www.getstours.com Open in urlscan Pro
103.102.234.9 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.getstours.com/Document/Invoice
Effective URL:
https://www.getstours.com/Document/Invoice/65769479149a444faa3e61d0ac3c11ab/index2.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418...
Submission Tags: @ipnigh
Submission: On December 09 via api (December 9th 2019, 10:08:39 am UTC) from GB

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 10 HTTP transactions. The main IP is 103.102.234.9, located in India and belongs to WEBWERKS-AS-IN Web Werks India Pvt. Ltd., IN. The main domain is www.getstours.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on September 23rd 2019. Valid for: 3 months.

This is the only time www.getstours.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DocuSign (Online)

Domain & IP information

	IP Address	AS Autonomous System
4 12	103.102.234.9 103.102.234.9	133296 (WEBWERKS-...) (WEBWERKS-AS-IN Web Werks India Pvt. Ltd.)
1	2600:9000:20e... 2600:9000:20eb::d819:22c0:93a1	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
10	3

12 103.102.234.9 (India) 4 redirects

ASN133296 (WEBWERKS-AS-IN Web Werks India Pvt. Ltd., IN)
PTR: server.getscounseling.com

www.getstours.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20eb::d819:22c0:93a1 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)

wac-cdn.atlassian.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	getstours.com 4 redirects www.getstours.com	559 KB
1	atlassian.com wac-cdn.atlassian.com	26 KB
0	googleapis.com Failed fonts.googleapis.com Failed
10	3

	Domain	Requested by
12	www.getstours.com	4 redirects www.getstours.com
1	wac-cdn.atlassian.com	www.getstours.com
0	fonts.googleapis.com Failed	www.getstours.com
10	3

This site contains no links.

Subject Issuer	Validity	Valid
getstours.com cPanel, Inc. Certification Authority	`2019-09-23` - `2019-12-22`	3 months	crt.sh
*.atlassian.com DigiCert SHA2 High Assurance Server CA	`2017-05-02` - `2020-05-06`	3 years	crt.sh

This page contains 1 frames:

Primary Page: https://www.getstours.com/Document/Invoice/65769479149a444faa3e61d0ac3c11ab/index2.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email=
Frame ID: 32633C8C286B7351C9B46ECEEB03FDBA
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://www.getstours.com/Document/Invoice HTTP 301
https://www.getstours.com/Document/Invoice/ HTTP 302
https://www.getstours.com/Document/Invoice/65769479149a444faa3e61d0ac3c11ab HTTP 301
https://www.getstours.com/Document/Invoice/65769479149a444faa3e61d0ac3c11ab/ HTTP 302
https://www.getstours.com/Document/Invoice/65769479149a444faa3e61d0ac3c11ab/index2.php?l=_JeHFUq_VJOXK... Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

10
Requests

90 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

584 kB
Transfer

582 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.getstours.com/Document/Invoice HTTP 301
https://www.getstours.com/Document/Invoice/ HTTP 302
https://www.getstours.com/Document/Invoice/65769479149a444faa3e61d0ac3c11ab HTTP 301
https://www.getstours.com/Document/Invoice/65769479149a444faa3e61d0ac3c11ab/ HTTP 302
https://www.getstours.com/Document/Invoice/65769479149a444faa3e61d0ac3c11ab/index2.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request index2.php Show response
www.getstours.com/Document/Invoice/65769479149a444faa3e61d0ac3c11ab/
Redirect Chain

https://www.getstours.com/Document/Invoice
https://www.getstours.com/Document/Invoice/
https://www.getstours.com/Document/Invoice/65769479149a444faa3e61d0ac3c11ab
https://www.getstours.com/Document/Invoice/65769479149a444faa3e61d0ac3c11ab/
https://www.getstours.com/Document/Invoice/65769479149a444faa3e61d0ac3c11ab/index2.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Produ...

5 KB
6 KB

161ms
161ms

Document
text/html

103.102.234.9
WEBWERKS-AS-IN We...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.getstours.com/Document/Invoice/65769479149a444faa3e61d0ac3c11ab/index2.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.102.234.9 , India, ASN133296 (WEBWERKS-AS-IN Web Werks India Pvt. Ltd., IN),
Reverse DNS: server.getscounseling.com
Software: Apache /
Resource Hash: bce4268b7ea69946493844866e4cb87d065ab37f82a47e2d930767dbbceef820

Request headers

Host: www.getstours.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-User: ?1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-User: ?1

Response headers

Date: Mon, 09 Dec 2019 10:08:16 GMT
Server: Apache
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

Redirect headers

Date: Mon, 09 Dec 2019 10:08:16 GMT
Server: Apache
Location: index2.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email=
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK theDocs.all.min.css
www.getstours.com/Document/Invoice/65769479149a444faa3e61d0ac3c11ab/assets/css/ 203 KB
203 KB 137ms
137ms Stylesheet
text/css 103.102.234.9
WEBWERKS-AS-IN We...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.getstours.com/Document/Invoice/65769479149a444faa3e61d0ac3c11ab/assets/css/theDocs.all.min.css
Requested by: Host: www.getstours.com
URL: https://www.getstours.com/Document/Invoice/65769479149a444faa3e61d0ac3c11ab/index2.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.102.234.9 , India, ASN133296 (WEBWERKS-AS-IN Web Werks India Pvt. Ltd., IN),
Reverse DNS: server.getscounseling.com
Software: Apache /
Resource Hash: ccbfb30d756fc09de5555c449391cc1d0ea0b0fb9d19859dda90e50ecbc58bb3

Request headers

Referer: https://www.getstours.com/Document/Invoice/65769479149a444faa3e61d0ac3c11ab/index2.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 09 Dec 2019 10:08:16 GMT
Last-Modified: Mon, 09 Dec 2019 10:08:15 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 207752

GET
H/1.1 200
OK custom.css
www.getstours.com/Document/Invoice/65769479149a444faa3e61d0ac3c11ab/assets/css/ 2 KB
2 KB 138ms
138ms Stylesheet
text/css 103.102.234.9
WEBWERKS-AS-IN We...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.getstours.com/Document/Invoice/65769479149a444faa3e61d0ac3c11ab/assets/css/custom.css
Requested by: Host: www.getstours.com
URL: https://www.getstours.com/Document/Invoice/65769479149a444faa3e61d0ac3c11ab/index2.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.102.234.9 , India, ASN133296 (WEBWERKS-AS-IN Web Werks India Pvt. Ltd., IN),
Reverse DNS: server.getscounseling.com
Software: Apache /
Resource Hash: fd125e9ec68466eb5a9e6a5a9a9c33304d35968533d32a41396b4aafcd27782c

Request headers

Referer: https://www.getstours.com/Document/Invoice/65769479149a444faa3e61d0ac3c11ab/index2.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 09 Dec 2019 10:08:16 GMT
Last-Modified: Mon, 09 Dec 2019 10:08:15 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 1762

GET
H/1.1 200
OK logo.png
www.getstours.com/Document/Invoice/65769479149a444faa3e61d0ac3c11ab/assets/img/ 37 KB
37 KB 411ms
139ms Image
image/png 103.102.234.9
WEBWERKS-AS-IN We...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.getstours.com/Document/Invoice/65769479149a444faa3e61d0ac3c11ab/assets/img/logo.png
Requested by: Host: www.getstours.com
URL: https://www.getstours.com/Document/Invoice/65769479149a444faa3e61d0ac3c11ab/index2.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.102.234.9 , India, ASN133296 (WEBWERKS-AS-IN Web Werks India Pvt. Ltd., IN),
Reverse DNS: server.getscounseling.com
Software: Apache /
Resource Hash: 130119863ba9fdba0226b230cbcae75d5f4ad72868d334ab7823f0f654ddeb54

Request headers

Referer: https://www.getstours.com/Document/Invoice/65769479149a444faa3e61d0ac3c11ab/index2.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 09 Dec 2019 10:08:16 GMT
Last-Modified: Mon, 09 Dec 2019 10:08:15 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 38092

GET
H/1.1 200
OK docusign.jpg
www.getstours.com/Document/Invoice/65769479149a444faa3e61d0ac3c11ab/assets/img/ 13 KB
13 KB 409ms
138ms Image
image/jpeg 103.102.234.9
WEBWERKS-AS-IN We...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.getstours.com/Document/Invoice/65769479149a444faa3e61d0ac3c11ab/assets/img/docusign.jpg
Requested by: Host: www.getstours.com
URL: https://www.getstours.com/Document/Invoice/65769479149a444faa3e61d0ac3c11ab/index2.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.102.234.9 , India, ASN133296 (WEBWERKS-AS-IN Web Werks India Pvt. Ltd., IN),
Reverse DNS: server.getscounseling.com
Software: Apache /
Resource Hash: 450ad0f21d2c23c244e042df43cc94295666d61a1560d2dc9c2cd0797b7f47bc

Request headers

Referer: https://www.getstours.com/Document/Invoice/65769479149a444faa3e61d0ac3c11ab/index2.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 09 Dec 2019 10:08:16 GMT
Last-Modified: Mon, 09 Dec 2019 10:08:15 GMT
Server: Apache
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 13134

GET
H2 200 docusign_logo.png
wac-cdn.atlassian.com/dam/jcr:8673b75c-cca8-456b-8ed5-13b8b220835b/ 25 KB
26 KB 52ms
9ms Image
image/png 2600:9000:20eb::d819:22c0:93a1
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://wac-cdn.atlassian.com/dam/jcr:8673b75c-cca8-456b-8ed5-13b8b220835b/docusign_logo.png

Requested by

Host: www.getstours.com
URL: https://www.getstours.com/Document/Invoice/65769479149a444faa3e61d0ac3c11ab/index2.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:9000:20eb::d819:22c0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

Software

globaledge-envoy / Express

Resource Hash

211d6a50365805b7d25eaeab489d989a9ef9f1e1b8aaa239cbc653962bc2e444

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.getstours.com/Document/Invoice/65769479149a444faa3e61d0ac3c11ab/index2.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 27 Nov 2019 01:36:34 GMT
via: 1.1 0f538ee832e1105649039b38ce89e883.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 3778
x-powered-by: Express
x-cache: Hit from cloudfront
status: 200
x-envoy-upstream-service-time: 45
x-logging-id: 808076e7-7c9f-403d-9295-7436570228e4
content-disposition: attachment; filename="docusign_logo.png"
content-length: 26056
x-xss-protection: 1; mode=block
x-magnolia-registration: Registered
last-modified: Fri, 16 Dec 2016 18:38:13 GMT
server: globaledge-envoy
etag: W/"65c8-O+Q6dVRSr7jOWw6F6Sjk7woROwo"
expect-ct: report-uri="https://web-security-reports.services.atlassian.com/expect-ct-report/bxp-nginx", max-age=86400
strict-transport-security: max-age=63072000; preload
content-type: image/png;charset=UTF-8
cache-control: max-age=2592000, public
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: G0QOsKamnZTTMOwhl2f0QgpIRvBJX3Mj8DFgGT9ykhokx0T57JtMng==
x-proxy-cache: MISS

GET
H/1.1 200
OK theDocs.all.min.js Show response
www.getstours.com/Document/Invoice/65769479149a444faa3e61d0ac3c11ab/assets/js/ 222 KB
222 KB 275ms
137ms Script
application/javascript 103.102.234.9
WEBWERKS-AS-IN We...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.getstours.com/Document/Invoice/65769479149a444faa3e61d0ac3c11ab/assets/js/theDocs.all.min.js
Requested by: Host: www.getstours.com
URL: https://www.getstours.com/Document/Invoice/65769479149a444faa3e61d0ac3c11ab/index2.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.102.234.9 , India, ASN133296 (WEBWERKS-AS-IN Web Werks India Pvt. Ltd., IN),
Reverse DNS: server.getscounseling.com
Software: Apache /
Resource Hash: f81e12f67f4c6f10ed89f3be4a9f7f4685c1e746cae88373f1e5f823980601fb

Request headers

Referer: https://www.getstours.com/Document/Invoice/65769479149a444faa3e61d0ac3c11ab/index2.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 09 Dec 2019 10:08:16 GMT
Last-Modified: Mon, 09 Dec 2019 10:08:15 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 227270

GET
H/1.1 200
OK custom.js Show response
www.getstours.com/Document/Invoice/65769479149a444faa3e61d0ac3c11ab/assets/js/ 4 KB
4 KB 412ms
140ms Script
application/javascript 103.102.234.9
WEBWERKS-AS-IN We...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.getstours.com/Document/Invoice/65769479149a444faa3e61d0ac3c11ab/assets/js/custom.js
Requested by: Host: www.getstours.com
URL: https://www.getstours.com/Document/Invoice/65769479149a444faa3e61d0ac3c11ab/index2.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.102.234.9 , India, ASN133296 (WEBWERKS-AS-IN Web Werks India Pvt. Ltd., IN),
Reverse DNS: server.getscounseling.com
Software: Apache /
Resource Hash: 28745f9888b421ab15b26992fc72ce8630fd7632e79d63271479489ec7d9d272

Request headers

Referer: https://www.getstours.com/Document/Invoice/65769479149a444faa3e61d0ac3c11ab/index2.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 09 Dec 2019 10:08:16 GMT
Last-Modified: Mon, 09 Dec 2019 10:08:15 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 4068

GET css
fonts.googleapis.com/ 0
0

GET
H/1.1 200
OK fontawesome-webfont5b62.html
www.getstours.com/Document/Invoice/65769479149a444faa3e61d0ac3c11ab/assets/fonts/ 70 KB
70 KB 138ms
137ms Font
text/html 103.102.234.9
WEBWERKS-AS-IN We...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.getstours.com/Document/Invoice/65769479149a444faa3e61d0ac3c11ab/assets/fonts/fontawesome-webfont5b62.html?v=4.6.3
Requested by: Host: www.getstours.com
URL: https://www.getstours.com/Document/Invoice/65769479149a444faa3e61d0ac3c11ab/index2.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.102.234.9 , India, ASN133296 (WEBWERKS-AS-IN Web Werks India Pvt. Ltd., IN),
Reverse DNS: server.getscounseling.com
Software: Apache /
Resource Hash: 7dacf83f51179de8d7980a513e67ab3a08f2c6272bb5946df8fd77c0d1763b73

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.getstours.com/Document/Invoice/65769479149a444faa3e61d0ac3c11ab/assets/css/theDocs.all.min.css
Origin: https://www.getstours.com

Response headers

Date: Mon, 09 Dec 2019 10:08:17 GMT
Last-Modified: Mon, 09 Dec 2019 10:08:15 GMT
Server: Apache
Content-Type: text/html
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=96
Content-Length: 71896

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: fonts.googleapis.com
URL: http://fonts.googleapis.com/css?family=Raleway:100,300,400,500%7CLato:300,400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DocuSign (Online)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
wac-cdn.atlassian.com
www.getstours.com
fonts.googleapis.com
103.102.234.9
2600:9000:20eb::d819:22c0:93a1
130119863ba9fdba0226b230cbcae75d5f4ad72868d334ab7823f0f654ddeb54
211d6a50365805b7d25eaeab489d989a9ef9f1e1b8aaa239cbc653962bc2e444
28745f9888b421ab15b26992fc72ce8630fd7632e79d63271479489ec7d9d272
450ad0f21d2c23c244e042df43cc94295666d61a1560d2dc9c2cd0797b7f47bc
7dacf83f51179de8d7980a513e67ab3a08f2c6272bb5946df8fd77c0d1763b73
bce4268b7ea69946493844866e4cb87d065ab37f82a47e2d930767dbbceef820
ccbfb30d756fc09de5555c449391cc1d0ea0b0fb9d19859dda90e50ecbc58bb3
f81e12f67f4c6f10ed89f3be4a9f7f4685c1e746cae88373f1e5f823980601fb
fd125e9ec68466eb5a9e6a5a9a9c33304d35968533d32a41396b4aafcd27782c

www.getstours.com Open in urlscan Pro 103.102.234.9 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

10 Requests

90 %HTTPS

50 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

584 kBTransfer

582 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

15 JavaScript Global Variables

0 Cookies

Indicators

www.getstours.com Open in urlscan Pro
103.102.234.9 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

90 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

584 kB
Transfer

582 kB
Size

0
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!