urlscan.io logo urlscan.io
SecurityTrails logo

surveylink.in Open in urlscan Pro
104.238.98.87  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://surveylink.in/camera_capture/images/json.html
Submission: On July 17 via manual from AU — Scanned from AU
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 2 countries across 5 domains to perform 7 HTTP transactions. The main IP is 104.238.98.87, located in United States and belongs to GO-DADDY-COM-LLC, US. The main domain is surveylink.in.
TLS certificate: Issued by cPanel, Inc. Certification Authority on May 14th 2024. Valid for: 3 months.
This is the only time surveylink.in was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Email (Online)

Domain & IP information

IP Address AS Autonomous System
2 104.238.98.87 398101 (GO-DADDY-...)
1 117.18.232.200 15133 (EDGECAST)
1 151.101.66.137 54113 (FASTLY)
7 4
Apex Domain
Subdomains		 Transfer
2 surveylink.in
surveylink.in
67 KB
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 1211
31 KB
1 aspnetcdn.com
ajax.aspnetcdn.com — Cisco Umbrella Rank: 5661
152 KB
0 clearbit.com Failed
logo.clearbit.com Failed
0 cwbholding.com Failed
mgmnt.scr.cwbholding.com Failed
7 5
Domain Requested by
2 surveylink.in
1 code.jquery.com surveylink.in
1 ajax.aspnetcdn.com surveylink.in
0 logo.clearbit.com Failed
0 mgmnt.scr.cwbholding.com Failed
7 5

This site contains no links.

Subject Issuer Validity Valid
surveylink.in
cPanel, Inc. Certification Authority		 2024-05-14 -
2024-08-12		 3 months crt.sh
*.vo.msecnd.net
DigiCert SHA2 Secure Server CA		 2024-06-06 -
2025-06-06		 a year crt.sh
*.jquery.com
Sectigo ECC Domain Validation Secure Server CA		 2024-06-25 -
2025-06-25		 a year crt.sh

This page contains 1 frames:

Primary Page: https://surveylink.in/camera_capture/images/json.html
Frame ID: 95B34DBAD8A6A5C4B66477A84990E318
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

: Sign In Session

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

7
Requests

57 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

4
IPs

2
Countries

250 kB
Transfer

351 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request json.html
surveylink.in/camera_capture/images/ 		66 KB
66 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://surveylink.in/camera_capture/images/json.html?
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.238.98.87 , United States, ASN398101 (GO-DADDY-COM-LLC, US),
Reverse DNS
87.98.238.104.host.secureserver.net
Software
Apache/2.2.32 (Unix) mod_ssl/2.2.32 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 PHP/5.6.39 mod_perl/2.0.8 Perl/v5.14.4 /
Resource Hash
2fd21bd197392dcba4a04a830e6424ba33275509dbdbcb8a796234a21d8156fc

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Origin
*
Connection
Keep-Alive
Content-Length
67650
Content-Type
text/html
Date
Wed, 17 Jul 2024 21:35:36 GMT
ETag
"920868-10842-61d5eb890fcfe"
Keep-Alive
timeout=5, max=100
Last-Modified
Tue, 16 Jul 2024 15:08:40 GMT
Server
Apache/2.2.32 (Unix) mod_ssl/2.2.32 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 PHP/5.6.39 mod_perl/2.0.8 Perl/v5.14.4
bootstrap.min.css
ajax.aspnetcdn.com/ajax/bootstrap/4.3.1/css/ 		152 KB
152 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ajax.aspnetcdn.com/ajax/bootstrap/4.3.1/css/bootstrap.min.css
Requested by
Host: surveylink.in
URL: https://surveylink.in/camera_capture/images/json.html?
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
117.18.232.200 , Australia, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (nwa/E7CD) /
Resource Hash
60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://surveylink.in/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Wed, 17 Jul 2024 21:35:36 GMT
x-content-type-options
nosniff
last-modified
Mon, 04 Mar 2019 19:22:27 GMT
server
ECAcc (nwa/E7CD)
age
9867885
etag
"bd1f889abfd2d41:0"
x-cache
HIT
content-type
text/css
access-control-allow-origin
*
cache-control
public,max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
content-length
155758
x-xss-protection
1; mode=block
jquery-3.6.4.min.js
code.jquery.com/ 		88 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.6.4.min.js
Requested by
Host: surveylink.in
URL: https://surveylink.in/camera_capture/images/json.html?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.66.137 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
a0fe8723dcf55da64d06b25446d0a8513e52527c45afcb37073465f9c6f352af

Request headers

Referer
https://surveylink.in/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Wed, 17 Jul 2024 21:35:36 GMT
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
age
26449936
x-cache
HIT, HIT
content-length
31011
x-served-by
cache-lga21953-LGA, cache-syd10147-SYD
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
server
nginx
x-timer
S1721252137.805800,VS0,VE0
etag
W/"28feccc0-15ec3"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=604800
accept-ranges
bytes
x-cache-hits
38, 4945
truncated
/ 		555 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
93f553f07040ccaa21c9fa7c4ec02e97aff4999acee2bd4bdf9860100a1ea08a

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		24 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6a6beae164a3397dd506f59af5261bb7662b9344a3225c0f4d7f857f54f4db13

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		15 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
aba082654ed9a884ee14954d8a4085aff721d03989fcc16934f4d03cf6a55229

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		5 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b4e7ff4c0ce6fdd93c9cb43548a3c90a99a5b096de4892bb9d21462bd48c5e74

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
application/x-javascript
screen.php
mgmnt.scr.cwbholding.com/console/shot/ 		0
0
www.
logo.clearbit.com/ 		0
0
favicon.ico
surveylink.in/ 		0
350 B 		Other
General
Check archive.org
Download Go to
Full URL
https://surveylink.in/favicon.ico
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.238.98.87 , United States, ASN398101 (GO-DADDY-COM-LLC, US),
Reverse DNS
87.98.238.104.host.secureserver.net
Software
Apache/2.2.32 (Unix) mod_ssl/2.2.32 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 PHP/5.6.39 mod_perl/2.0.8 Perl/v5.14.4 / PHP/5.6.39
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://surveylink.in/camera_capture/images/json.html?
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date
Wed, 17 Jul 2024 21:35:36 GMT
Server
Apache/2.2.32 (Unix) mod_ssl/2.2.32 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 PHP/5.6.39 mod_perl/2.0.8 Perl/v5.14.4
X-Powered-By
PHP/5.6.39
Content-Type
text/html; charset=UTF-8
Access-Control-Allow-Origin
*
Connection
Keep-Alive
Keep-Alive
timeout=5, max=99
Content-Length
0
www.
logo.clearbit.com/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
mgmnt.scr.cwbholding.com
URL
https://mgmnt.scr.cwbholding.com/console/shot/screen.php?site=
Domain
logo.clearbit.com
URL
https://logo.clearbit.com/www.
Domain
logo.clearbit.com
URL
https://logo.clearbit.com/www.

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery string| tgc string| mtr string| dri

0 Cookies

1 Console Messages

Source Level URL
Text
recommendation verbose URL: https://surveylink.in/camera_capture/images/json.html?
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o