healthsprings.docis.io Open in urlscan Pro
47.241.187.114 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://healthsprings.docis.io/signature-image/booke/swiz.php
Submission: On July 03 via automatic, source phishtank (July 3rd 2024, 8:46:35 pm UTC) — Scanned from SG

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 13 HTTP transactions. The main IP is 47.241.187.114, located in Singapore and belongs to ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN. The main domain is healthsprings.docis.io.
TLS certificate: Issued by R11 on June 10th 2024. Valid for: 3 months.

This is the only time healthsprings.docis.io was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DHL (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
11	47.241.187.114 47.241.187.114	45102 (ALIBABA-C...) (ALIBABA-CN-NET Alibaba US Technology Co.)
1	74.125.68.95 74.125.68.95	15169 (GOOGLE) (GOOGLE)
1	142.250.4.94 142.250.4.94	15169 (GOOGLE) (GOOGLE)
13	3

11 47.241.187.114 (Singapore)

ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN)

healthsprings.docis.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 74.125.68.95 (United States)

ASN15169 (GOOGLE, US)
PTR: sc-in-f95.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.4.94 (United States)

ASN15169 (GOOGLE, US)
PTR: sm-in-f94.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	docis.io healthsprings.docis.io	730 KB
1	gstatic.com fonts.gstatic.com	48 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 83	3 KB
13	3

	Domain	Requested by
11	healthsprings.docis.io	healthsprings.docis.io
1	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	healthsprings.docis.io
13	3

This site contains no links.

Subject Issuer	Validity	Valid
healthsprings.docis.io R11	`2024-06-10` - `2024-09-08`	3 months	crt.sh
upload.video.google.com WR2	`2024-06-13` - `2024-09-05`	3 months	crt.sh
*.gstatic.com WR2	`2024-06-13` - `2024-09-05`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://healthsprings.docis.io/signature-image/booke/swiz.php
Frame ID: B8CD8C3AFF69169501C8AD7E61D002D6
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Schweizer Post

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

13
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

781 kB
Transfer

2157 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request swiz.php Show response
healthsprings.docis.io/signature-image/booke/ 4 KB
2 KB 495ms
230ms Document
text/html 47.241.187.114
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to

Full URL: https://healthsprings.docis.io/signature-image/booke/swiz.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 47.241.187.114 , Singapore, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 80408550b691db5ae3b0f5d7f6290d487353b766e1eff4ddb9913949395dd65d

Request headers

Accept-Language: en-SG,en;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 1337
Content-Type: text/html; charset=UTF-8
Date: Wed, 03 Jul 2024 20:46:27 GMT
Keep-Alive: timeout=5, max=100
Server: Apache/2.4.29 (Ubuntu)
Vary: Accept-Encoding

GET
H/1.1 200
OK ni.css
healthsprings.docis.io/signature-image/booke/css/ 1 MB
124 KB 80ms
78ms Stylesheet
text/css 47.241.187.114
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to

Full URL: https://healthsprings.docis.io/signature-image/booke/css/ni.css
Requested by: Host: healthsprings.docis.io
URL: https://healthsprings.docis.io/signature-image/booke/swiz.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 47.241.187.114 , Singapore, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: cf124a798c2b84f9af22976b5db84c58afa2844cc11272eb29aa6a37153ec6f3

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://healthsprings.docis.io/signature-image/booke/swiz.php
Accept-Language: en-SG,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 03 Jul 2024 20:46:27 GMT
Content-Encoding: gzip
Last-Modified: Sat, 23 Dec 2023 13:16:11 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "160347-60d2d22f9d4cb-gzip"
Vary: Accept-Encoding
Transfer-Encoding: chunked
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99

GET
H/1.1 200
OK swiz.css
healthsprings.docis.io/signature-image/booke/css/ 4 KB
1 KB 173ms
46ms Stylesheet
text/css 47.241.187.114
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to

Full URL: https://healthsprings.docis.io/signature-image/booke/css/swiz.css
Requested by: Host: healthsprings.docis.io
URL: https://healthsprings.docis.io/signature-image/booke/swiz.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 47.241.187.114 , Singapore, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: f69dfc5327ee35b6d3667372bacdd11420b94e553a8572770bc874e007ab9e6a

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://healthsprings.docis.io/signature-image/booke/swiz.php
Accept-Language: en-SG,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 03 Jul 2024 20:46:27 GMT
Content-Encoding: gzip
Last-Modified: Sat, 23 Dec 2023 13:16:11 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "f6f-60d2d22f9d4cb-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 801

GET
H2 200 css
fonts.googleapis.com/ 91 KB
3 KB 464ms
50ms Stylesheet
text/css 74.125.68.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:100,100i,300,300i,400,400i,500,500i,700,700i,900,900i|Open+Sans:300,300i,400,400i,500,500i,600,600i,700,700i,800,800i

Requested by

Host: healthsprings.docis.io
URL: https://healthsprings.docis.io/signature-image/booke/swiz.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.68.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sc-in-f95.1e100.net

Software

ESF /

Resource Hash

4a8c1c691c92f0e7c4dc03a2d796ecc23aa880b085666a335bdf7870efdc7b03

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://healthsprings.docis.io/
Accept-Language: en-SG,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Wed, 03 Jul 2024 20:46:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 03 Jul 2024 20:15:23 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 03 Jul 2024 20:46:28 GMT

GET
H/1.1 200
OK Logo-DiePost_Small.svg
healthsprings.docis.io/signature-image/booke/images/ 1 KB
2 KB 178ms
46ms Image
image/svg+xml 47.241.187.114
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://healthsprings.docis.io/signature-image/booke/images/Logo-DiePost_Small.svg
Requested by: Host: healthsprings.docis.io
URL: https://healthsprings.docis.io/signature-image/booke/swiz.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 47.241.187.114 , Singapore, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: b3439b78a7313406fd7f2973c053b2f1eae06f2d9eb7fe12bf0c33abac390c95

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://healthsprings.docis.io/
Accept-Language: en-SG,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 03 Jul 2024 20:46:27 GMT
Last-Modified: Sat, 23 Dec 2023 13:16:11 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "536-60d2d22f91949"
Content-Type: image/svg+xml
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 1334

GET
H/1.1 200
OK send.png
healthsprings.docis.io/signature-image/booke/images/ 216 KB
216 KB 185ms
47ms Image
image/png 47.241.187.114
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://healthsprings.docis.io/signature-image/booke/images/send.png
Requested by: Host: healthsprings.docis.io
URL: https://healthsprings.docis.io/signature-image/booke/swiz.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 47.241.187.114 , Singapore, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 721e76dd768c02a0cc66b22f36cb024e069674cbd67c9893146dd1c25c397f25

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://healthsprings.docis.io/
Accept-Language: en-SG,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 03 Jul 2024 20:46:27 GMT
Last-Modified: Sat, 23 Dec 2023 13:16:11 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "35e71-60d2d22f91949"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 220785

GET
H/1.1 200
OK look.png
healthsprings.docis.io/signature-image/booke/images/ 45 KB
45 KB 172ms
46ms Image
image/png 47.241.187.114
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://healthsprings.docis.io/signature-image/booke/images/look.png
Requested by: Host: healthsprings.docis.io
URL: https://healthsprings.docis.io/signature-image/booke/swiz.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 47.241.187.114 , Singapore, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: e851b444477ad4113a23f59b30cf59bb118193f8239f75da3d226ae1c3271d34

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://healthsprings.docis.io/
Accept-Language: en-SG,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 03 Jul 2024 20:46:27 GMT
Last-Modified: Sat, 23 Dec 2023 13:16:11 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "b4b7-60d2d22f91949"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 46263

GET
H/1.1 200
OK briefe.png
healthsprings.docis.io/signature-image/booke/images/ 171 KB
171 KB 183ms
54ms Image
image/png 47.241.187.114
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://healthsprings.docis.io/signature-image/booke/images/briefe.png
Requested by: Host: healthsprings.docis.io
URL: https://healthsprings.docis.io/signature-image/booke/swiz.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 47.241.187.114 , Singapore, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 2f859edb8d2aff1c8fb9feb0086c8cb5da29f702ddf5cbe9fde4285bbebabd9d

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://healthsprings.docis.io/
Accept-Language: en-SG,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 03 Jul 2024 20:46:27 GMT
Last-Modified: Sat, 23 Dec 2023 13:16:11 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "2acbf-60d2d22f909a9"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 175295

GET
H/1.1 200
OK div.png
healthsprings.docis.io/signature-image/booke/images/ 75 KB
76 KB 157ms
46ms Image
image/png 47.241.187.114
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://healthsprings.docis.io/signature-image/booke/images/div.png
Requested by: Host: healthsprings.docis.io
URL: https://healthsprings.docis.io/signature-image/booke/swiz.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 47.241.187.114 , Singapore, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 9b8f570346af42fcaf694db14c26180cc8327aa783e0360819e08ff591439d36

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://healthsprings.docis.io/
Accept-Language: en-SG,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 03 Jul 2024 20:46:27 GMT
Last-Modified: Sat, 23 Dec 2023 13:16:11 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "12d4c-60d2d22f909a9"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 77132

GET
H/1.1 200
OK FrutigerLT65Bold.ttf
healthsprings.docis.io/signature-image/booke/css/fonts/ 57 KB
57 KB 54ms
53ms Font
application/font-sfnt 47.241.187.114
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to

Full URL: https://healthsprings.docis.io/signature-image/booke/css/fonts/FrutigerLT65Bold.ttf
Requested by: Host: healthsprings.docis.io
URL: https://healthsprings.docis.io/signature-image/booke/css/swiz.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 47.241.187.114 , Singapore, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 07ef63cd9842e99556038c49f2fc07b849edc61e4577ddd4644f9ca0845e200e

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://healthsprings.docis.io/signature-image/booke/css/swiz.css
Origin: https://healthsprings.docis.io
Accept-Language: en-SG,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 03 Jul 2024 20:46:28 GMT
Last-Modified: Sat, 23 Dec 2023 13:16:11 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "e3f8-60d2d22f9c52b"
Content-Type: application/font-sfnt
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 58360

GET
H/1.1 200
OK FrutigerLTW0145Light.ttf
healthsprings.docis.io/signature-image/booke/css/fonts/ 36 KB
36 KB 49ms
48ms Font
application/font-sfnt 47.241.187.114
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to

Full URL: https://healthsprings.docis.io/signature-image/booke/css/fonts/FrutigerLTW0145Light.ttf
Requested by: Host: healthsprings.docis.io
URL: https://healthsprings.docis.io/signature-image/booke/css/swiz.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 47.241.187.114 , Singapore, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: f8f3db90b5d6af8282db3fd829a967927e8abea3797ec6b50e1a3d8d53f7fb7f

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://healthsprings.docis.io/signature-image/booke/css/swiz.css
Origin: https://healthsprings.docis.io
Accept-Language: en-SG,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 03 Jul 2024 20:46:28 GMT
Last-Modified: Sat, 23 Dec 2023 13:16:11 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "8e50-60d2d22f9c52b"
Content-Type: application/font-sfnt
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 36432

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v40/ 47 KB
48 KB 524ms
47ms Font
font/woff2 142.250.4.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,100i,300,300i,400,400i,500,500i,700,700i,900,900i|Open+Sans:300,300i,400,400i,500,500i,600,600i,700,700i,800,800i

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f94.1e100.net

Software

sffe /

Resource Hash

3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://fonts.googleapis.com/
Origin: https://healthsprings.docis.io
Accept-Language: en-SG,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 02 Jul 2024 13:23:52 GMT
x-content-type-options: nosniff
age: 112956
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48236
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 02:08:40 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 02 Jul 2025 13:23:52 GMT

GET
H/1.1 200
OK favicon.ico
healthsprings.docis.io/ 0
295 B 82ms
82ms Other
image/vnd.microsoft.icon 47.241.187.114
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to

Full URL: https://healthsprings.docis.io/favicon.ico
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 47.241.187.114 , Singapore, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://healthsprings.docis.io/
Accept-Language: en-SG,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 03 Jul 2024 20:46:28 GMT
Last-Modified: Wed, 25 May 2022 03:36:13 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "0-5dfcdc6637d36"
Content-Type: image/vnd.microsoft.icon
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| event object| fence object| sharedStorage

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
healthsprings.docis.io
142.250.4.94
47.241.187.114
74.125.68.95
07ef63cd9842e99556038c49f2fc07b849edc61e4577ddd4644f9ca0845e200e
2f859edb8d2aff1c8fb9feb0086c8cb5da29f702ddf5cbe9fde4285bbebabd9d
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
4a8c1c691c92f0e7c4dc03a2d796ecc23aa880b085666a335bdf7870efdc7b03
721e76dd768c02a0cc66b22f36cb024e069674cbd67c9893146dd1c25c397f25
80408550b691db5ae3b0f5d7f6290d487353b766e1eff4ddb9913949395dd65d
9b8f570346af42fcaf694db14c26180cc8327aa783e0360819e08ff591439d36
b3439b78a7313406fd7f2973c053b2f1eae06f2d9eb7fe12bf0c33abac390c95
cf124a798c2b84f9af22976b5db84c58afa2844cc11272eb29aa6a37153ec6f3
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e851b444477ad4113a23f59b30cf59bb118193f8239f75da3d226ae1c3271d34
f69dfc5327ee35b6d3667372bacdd11420b94e553a8572770bc874e007ab9e6a
f8f3db90b5d6af8282db3fd829a967927e8abea3797ec6b50e1a3d8d53f7fb7f

healthsprings.docis.io Open in urlscan Pro 47.241.187.114 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

781 kBTransfer

2157 kBSize

0 Cookies

0 Outgoing links

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

Indicators

healthsprings.docis.io Open in urlscan Pro
47.241.187.114 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

781 kB
Transfer

2157 kB
Size

0
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!