms-all.min.css Requested by Host: dhakaparivar.com URL: https://dhakaparivar.com/.well-known/businessfile/qsurve/qsurve/index.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.144.64.241 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS server.websitedesignfaridabad.com Software Apache / Resource Hash ebba5d454159b13a724f225bf01d4281bb35c66f4a15ed838b51d0c5c36cc6e9 Request headers Referer https://dhakaparivar.com/.well-known/businessfile/qsurve/qsurve/index.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 04 Mar 2021 20:28:30 GMT Last-Modified Thu, 28 Jan 2021 16:48:42 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 202681
GET H/1.1	200 OK	loop.png dhakaparivar.com/.well-known/businessfile/qsurve/qsurve/img/	26 KB 27 KB	460ms 154ms	Image image/png	162.144.64.241 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL https://dhakaparivar.com/.well-known/businessfile/qsurve/qsurve/img/loop.png Requested by Host: dhakaparivar.com URL: https://dhakaparivar.com/.well-known/businessfile/qsurve/qsurve/index.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.144.64.241 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS server.websitedesignfaridabad.com Software Apache / Resource Hash 9fc1596deb549cbcf4772ed470bd01e461a625525ad632bf394e2401000f50e7 Request headers Referer https://dhakaparivar.com/.well-known/businessfile/qsurve/qsurve/index.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 04 Mar 2021 20:28:30 GMT Last-Modified Thu, 28 Jan 2021 16:48:42 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 27070
GET H2	200	0b.jpg astroholdings.co.zm/admin/	118 KB 119 KB	576ms 176ms	Image image/jpeg	162.215.254.31 PUBLIC-DOMAIN-REG...
General Check archive.org Show headers Download Go to Show image Full URL https://astroholdings.co.zm/admin/0b.jpg Requested by Host: dhakaparivar.com URL: https://dhakaparivar.com/.well-known/businessfile/qsurve/qsurve/root/rui-forms-all.min.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.215.254.31 , United States, ASN394695 (PUBLIC-DOMAIN-REGISTRY, US), Reverse DNS 162-215-254-31.unifiedlayer.com Software nginx/1.19.5 / Resource Hash b50adbf5b4dc387ad81d2773f1b03692c682eefbf67dd5c07f8bf488e0c63b0b Request headers Referer https://dhakaparivar.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 04 Mar 2021 20:28:31 GMT content-length 120483 last-modified Thu, 07 Jan 2021 01:25:48 GMT server nginx/1.19.5 accept-ranges bytes x-server-cache false content-type image/jpeg
GET H2	200	museo-sans-500-v1.woff s1.rui.au.reastatic.net/rui-static/font/	15 KB 15 KB	9ms 9ms	Font application/font-woff	2600:9000:2156:dc00:1e:c291:240:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s1.rui.au.reastatic.net/rui-static/font/museo-sans-500-v1.woff Requested by Host: dhakaparivar.com URL: https://dhakaparivar.com/.well-known/businessfile/qsurve/qsurve/root/rui-core.min.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:dc00:1e:c291:240:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 7e5491716d4bab50405712cc09b025aa10456a119e206e2677f8a30358846703 Request headers Origin https://dhakaparivar.com Referer https://dhakaparivar.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 04 Mar 2021 17:01:14 GMT via 1.1 bee9d99ac2913ec4167e166e6bdb691e.cloudfront.net (CloudFront) age 12437 x-cache Hit from cloudfront content-length 15420 last-modified Thu, 06 Feb 2014 04:47:57 GMT server AmazonS3 etag "beecaad8180ee6ab9625fbe8aa2d6d18" vary Origin access-control-allow-methods GET, HEAD x-amz-version-id null access-control-allow-origin * cache-control max-age=31536000 x-amz-cf-pop FRA50-C1 accept-ranges bytes content-type application/font-woff x-amz-cf-id mQ_cZ6ux-rsJmqBm31cRW2JXCH6JT2K48T0vVYU46JQO3qqDpT8j1A==

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

dhakaparivar.com

URL

https://dhakaparivar.com/.well-known/businessfile/qsurve/qsurve/index.php

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
astroholdings.co.zm
dhakaparivar.com
s1.rui.au.reastatic.net
www.hearinghealthcareclinics.com
dhakaparivar.com
101.53.144.229
162.144.64.241
162.215.254.31
2600:9000:2156:dc00:1e:c291:240:93a1
2a00:1450:4001:829::200a
7e5491716d4bab50405712cc09b025aa10456a119e206e2677f8a30358846703
900c0c8b9be5a9404758dc2c5538e6cf059892fef129f1727a14be4e74c6e142
9fc1596deb549cbcf4772ed470bd01e461a625525ad632bf394e2401000f50e7
ae7201b3cbcdee4d90a5ac451789bf02d4095d08207aad62be33c2e1ea07991e
b50adbf5b4dc387ad81d2773f1b03692c682eefbf67dd5c07f8bf488e0c63b0b
ebba5d454159b13a724f225bf01d4281bb35c66f4a15ed838b51d0c5c36cc6e9
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d