healthsprings.docis.io Open in urlscan Pro
47.241.187.114 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://email.ecybermission.info/c/eJxsjEsKwyAUAE-jm5LwolbjwkWheI_nJ1VIalATevySrrsbhmGC0YxHkJpGMyngXEglgSajA9N6iREQhffK46RmRHWfER...
Effective URL:
https://healthsprings.docis.io/signature-image/booke/swiz.php
Submission: On December 23 via manual (December 23rd 2023, 4:49:34 pm UTC) from CH — Scanned from CH

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 4 domains to perform 11 HTTP transactions. The main IP is 47.241.187.114, located in Singapore and belongs to ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN. The main domain is healthsprings.docis.io.
TLS certificate: Issued by R3 on December 13th 2023. Valid for: 3 months.

This is the only time healthsprings.docis.io was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DHL (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
1 1	34.110.180.34 34.110.180.34	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2 12	47.241.187.114 47.241.187.114	45102 (ALIBABA-C...) (ALIBABA-CN-NET Alibaba US Technology Co.)
1	216.58.212.138 216.58.212.138	15169 (GOOGLE) (GOOGLE)
11	2

1 34.110.180.34 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 34.180.110.34.bc.googleusercontent.com

email.ecybermission.info	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 47.241.187.114 (Singapore) 2 redirects

ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN)

app.docis.live	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
healthsprings.docis.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.212.138 (United States)

ASN15169 (GOOGLE, US)
PTR: ams15s21-in-f138.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	docis.io 1 redirects healthsprings.docis.io	730 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 29	3 KB
1	docis.live 1 redirects app.docis.live	271 B
1	ecybermission.info 1 redirects email.ecybermission.info	180 B
11	4

	Domain	Requested by
11	healthsprings.docis.io	1 redirects healthsprings.docis.io
1	fonts.googleapis.com	healthsprings.docis.io
1	app.docis.live	1 redirects
1	email.ecybermission.info	1 redirects
11	4

This site contains no links.

Subject Issuer	Validity	Valid
healthsprings.docis.io R3	`2023-12-13` - `2024-03-12`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://healthsprings.docis.io/signature-image/booke/swiz.php
Frame ID: B8576D61761AB614DBA5DDB15F576037
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Schweizer Post

Page URL History Show full URLs

https://email.ecybermission.info/c/eJxsjEsKwyAUAE-jm5LwolbjwkWheI_nJ1VIalATevySrrsbhmGC0YxHkJpGMyngXEglgSajA9... HTTP 302
https://app.docis.live/storage/ch/?mail=+strueb@runbox.com HTTP 302
https://healthsprings.docis.io/signature-image/booke/ HTTP 302
https://healthsprings.docis.io/signature-image/booke/swiz.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

11
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

2
IPs

2
Countries

733 kB
Transfer

2109 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://email.ecybermission.info/c/eJxsjEsKwyAUAE-jm5LwolbjwkWheI_nJ1VIalATevySrrsbhmGC0YxHkJpGMyngXEglgSajA9N6iREQhffK46RmRHWfERbttKfZNBbSpAYI8kxpKIEIiA5by6MvG11N6n1vhD8Is4RZ3PcxFJ_buOYzEmZbLxVfF_l0JdxumFfCn7fW6xEdEVCPtyuf366aP_YbAAD__-iPO7E HTTP 302
https://app.docis.live/storage/ch/?mail=+strueb@runbox.com HTTP 302
https://healthsprings.docis.io/signature-image/booke/ HTTP 302
https://healthsprings.docis.io/signature-image/booke/swiz.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request swiz.php Show response
healthsprings.docis.io/signature-image/booke/
Redirect Chain

https://email.ecybermission.info/c/eJxsjEsKwyAUAE-jm5LwolbjwkWheI_nJ1VIalATevySrrsbhmGC0YxHkJpGMyngXEglgSajA9N6iREQhffK46RmRHWfERbttKfZNBbSpAYI8kxpKIEIiA5by6MvG11N6n1vhD8Is4RZ3PcxFJ_buOYzEmZbLxVfF_...
https://app.docis.live/storage/ch/?mail=+strueb@runbox.com
https://healthsprings.docis.io/signature-image/booke/
https://healthsprings.docis.io/signature-image/booke/swiz.php

4 KB
2 KB

482ms
482ms

Document
text/html

47.241.187.114
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to

Full URL: https://healthsprings.docis.io/signature-image/booke/swiz.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 47.241.187.114 , Singapore, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 80408550b691db5ae3b0f5d7f6290d487353b766e1eff4ddb9913949395dd65d

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-CH,de;q=0.9

Response headers

Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 1337
Content-Type: text/html; charset=UTF-8
Date: Sat, 23 Dec 2023 16:49:27 GMT
Keep-Alive: timeout=5, max=99
Server: Apache/2.4.29 (Ubuntu)
Vary: Accept-Encoding

Redirect headers

Connection: Keep-Alive
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Date: Sat, 23 Dec 2023 16:49:27 GMT
Keep-Alive: timeout=5, max=100
Location: ./swiz.php
Server: Apache/2.4.29 (Ubuntu)

GET
H/1.1 200
OK ni.css
healthsprings.docis.io/signature-image/booke/css/ 1 MB
124 KB 314ms
313ms Stylesheet
text/css 47.241.187.114
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to

Full URL: https://healthsprings.docis.io/signature-image/booke/css/ni.css
Requested by: Host: healthsprings.docis.io
URL: https://healthsprings.docis.io/signature-image/booke/swiz.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 47.241.187.114 , Singapore, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: cf124a798c2b84f9af22976b5db84c58afa2844cc11272eb29aa6a37153ec6f3

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://healthsprings.docis.io/signature-image/booke/swiz.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Sat, 23 Dec 2023 16:49:28 GMT
Content-Encoding: gzip
Last-Modified: Sat, 23 Dec 2023 13:16:11 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "160347-60d2d22f9d4cb-gzip"
Vary: Accept-Encoding
Transfer-Encoding: chunked
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98

GET
H/1.1 200
OK swiz.css
healthsprings.docis.io/signature-image/booke/css/ 4 KB
1 KB 891ms
413ms Stylesheet
text/css 47.241.187.114
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to

Full URL: https://healthsprings.docis.io/signature-image/booke/css/swiz.css
Requested by: Host: healthsprings.docis.io
URL: https://healthsprings.docis.io/signature-image/booke/swiz.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 47.241.187.114 , Singapore, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: f69dfc5327ee35b6d3667372bacdd11420b94e553a8572770bc874e007ab9e6a

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://healthsprings.docis.io/signature-image/booke/swiz.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Sat, 23 Dec 2023 16:49:29 GMT
Content-Encoding: gzip
Last-Modified: Sat, 23 Dec 2023 13:16:11 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "f6f-60d2d22f9d4cb-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 801

GET
H2 200 css
fonts.googleapis.com/ 91 KB
3 KB 529ms
79ms Stylesheet
text/css 216.58.212.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:100,100i,300,300i,400,400i,500,500i,700,700i,900,900i|Open+Sans:300,300i,400,400i,500,500i,600,600i,700,700i,800,800i

Requested by

Host: healthsprings.docis.io
URL: https://healthsprings.docis.io/signature-image/booke/swiz.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s21-in-f138.1e100.net

Software

ESF /

Resource Hash

d2db236fecc374a8be0545ad1d5c600babc728f913fd58adef765a3ba269e2dd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://healthsprings.docis.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 23 Dec 2023 16:49:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 23 Dec 2023 16:49:09 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 23 Dec 2023 16:49:28 GMT

GET
H/1.1 200
OK Logo-DiePost_Small.svg
healthsprings.docis.io/signature-image/booke/images/ 1 KB
2 KB 710ms
231ms Image
image/svg+xml 47.241.187.114
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://healthsprings.docis.io/signature-image/booke/images/Logo-DiePost_Small.svg
Requested by: Host: healthsprings.docis.io
URL: https://healthsprings.docis.io/signature-image/booke/swiz.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 47.241.187.114 , Singapore, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: b3439b78a7313406fd7f2973c053b2f1eae06f2d9eb7fe12bf0c33abac390c95

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://healthsprings.docis.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Sat, 23 Dec 2023 16:49:28 GMT
Last-Modified: Sat, 23 Dec 2023 13:16:11 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "536-60d2d22f91949"
Content-Type: image/svg+xml
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 1334

GET
H/1.1 200
OK send.png
healthsprings.docis.io/signature-image/booke/images/ 216 KB
216 KB 935ms
435ms Image
image/png 47.241.187.114
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://healthsprings.docis.io/signature-image/booke/images/send.png
Requested by: Host: healthsprings.docis.io
URL: https://healthsprings.docis.io/signature-image/booke/swiz.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 47.241.187.114 , Singapore, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 721e76dd768c02a0cc66b22f36cb024e069674cbd67c9893146dd1c25c397f25

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://healthsprings.docis.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Sat, 23 Dec 2023 16:49:29 GMT
Last-Modified: Sat, 23 Dec 2023 13:16:11 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "35e71-60d2d22f91949"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 220785

GET
H/1.1 200
OK look.png
healthsprings.docis.io/signature-image/booke/images/ 45 KB
45 KB 951ms
308ms Image
image/png 47.241.187.114
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://healthsprings.docis.io/signature-image/booke/images/look.png
Requested by: Host: healthsprings.docis.io
URL: https://healthsprings.docis.io/signature-image/booke/swiz.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 47.241.187.114 , Singapore, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: e851b444477ad4113a23f59b30cf59bb118193f8239f75da3d226ae1c3271d34

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://healthsprings.docis.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Sat, 23 Dec 2023 16:49:29 GMT
Last-Modified: Sat, 23 Dec 2023 13:16:11 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "b4b7-60d2d22f91949"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 46263

GET
H/1.1 200
OK briefe.png
healthsprings.docis.io/signature-image/booke/images/ 171 KB
171 KB 1265ms
606ms Image
image/png 47.241.187.114
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://healthsprings.docis.io/signature-image/booke/images/briefe.png
Requested by: Host: healthsprings.docis.io
URL: https://healthsprings.docis.io/signature-image/booke/swiz.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 47.241.187.114 , Singapore, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 2f859edb8d2aff1c8fb9feb0086c8cb5da29f702ddf5cbe9fde4285bbebabd9d

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://healthsprings.docis.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Sat, 23 Dec 2023 16:49:29 GMT
Last-Modified: Sat, 23 Dec 2023 13:16:11 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "2acbf-60d2d22f909a9"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 175295

GET
H/1.1 200
OK div.png
healthsprings.docis.io/signature-image/booke/images/ 75 KB
76 KB 226ms
225ms Image
image/png 47.241.187.114
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://healthsprings.docis.io/signature-image/booke/images/div.png
Requested by: Host: healthsprings.docis.io
URL: https://healthsprings.docis.io/signature-image/booke/swiz.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 47.241.187.114 , Singapore, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 9b8f570346af42fcaf694db14c26180cc8327aa783e0360819e08ff591439d36

Request headers

accept-language: de-CH,de;q=0.9
Referer: https://healthsprings.docis.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Sat, 23 Dec 2023 16:49:29 GMT
Last-Modified: Sat, 23 Dec 2023 13:16:11 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "12d4c-60d2d22f909a9"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 77132

GET
H/1.1 200
OK FrutigerLTW0145Light.ttf
healthsprings.docis.io/signature-image/booke/css/fonts/ 36 KB
36 KB 299ms
299ms Font
application/font-sfnt 47.241.187.114
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to

Full URL: https://healthsprings.docis.io/signature-image/booke/css/fonts/FrutigerLTW0145Light.ttf
Requested by: Host: healthsprings.docis.io
URL: https://healthsprings.docis.io/signature-image/booke/css/swiz.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 47.241.187.114 , Singapore, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: f8f3db90b5d6af8282db3fd829a967927e8abea3797ec6b50e1a3d8d53f7fb7f

Request headers

Referer: https://healthsprings.docis.io/signature-image/booke/css/swiz.css
Origin: https://healthsprings.docis.io
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Sat, 23 Dec 2023 16:49:29 GMT
Last-Modified: Sat, 23 Dec 2023 13:16:11 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "8e50-60d2d22f9c52b"
Content-Type: application/font-sfnt
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 36432

GET
H/1.1 200
OK FrutigerLT65Bold.ttf
healthsprings.docis.io/signature-image/booke/css/fonts/ 57 KB
57 KB 298ms
297ms Font
application/font-sfnt 47.241.187.114
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to

Full URL: https://healthsprings.docis.io/signature-image/booke/css/fonts/FrutigerLT65Bold.ttf
Requested by: Host: healthsprings.docis.io
URL: https://healthsprings.docis.io/signature-image/booke/css/swiz.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 47.241.187.114 , Singapore, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 07ef63cd9842e99556038c49f2fc07b849edc61e4577ddd4644f9ca0845e200e

Request headers

Referer: https://healthsprings.docis.io/signature-image/booke/css/swiz.css
Origin: https://healthsprings.docis.io
accept-language: de-CH,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Sat, 23 Dec 2023 16:49:29 GMT
Last-Modified: Sat, 23 Dec 2023 13:16:11 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "e3f8-60d2d22f9c52b"
Content-Type: application/font-sfnt
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 58360

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

app.docis.live
email.ecybermission.info
fonts.googleapis.com
healthsprings.docis.io
216.58.212.138
34.110.180.34
47.241.187.114
07ef63cd9842e99556038c49f2fc07b849edc61e4577ddd4644f9ca0845e200e
2f859edb8d2aff1c8fb9feb0086c8cb5da29f702ddf5cbe9fde4285bbebabd9d
721e76dd768c02a0cc66b22f36cb024e069674cbd67c9893146dd1c25c397f25
80408550b691db5ae3b0f5d7f6290d487353b766e1eff4ddb9913949395dd65d
9b8f570346af42fcaf694db14c26180cc8327aa783e0360819e08ff591439d36
b3439b78a7313406fd7f2973c053b2f1eae06f2d9eb7fe12bf0c33abac390c95
cf124a798c2b84f9af22976b5db84c58afa2844cc11272eb29aa6a37153ec6f3
d2db236fecc374a8be0545ad1d5c600babc728f913fd58adef765a3ba269e2dd
e851b444477ad4113a23f59b30cf59bb118193f8239f75da3d226ae1c3271d34
f69dfc5327ee35b6d3667372bacdd11420b94e553a8572770bc874e007ab9e6a
f8f3db90b5d6af8282db3fd829a967927e8abea3797ec6b50e1a3d8d53f7fb7f

healthsprings.docis.io Open in urlscan Pro 47.241.187.114 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

11 Requests

100 %HTTPS

0 %IPv6

4 Domains

4 Subdomains

2 IPs

2 Countries

733 kBTransfer

2109 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

Indicators

healthsprings.docis.io Open in urlscan Pro
47.241.187.114 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

2
IPs

2
Countries

733 kB
Transfer

2109 kB
Size

0
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!