rolleintegrativehealingsolutions.com Open in urlscan Pro
207.55.245.88 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://hdl.handle.net/11346/AlliedbenefitNewPlanningFolderSummary2018-IMR2
Effective URL:
https://rolleintegrativehealingsolutions.com/sandcastle-online.com/mam23k22k/login-crypt.php?&sessionid=65a89d51a74c843ac913134976da73e8&secu...
Submission: On May 03 via api (May 3rd 2018, 4:06:58 pm UTC) from US

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 2 countries across 7 domains to perform 12 HTTP transactions. The main IP is 207.55.245.88, located in Saint Petersburg, United States and belongs to AS17054 - CONTINENTAL BROADBAND PENNSYLVANIA, INC., US. The main domain is rolleintegrativehealingsolutions.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on March 27th 2018. Valid for: 3 months.

This is the only time rolleintegrativehealingsolutions.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DocuSign (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	52.19.202.222 52.19.202.222	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	69.73.180.151 69.73.180.151	3595 (GNAXNET-AS) (GNAXNET-AS - Global Net Access)
2 5	207.55.245.88 207.55.245.88	17054 (AS17054) (AS17054 - CONTINENTAL BROADBAND PENNSYLVANIA)
5	162.248.185.48 162.248.185.48	62856 (DOCUS-6-PROD) (DOCUS-6-PROD - Docusign)
1	104.27.127.62 104.27.127.62	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	52.218.208.80 52.218.208.80	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
12	6

1 52.19.202.222 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-19-202-222.eu-west-1.compute.amazonaws.com

hdl.handle.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.73.180.151 (Spring, United States)

ASN3595 (GNAXNET-AS - Global Net Access, LLC, US)
PTR: buana.servmap.com

ldcontrol.com.mx	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 207.55.245.88 (Saint Petersburg, United States) 2 redirects

ASN17054 (AS17054 - CONTINENTAL BROADBAND PENNSYLVANIA, INC., US)
PTR: s88.s245.n55.n207.deluxehosting.com

rolleintegrativehealingsolutions.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 162.248.185.48 (United States)

ASN62856 (DOCUS-6-PROD - Docusign, Inc, US)
PTR: na2.docusign.net

na2.docusign.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.27.127.62 (San Francisco, United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

image.ibb.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.218.208.80 (Boardman, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: s3-us-west-2.amazonaws.com

s3-us-west-2.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	docusign.net na2.docusign.net	19 KB
5	rolleintegrativehealingsolutions.com 2 redirects rolleintegrativehealingsolutions.com	142 KB
1	amazonaws.com s3-us-west-2.amazonaws.com	2 KB
1	ibb.co image.ibb.co	628 B
1	ldcontrol.com.mx ldcontrol.com.mx	357 B
1	handle.net 1 redirects hdl.handle.net	241 B
0	akamaihd.net Failed docucdn-a.akamaihd.net Failed
12	7

	Domain	Requested by
5	na2.docusign.net	rolleintegrativehealingsolutions.com
5	rolleintegrativehealingsolutions.com	2 redirects rolleintegrativehealingsolutions.com
1	s3-us-west-2.amazonaws.com	rolleintegrativehealingsolutions.com
1	image.ibb.co	rolleintegrativehealingsolutions.com
1	ldcontrol.com.mx
1	hdl.handle.net	1 redirects
0	docucdn-a.akamaihd.net Failed	rolleintegrativehealingsolutions.com
12	7

This site contains no links.

Subject Issuer	Validity	Valid
ldcontrol.com.mx cPanel, Inc. Certification Authority	`2018-02-25` - `2018-05-26`	3 months	crt.sh
rolleintegrativehealingsolutions.com cPanel, Inc. Certification Authority	`2018-03-27` - `2018-06-25`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://rolleintegrativehealingsolutions.com/sandcastle-online.com/mam23k22k/login-crypt.php?&sessionid=65a89d51a74c843ac913134976da73e8&securessl=true
Frame ID: A6CA509E64620C29A07B0373ED26BE63
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://hdl.handle.net/11346/AlliedbenefitNewPlanningFolderSummary2018-IMR2 HTTP 303
https://ldcontrol.com.mx/management.php Page URL
https://rolleintegrativehealingsolutions.com/sandcastle-online.com/mam23k22k HTTP 301
https://rolleintegrativehealingsolutions.com/sandcastle-online.com/mam23k22k/ HTTP 302
https://rolleintegrativehealingsolutions.com/sandcastle-online.com/mam23k22k/login-crypt.php?&sessionid=65a89d51a74c843ac... Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

12
Requests

33 %
HTTPS

0 %
IPv6

7
Domains

7
Subdomains

6
IPs

2
Countries

164 kB
Transfer

167 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://hdl.handle.net/11346/AlliedbenefitNewPlanningFolderSummary2018-IMR2 HTTP 303
https://ldcontrol.com.mx/management.php Page URL
https://rolleintegrativehealingsolutions.com/sandcastle-online.com/mam23k22k HTTP 301
https://rolleintegrativehealingsolutions.com/sandcastle-online.com/mam23k22k/ HTTP 302
https://rolleintegrativehealingsolutions.com/sandcastle-online.com/mam23k22k/login-crypt.php?&sessionid=65a89d51a74c843ac913134976da73e8&securessl=true Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://hdl.handle.net/11346/AlliedbenefitNewPlanningFolderSummary2018-IMR2 HTTP 303
https://ldcontrol.com.mx/management.php

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

management.php Show response
ldcontrol.com.mx/
Redirect Chain

https://hdl.handle.net/11346/AlliedbenefitNewPlanningFolderSummary2018-IMR2
https://ldcontrol.com.mx/management.php

124 B
357 B

442ms
172ms

Document
text/html

69.73.180.151
Global Net Access

General

Check archive.org

Show headers Download Go to

Full URL: https://ldcontrol.com.mx/management.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 69.73.180.151 Spring, United States, ASN3595 (GNAXNET-AS - Global Net Access, LLC, US),
Reverse DNS: buana.servmap.com
Software: Apache / PHP/5.6.31
Resource Hash: 290b41b9cba87e3c5377291e41ce06eac40eb639758cfaf83bb85b6f9eb12dfd

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: ldcontrol.com.mx
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Cache-Control: no-cache
Connection: keep-alive
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Thu, 03 May 2018 16:06:47 GMT
Server: Apache
Connection: Keep-Alive
X-Powered-By: PHP/5.6.31
Transfer-Encoding: chunked
Keep-Alive: timeout=5, max=100
Content-Type: text/html; charset=UTF-8

Redirect headers

Location: https://ldcontrol.com.mx/management.php
Date: Thu, 03 May 2018 16:06:47 GMT
Expires: Thu, 03 May 2018 16:08:27 GMT
Server: Apache-Coyote/1.1
Content-Length: 163
Content-Type: text/html;charset=utf-8

GET
H/1.1

200
OK

Primary Request login-crypt.php Show response
rolleintegrativehealingsolutions.com/sandcastle-online.com/mam23k22k/
Redirect Chain

https://rolleintegrativehealingsolutions.com/sandcastle-online.com/mam23k22k
https://rolleintegrativehealingsolutions.com/sandcastle-online.com/mam23k22k/
https://rolleintegrativehealingsolutions.com/sandcastle-online.com/mam23k22k/login-crypt.php?&sessionid=65a89d51a74c843ac913134976da73e8&securessl=true

140 KB
140 KB

196ms
192ms

Document
text/html

207.55.245.88
CONTINENTAL BROAD...

General

Check archive.org

Show headers Download Go to

Full URL: https://rolleintegrativehealingsolutions.com/sandcastle-online.com/mam23k22k/login-crypt.php?&sessionid=65a89d51a74c843ac913134976da73e8&securessl=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 207.55.245.88 Saint Petersburg, United States, ASN17054 (AS17054 - CONTINENTAL BROADBAND PENNSYLVANIA, INC., US),
Reverse DNS: s88.s245.n55.n207.deluxehosting.com
Software: Apache /
Resource Hash: 17518f2739af625ae6c1bb1a59e3a25a24ec30c24450b547d5e1d5edb9ec2faf

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: rolleintegrativehealingsolutions.com
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: https://ldcontrol.com.mx/management.php
Connection: keep-alive
Cache-Control: no-cache
Referer: https://ldcontrol.com.mx/management.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Thu, 03 May 2018 16:06:48 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=48
Transfer-Encoding: chunked
Content-Type: text/html

Redirect headers

Location: login-crypt.php?&sessionid=65a89d51a74c843ac913134976da73e8&securessl=true
Date: Thu, 03 May 2018 16:06:48 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=49
Transfer-Encoding: chunked
Content-Type: text/html

GET font-faces.css
docucdn-a.akamaihd.net/signing/1.9.0/css/ 0
0

GET
H/1.1 200
OK button.css
rolleintegrativehealingsolutions.com/sandcastle-online.com/mam23k22k/css/ 1 KB
2 KB 122ms
121ms Stylesheet
text/css 207.55.245.88
CONTINENTAL BROAD...

General

Check archive.org

Show headers Download Go to

Full URL: https://rolleintegrativehealingsolutions.com/sandcastle-online.com/mam23k22k/css/button.css
Requested by: Host: rolleintegrativehealingsolutions.com
URL: https://rolleintegrativehealingsolutions.com/sandcastle-online.com/mam23k22k/login-crypt.php?&sessionid=65a89d51a74c843ac913134976da73e8&securessl=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 207.55.245.88 Saint Petersburg, United States, ASN17054 (AS17054 - CONTINENTAL BROADBAND PENNSYLVANIA, INC., US),
Reverse DNS: s88.s245.n55.n207.deluxehosting.com
Software: Apache /
Resource Hash: 79b9ebe621ca631ffc7f7650f1689800a839307df392b6c6e2a8f2abf596643b

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: rolleintegrativehealingsolutions.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: https://rolleintegrativehealingsolutions.com/sandcastle-online.com/mam23k22k/login-crypt.php?&sessionid=65a89d51a74c843ac913134976da73e8&securessl=true
Connection: keep-alive
Cache-Control: no-cache
Referer: https://rolleintegrativehealingsolutions.com/sandcastle-online.com/mam23k22k/login-crypt.php?&sessionid=65a89d51a74c843ac913134976da73e8&securessl=true
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Thu, 03 May 2018 16:06:49 GMT
Last-Modified: Mon, 30 Apr 2018 09:54:06 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=47
Content-Length: 1501

GET
H/1.1 200
OK Framework.css
na2.docusign.net/Member/StyleSheets/ 4 KB
2 KB 204ms
204ms Stylesheet
text/css 162.248.185.48
Docusign

General

Check archive.org

Show headers Download Go to

Full URL

https://na2.docusign.net/Member/StyleSheets/Framework.css?vers=18.1.101.8642

Requested by

Host: rolleintegrativehealingsolutions.com
URL: https://rolleintegrativehealingsolutions.com/sandcastle-online.com/mam23k22k/login-crypt.php?&sessionid=65a89d51a74c843ac913134976da73e8&securessl=true

Protocol

HTTP/1.1

Server

162.248.185.48 , United States, ASN62856 (DOCUS-6-PROD - Docusign, Inc, US),

Reverse DNS

na2.docusign.net

Software

Resource Hash

c8757d8c26bfb7536415c21fc144a7740cf6e4e3d3324f231d469c4e46facef1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://rolleintegrativehealingsolutions.com/sandcastle-online.com/mam23k22k/login-crypt.php?&sessionid=65a89d51a74c843ac913134976da73e8&securessl=true
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Thu, 03 May 2018 16:06:49 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: text/css
Last-Modified: Tue, 17 Apr 2018 19:32:32 GMT
ETag: "04850d482d6d31:0"
Strict-Transport-Security: max-age=31536000; includeSubDomains
p3p: CP="IDC DSP COR CURa ADMa OUR IND PHY ONL COM STA"
Connection: Keep-Alive
Accept-Ranges: bytes
X-DocuSign-Node: CH2FE74
Content-Length: 1524

GET
H/1.1 200
OK MemberLogin.css
na2.docusign.net/Member/StyleSheets/ 6 KB
3 KB 110ms
110ms Stylesheet
text/css 162.248.185.48
Docusign

General

Check archive.org

Show headers Download Go to

Full URL

https://na2.docusign.net/Member/StyleSheets/MemberLogin.css?vers=18.1.101.8642

Requested by

Protocol

HTTP/1.1

Server

162.248.185.48 , United States, ASN62856 (DOCUS-6-PROD - Docusign, Inc, US),

Reverse DNS

na2.docusign.net

Software

Resource Hash

c6f240ed7feb3562e96184fb6a928528d7f55f9037d31557f6c33e342841dcd5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://rolleintegrativehealingsolutions.com/sandcastle-online.com/mam23k22k/login-crypt.php?&sessionid=65a89d51a74c843ac913134976da73e8&securessl=true
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Thu, 03 May 2018 16:06:48 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: text/css
Last-Modified: Tue, 17 Apr 2018 19:32:32 GMT
ETag: "04850d482d6d31:0"
Strict-Transport-Security: max-age=31536000; includeSubDomains
p3p: CP="IDC DSP COR CURa ADMa OUR IND PHY ONL COM STA"
Connection: Keep-Alive
Accept-Ranges: bytes
X-DocuSign-Node: CH3FE13
Content-Length: 2072

GET
H/1.1 200
OK docusign.png
na2.docusign.net/Member/Images/ 7 KB
8 KB 109ms
109ms Image
image/png 162.248.185.48
Docusign

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://na2.docusign.net/Member/Images/docusign.png

Requested by

Protocol

HTTP/1.1

Server

162.248.185.48 , United States, ASN62856 (DOCUS-6-PROD - Docusign, Inc, US),

Reverse DNS

na2.docusign.net

Software

Resource Hash

fa2776137cbda7fb85aaa56be710f14e5d3d18e231756cfbe283a2938e7d6620

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://rolleintegrativehealingsolutions.com/sandcastle-online.com/mam23k22k/login-crypt.php?&sessionid=65a89d51a74c843ac913134976da73e8&securessl=true
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Thu, 03 May 2018 16:06:48 GMT
Content-Type: image/png
Last-Modified: Thu, 15 Mar 2018 23:38:36 GMT
ETag: "026b6bcb6bcd31:0"
Strict-Transport-Security: max-age=31536000; includeSubDomains
p3p: CP="IDC DSP COR CURa ADMa OUR IND PHY ONL COM STA"
Accept-Ranges: bytes
X-DocuSign-Node: CH3FE13
Content-Length: 7635

GET
H/1.1 200
OK powered_by_docusign_gray.png
na2.docusign.net/Member/Images/ 3 KB
3 KB 110ms
109ms Image
image/png 162.248.185.48
Docusign

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://na2.docusign.net/Member/Images/powered_by_docusign_gray.png

Requested by

Protocol

HTTP/1.1

Server

162.248.185.48 , United States, ASN62856 (DOCUS-6-PROD - Docusign, Inc, US),

Reverse DNS

na2.docusign.net

Software

Resource Hash

4d48e45cf65adea52c6057d85dbcc34528b7829cb5f5b80565a1b5d24972bacc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://rolleintegrativehealingsolutions.com/sandcastle-online.com/mam23k22k/login-crypt.php?&sessionid=65a89d51a74c843ac913134976da73e8&securessl=true
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Thu, 03 May 2018 16:06:49 GMT
Content-Type: image/png
Last-Modified: Thu, 15 Mar 2018 23:38:38 GMT
ETag: "053e7bdb6bcd31:0"
Strict-Transport-Security: max-age=31536000; includeSubDomains
p3p: CP="IDC DSP COR CURa ADMa OUR IND PHY ONL COM STA"
Accept-Ranges: bytes
X-DocuSign-Node: CH2FE74
Content-Length: 2709

GET
H/1.1 200
OK btn_arrow_u.png
na2.docusign.net/Member/Images/controls/ 3 KB
3 KB 135ms
110ms Image
image/png 162.248.185.48
Docusign

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://na2.docusign.net/Member/Images/controls/btn_arrow_u.png

Requested by

Protocol

HTTP/1.1

Server

162.248.185.48 , United States, ASN62856 (DOCUS-6-PROD - Docusign, Inc, US),

Reverse DNS

na2.docusign.net

Software

Resource Hash

015a8b230071ba12f8d35bc401908c7fdf9a27af371c235e253db9cfc738f732

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://rolleintegrativehealingsolutions.com/sandcastle-online.com/mam23k22k/login-crypt.php?&sessionid=65a89d51a74c843ac913134976da73e8&securessl=true
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Thu, 03 May 2018 16:06:49 GMT
Content-Type: image/png
Last-Modified: Thu, 15 Mar 2018 23:38:36 GMT
ETag: "026b6bcb6bcd31:0"
Strict-Transport-Security: max-age=31536000; includeSubDomains
p3p: CP="IDC DSP COR CURa ADMa OUR IND PHY ONL COM STA"
Accept-Ranges: bytes
X-DocuSign-Node: CH2FE74
Content-Length: 2952

GET
H/1.1 404
Not Found body_background.png
rolleintegrativehealingsolutions.com/sandcastle-online.com/mam23k22k/Images/backgrounds/ 171 B
171 B 1020ms
1019ms Image
text/html 207.55.245.88
CONTINENTAL BROAD...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rolleintegrativehealingsolutions.com/sandcastle-online.com/mam23k22k/Images/backgrounds/body_background.png
Requested by: Host: rolleintegrativehealingsolutions.com
URL: https://rolleintegrativehealingsolutions.com/sandcastle-online.com/mam23k22k/login-crypt.php?&sessionid=65a89d51a74c843ac913134976da73e8&securessl=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 207.55.245.88 Saint Petersburg, United States, ASN17054 (AS17054 - CONTINENTAL BROADBAND PENNSYLVANIA, INC., US),
Reverse DNS: s88.s245.n55.n207.deluxehosting.com
Software: Apache /
Resource Hash: 93aa7357e7d20bed343a75108110c2bc2723c20acc14931b1a70541677e1ba9e

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: rolleintegrativehealingsolutions.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: https://rolleintegrativehealingsolutions.com/sandcastle-online.com/mam23k22k/login-crypt.php?&sessionid=65a89d51a74c843ac913134976da73e8&securessl=true
Connection: keep-alive
Cache-Control: no-cache
Referer: https://rolleintegrativehealingsolutions.com/sandcastle-online.com/mam23k22k/login-crypt.php?&sessionid=65a89d51a74c843ac913134976da73e8&securessl=true
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Thu, 03 May 2018 16:06:49 GMT
Server: Apache
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Cache-Control: no-cache, must-revalidate, max-age=0
Connection: Keep-Alive
Link: <https://rolleintegrativehealingsolutions.com/wp-json/>; rel="https://api.w.org/"
Keep-Alive: timeout=5, max=46
Expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
S 200 office_365_Smole.png
image.ibb.co/mr3Vrx/ 428 B
628 B 8ms
8ms Image
image/png 104.27.127.62
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image.ibb.co/mr3Vrx/office_365_Smole.png
Requested by: Host: rolleintegrativehealingsolutions.com
URL: https://rolleintegrativehealingsolutions.com/sandcastle-online.com/mam23k22k/login-crypt.php?&sessionid=65a89d51a74c843ac913134976da73e8&securessl=true
Protocol: SPDY
Server: 104.27.127.62 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: be1143dbc841cdf988b8b8cc8f50aeaae228d1501c52066d96ba05fa787d6e99

Request headers

Referer: https://rolleintegrativehealingsolutions.com/sandcastle-online.com/mam23k22k/css/button.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Thu, 03 May 2018 16:06:49 GMT
cf-cache-status: HIT
last-modified: Mon, 30 Apr 2018 15:49:57 GMT, Mon, 30 Apr 2018 15:49:57 GMT
server: cloudflare
status: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=315360000
accept-ranges: bytes
cf-ray: 4153fa1f8d5697b0-FRA
content-length: 428
expires: Sun, 30 Apr 2028 16:06:49 GMT

GET
H/1.1 200
OK icon_google.png
s3-us-west-2.amazonaws.com/s.cdpn.io/14082/ 1 KB
2 KB 711ms
182ms Image
image/png 52.218.208.80
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3-us-west-2.amazonaws.com/s.cdpn.io/14082/icon_google.png
Requested by: Host: rolleintegrativehealingsolutions.com
URL: https://rolleintegrativehealingsolutions.com/sandcastle-online.com/mam23k22k/login-crypt.php?&sessionid=65a89d51a74c843ac913134976da73e8&securessl=true
Protocol: HTTP/1.1
Server: 52.218.208.80 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: s3-us-west-2.amazonaws.com
Software: AmazonS3 /
Resource Hash: 2a98026430dddc53539d283c04a2ad4b50536c93d0becadb03f3f61443e52c9c

Request headers

Referer: https://rolleintegrativehealingsolutions.com/sandcastle-online.com/mam23k22k/css/button.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Thu, 03 May 2018 16:06:51 GMT
Last-Modified: Mon, 17 Nov 2014 01:09:08 GMT
Server: AmazonS3
x-amz-request-id: A91BB8EC2106E537
ETag: "b63ad4034e043afb2bb31f64cc4988f1"
x-amz-version-id: null
Cache-Control: public
Accept-Ranges: bytes
Content-Type: image/png
Content-Length: 1428
x-amz-id-2: ogFxKB8o5Vi4fX2mjgQjdmXF+uzT+ZhDzRCRlrMruEGZyi9mEqyeNBsOyq8DJivvCbBDbDph5Fs=

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: docucdn-a.akamaihd.net
URL: http://docucdn-a.akamaihd.net/signing/1.9.0/css/font-faces.css

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DocuSign (Online)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.docusign.com/	1970-01-19 00:28:19	Name: mp_a4ee8d8b6f1745aa7258839a6a8ac8c9_mixpanel Value: %7B%22distinct_id%22%3A%20%2216326c192d2695-02527b03517b56-3b6e167f-1d4c00-16326c192d3f9%22%2C%22%24initial_referring_domain%22%3A%20%22rolleintegrativehealingsolutions.com%22%7D
			.docusign.com/	1970-01-19 00:28:19	Name: __cfduid Value: d52e145b07cb23c8dd43d173339ea05251525363609

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

docucdn-a.akamaihd.net
hdl.handle.net
image.ibb.co
ldcontrol.com.mx
na2.docusign.net
rolleintegrativehealingsolutions.com
s3-us-west-2.amazonaws.com
docucdn-a.akamaihd.net
104.27.127.62
162.248.185.48
207.55.245.88
52.19.202.222
52.218.208.80
69.73.180.151
015a8b230071ba12f8d35bc401908c7fdf9a27af371c235e253db9cfc738f732
17518f2739af625ae6c1bb1a59e3a25a24ec30c24450b547d5e1d5edb9ec2faf
290b41b9cba87e3c5377291e41ce06eac40eb639758cfaf83bb85b6f9eb12dfd
2a98026430dddc53539d283c04a2ad4b50536c93d0becadb03f3f61443e52c9c
4d48e45cf65adea52c6057d85dbcc34528b7829cb5f5b80565a1b5d24972bacc
79b9ebe621ca631ffc7f7650f1689800a839307df392b6c6e2a8f2abf596643b
93aa7357e7d20bed343a75108110c2bc2723c20acc14931b1a70541677e1ba9e
be1143dbc841cdf988b8b8cc8f50aeaae228d1501c52066d96ba05fa787d6e99
c6f240ed7feb3562e96184fb6a928528d7f55f9037d31557f6c33e342841dcd5
c8757d8c26bfb7536415c21fc144a7740cf6e4e3d3324f231d469c4e46facef1
fa2776137cbda7fb85aaa56be710f14e5d3d18e231756cfbe283a2938e7d6620

rolleintegrativehealingsolutions.com Open in urlscan Pro 207.55.245.88 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

33 %HTTPS

0 %IPv6

7 Domains

7 Subdomains

6 IPs

2 Countries

164 kBTransfer

167 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

2 Cookies

Indicators

rolleintegrativehealingsolutions.com Open in urlscan Pro
207.55.245.88 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

33 %
HTTPS

0 %
IPv6

7
Domains

7
Subdomains

6
IPs

2
Countries

164 kB
Transfer

167 kB
Size

2
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!