www.polymedicure.com Open in urlscan Pro
103.11.84.216 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.polymedicure.com/cgi/DocuSign/DocuSign/
Effective URL:
https://www.polymedicure.com/cgi/DocuSign/DocuSign/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_Je...
Submission: On August 20 via manual (August 20th 2018, 10:25:06 pm UTC) from US

Summary HTTP 11 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 11 HTTP transactions. The main IP is 103.11.84.216, located in Nagar, India and belongs to CYBERSPACE-IN NIL-36C, Malviya Nagar, IN. The main domain is www.polymedicure.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on August 13th 2018. Valid for: 3 months.

This is the only time www.polymedicure.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DocuSign (Online) DHL (Transportation)

Domain & IP information

	IP Address		AS Autonomous System
11	103.11.84.216 103.11.84.216		132052 (CYBERSPAC...) (CYBERSPACE-IN NIL-36C)
11	1

11 103.11.84.216 (Nagar, India)

ASN132052 (CYBERSPACE-IN NIL-36C, Malviya Nagar, IN)
PTR: s216.cyberspace.in

www.polymedicure.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	polymedicure.com www.polymedicure.com	401 KB
11	1

	Domain	Requested by
11	www.polymedicure.com	www.polymedicure.com
11	1

This site contains no links.

Subject Issuer	Validity	Valid
polymedicure.com cPanel, Inc. Certification Authority	`2018-08-13` - `2018-11-11`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.polymedicure.com/cgi/DocuSign/DocuSign/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto=
Frame ID: D9C6DE30DD5F7A65C231A36790A11208
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://www.polymedicure.com/cgi/DocuSign/DocuSign/ Page URL
https://www.polymedicure.com/cgi/DocuSign/DocuSign/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq... Page URL

Detected technologies

UNIX (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Unix/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

mod_ssl (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /mod_ssl(?:\/([\d.]+))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
headers server /mod_ssl(?:\/([\d.]+))?/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
script /jquery.*\.js/i
env /^jQuery$/i

Page Statistics

11
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

401 kB
Transfer

397 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.polymedicure.com/cgi/DocuSign/DocuSign/ Page URL
https://www.polymedicure.com/cgi/DocuSign/DocuSign/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ Show response www.polymedicure.com/cgi/DocuSign/DocuSign/	537 B 836 B	803ms 228ms	Document text/html	103.11.84.216 CYBERSPACE-IN NIL...
General Check archive.org Show headers Download Go to Full URL https://www.polymedicure.com/cgi/DocuSign/DocuSign/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 103.11.84.216 Nagar, India, ASN132052 (CYBERSPACE-IN NIL-36C, Malviya Nagar, IN), Reverse DNS s216.cyberspace.in Software Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 mod_qos/11.5 / PHP/5.4.45 Resource Hash `90931f890c362a6624f5f79c4dddaa8f891c57ff30582b15ae78b88f1feef89b` Request headers Host www.polymedicure.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 X-DevTools-Emulate-Network-Conditions-Client-Id D9C6DE30DD5F7A65C231A36790A11208 Response headers Date Mon, 20 Aug 2018 22:24:55 GMT Server Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 mod_qos/11.5 X-Powered-By PHP/5.4.45 Keep-Alive timeout=5, max=100 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html
GET H/1.1	200 OK	hl.jpg www.polymedicure.com/cgi/DocuSign/DocuSign/img/	27 KB 27 KB	230ms 156ms	Image image/jpeg	103.11.84.216 CYBERSPACE-IN NIL...
General Check archive.org Show headers Download Go to Show image Full URL https://www.polymedicure.com/cgi/DocuSign/DocuSign/img/hl.jpg Requested by Host: www.polymedicure.com URL: https://www.polymedicure.com/cgi/DocuSign/DocuSign/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 103.11.84.216 Nagar, India, ASN132052 (CYBERSPACE-IN NIL-36C, Malviya Nagar, IN), Reverse DNS s216.cyberspace.in Software Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 mod_qos/11.5 / Resource Hash `37c69dd0cf49f80d3b13d52c3cc4a2d5d80def209135b42397699d2b7594207c` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.polymedicure.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* https://www.polymedicure.com/cgi/DocuSign/DocuSign/ Connection keep-alive Cache-Control no-cache Referer https://www.polymedicure.com/cgi/DocuSign/DocuSign/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Mon, 20 Aug 2018 22:24:55 GMT Last-Modified Tue, 07 Nov 2017 08:43:38 GMT Server Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 mod_qos/11.5 ETag "1180a1f-6bf1-55d6091358280" Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 27633
GET H/1.1	200 OK	bar.gif www.polymedicure.com/cgi/DocuSign/DocuSign/img/	189 KB 189 KB	319ms 173ms	Image image/gif	103.11.84.216 CYBERSPACE-IN NIL...
General Check archive.org Show headers Download Go to Show image Full URL https://www.polymedicure.com/cgi/DocuSign/DocuSign/img/bar.gif Requested by Host: www.polymedicure.com URL: https://www.polymedicure.com/cgi/DocuSign/DocuSign/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 103.11.84.216 Nagar, India, ASN132052 (CYBERSPACE-IN NIL-36C, Malviya Nagar, IN), Reverse DNS s216.cyberspace.in Software Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 mod_qos/11.5 / Resource Hash `84a75ad61d0404ae29810295acffc370e195b64227a5445c30613ea316bdafdc` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.polymedicure.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* https://www.polymedicure.com/cgi/DocuSign/DocuSign/ Connection keep-alive Cache-Control no-cache Referer https://www.polymedicure.com/cgi/DocuSign/DocuSign/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Mon, 20 Aug 2018 22:24:55 GMT Last-Modified Tue, 07 Nov 2017 08:43:38 GMT Server Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 mod_qos/11.5 ETag "1180a14-2f475-55d6091358280" Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 193653
GET H/1.1	200 OK	Primary Request u.php Show response www.polymedicure.com/cgi/DocuSign/DocuSign/	5 KB 5 KB	222ms 222ms	Document text/html	103.11.84.216 CYBERSPACE-IN NIL...
General Check archive.org Show headers Download Go to Full URL https://www.polymedicure.com/cgi/DocuSign/DocuSign/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto= Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 103.11.84.216 Nagar, India, ASN132052 (CYBERSPACE-IN NIL-36C, Malviya Nagar, IN), Reverse DNS s216.cyberspace.in Software Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 mod_qos/11.5 / PHP/5.4.45 Resource Hash `5e26cca4db1293367b57b261d69d6252174214950820cf6431775fb116b6e114` Request headers Host www.polymedicure.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Referer https://www.polymedicure.com/cgi/DocuSign/DocuSign/ Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 X-DevTools-Emulate-Network-Conditions-Client-Id D9C6DE30DD5F7A65C231A36790A11208 Referer https://www.polymedicure.com/cgi/DocuSign/DocuSign/ Response headers Date Mon, 20 Aug 2018 22:24:58 GMT Server Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 mod_qos/11.5 X-Powered-By PHP/5.4.45 Keep-Alive timeout=5, max=99 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html
GET H/1.1	200 OK	facebox.css www.polymedicure.com/cgi/DocuSign/DocuSign/	1 KB 1 KB	155ms 154ms	Stylesheet text/css	103.11.84.216 CYBERSPACE-IN NIL...
General Check archive.org Show headers Download Go to Full URL https://www.polymedicure.com/cgi/DocuSign/DocuSign/facebox.css Requested by Host: www.polymedicure.com URL: https://www.polymedicure.com/cgi/DocuSign/DocuSign/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto= Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 103.11.84.216 Nagar, India, ASN132052 (CYBERSPACE-IN NIL-36C, Malviya Nagar, IN), Reverse DNS s216.cyberspace.in Software Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 mod_qos/11.5 / Resource Hash `c614122e326d88fffd8495fc3ccbac314634f3c36ea1f003cd222288bf67686b` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.polymedicure.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/css,/;q=0.1 Referer https://www.polymedicure.com/cgi/DocuSign/DocuSign/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto= Connection keep-alive Cache-Control no-cache Referer https://www.polymedicure.com/cgi/DocuSign/DocuSign/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Mon, 20 Aug 2018 22:24:58 GMT Last-Modified Tue, 07 Nov 2017 08:43:36 GMT Server Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 mod_qos/11.5 ETag "1180a0f-490-55d609116fe00" Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 1168
GET H/1.1	200 OK	jquery-1.6.2.min.js Show response www.polymedicure.com/cgi/DocuSign/DocuSign/javascript/	89 KB 90 KB	154ms 152ms	Script application/javascript	103.11.84.216 CYBERSPACE-IN NIL...
General Check archive.org Show headers Download Go to Full URL https://www.polymedicure.com/cgi/DocuSign/DocuSign/javascript/jquery-1.6.2.min.js Requested by Host: www.polymedicure.com URL: https://www.polymedicure.com/cgi/DocuSign/DocuSign/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto= Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 103.11.84.216 Nagar, India, ASN132052 (CYBERSPACE-IN NIL-36C, Malviya Nagar, IN), Reverse DNS s216.cyberspace.in Software Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 mod_qos/11.5 / Resource Hash `80f4f0fef93d99ae6a0ef3f6a583f6eba8d73655ad5a7c2b9febe4aae1eeead6` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.polymedicure.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept / Referer https://www.polymedicure.com/cgi/DocuSign/DocuSign/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto= Connection keep-alive Cache-Control no-cache Referer https://www.polymedicure.com/cgi/DocuSign/DocuSign/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Mon, 20 Aug 2018 22:24:58 GMT Last-Modified Tue, 07 Nov 2017 08:43:38 GMT Server Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 mod_qos/11.5 ETag "1180c38-165a4-55d6091358280" Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 91556
GET H/1.1	200 OK	facebox.js Show response www.polymedicure.com/cgi/DocuSign/DocuSign/javascript/facebox/src/	9 KB 10 KB	248ms 154ms	Script application/javascript	103.11.84.216 CYBERSPACE-IN NIL...
General Check archive.org Show headers Download Go to Full URL https://www.polymedicure.com/cgi/DocuSign/DocuSign/javascript/facebox/src/facebox.js Requested by Host: www.polymedicure.com URL: https://www.polymedicure.com/cgi/DocuSign/DocuSign/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto= Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 103.11.84.216 Nagar, India, ASN132052 (CYBERSPACE-IN NIL-36C, Malviya Nagar, IN), Reverse DNS s216.cyberspace.in Software Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 mod_qos/11.5 / Resource Hash `fc1051ff8ece6493b643873b420df97c3cb5037337891450cad3051a9bba1754` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.polymedicure.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept / Referer https://www.polymedicure.com/cgi/DocuSign/DocuSign/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto= Connection keep-alive Cache-Control no-cache Referer https://www.polymedicure.com/cgi/DocuSign/DocuSign/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Mon, 20 Aug 2018 22:24:59 GMT Last-Modified Tue, 07 Nov 2017 08:43:38 GMT Server Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 mod_qos/11.5 ETag "1180c18-253c-55d6091358280" Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 9532
GET H/1.1	200 OK	jquery.watermark.js Show response www.polymedicure.com/cgi/DocuSign/DocuSign/javascript/watermark/	19 KB 19 KB	309ms 154ms	Script application/javascript	103.11.84.216 CYBERSPACE-IN NIL...
General Check archive.org Show headers Download Go to Full URL https://www.polymedicure.com/cgi/DocuSign/DocuSign/javascript/watermark/jquery.watermark.js Requested by Host: www.polymedicure.com URL: https://www.polymedicure.com/cgi/DocuSign/DocuSign/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto= Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 103.11.84.216 Nagar, India, ASN132052 (CYBERSPACE-IN NIL-36C, Malviya Nagar, IN), Reverse DNS s216.cyberspace.in Software Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 mod_qos/11.5 / Resource Hash `016f9cfa001792db7ad2be1e1ea1424cea09f108f68e7efb1caf4c5e65ac1335` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.polymedicure.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept / Referer https://www.polymedicure.com/cgi/DocuSign/DocuSign/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto= Connection keep-alive Cache-Control no-cache Referer https://www.polymedicure.com/cgi/DocuSign/DocuSign/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Mon, 20 Aug 2018 22:24:59 GMT Last-Modified Tue, 07 Nov 2017 08:43:38 GMT Server Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 mod_qos/11.5 ETag "1180c4e-4b1d-55d6091358280" Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 19229
GET H/1.1	200 OK	javascript1.js Show response www.polymedicure.com/cgi/DocuSign/DocuSign/	3 KB 3 KB	401ms 151ms	Script application/javascript	103.11.84.216 CYBERSPACE-IN NIL...
General Check archive.org Show headers Download Go to Full URL https://www.polymedicure.com/cgi/DocuSign/DocuSign/javascript1.js Requested by Host: www.polymedicure.com URL: https://www.polymedicure.com/cgi/DocuSign/DocuSign/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto= Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 103.11.84.216 Nagar, India, ASN132052 (CYBERSPACE-IN NIL-36C, Malviya Nagar, IN), Reverse DNS s216.cyberspace.in Software Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 mod_qos/11.5 / Resource Hash `9d57619bd1338db2ee3a7fb1dd7774b4e76e49113b21a07be33d70818433d869` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.polymedicure.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept / Referer https://www.polymedicure.com/cgi/DocuSign/DocuSign/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto= Connection keep-alive Cache-Control no-cache Referer https://www.polymedicure.com/cgi/DocuSign/DocuSign/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Mon, 20 Aug 2018 22:24:59 GMT Last-Modified Tue, 07 Nov 2017 08:43:36 GMT Server Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 mod_qos/11.5 ETag "1180c5e-be5-55d609116fe00" Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 3045
GET H/1.1	200 OK	hl.jpg www.polymedicure.com/cgi/DocuSign/DocuSign/img/	27 KB 27 KB	154ms 154ms	Image image/jpeg	103.11.84.216 CYBERSPACE-IN NIL...
General Check archive.org Show headers Download Go to Show image Full URL https://www.polymedicure.com/cgi/DocuSign/DocuSign/img/hl.jpg Requested by Host: www.polymedicure.com URL: https://www.polymedicure.com/cgi/DocuSign/DocuSign/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto= Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 103.11.84.216 Nagar, India, ASN132052 (CYBERSPACE-IN NIL-36C, Malviya Nagar, IN), Reverse DNS s216.cyberspace.in Software Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 mod_qos/11.5 / Resource Hash `37c69dd0cf49f80d3b13d52c3cc4a2d5d80def209135b42397699d2b7594207c` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.polymedicure.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* https://www.polymedicure.com/cgi/DocuSign/DocuSign/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto= Connection keep-alive Cache-Control no-cache Referer https://www.polymedicure.com/cgi/DocuSign/DocuSign/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Mon, 20 Aug 2018 22:24:59 GMT Last-Modified Tue, 07 Nov 2017 08:43:38 GMT Server Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 mod_qos/11.5 ETag "1180a1f-6bf1-55d6091358280" Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=96 Content-Length 27633
GET H/1.1	200 OK	static-logo.jpg www.polymedicure.com/cgi/DocuSign/DocuSign/img/	27 KB 27 KB	147ms 146ms	Image image/jpeg	103.11.84.216 CYBERSPACE-IN NIL...
General Check archive.org Show headers Download Go to Show image Full URL https://www.polymedicure.com/cgi/DocuSign/DocuSign/img/static-logo.jpg Requested by Host: www.polymedicure.com URL: https://www.polymedicure.com/cgi/DocuSign/DocuSign/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto= Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 103.11.84.216 Nagar, India, ASN132052 (CYBERSPACE-IN NIL-36C, Malviya Nagar, IN), Reverse DNS s216.cyberspace.in Software Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 mod_qos/11.5 / Resource Hash `fd9249bcb8bf277f4db71cbc03a12f1b39b4da133e4661e3a72be3baf5303623` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.polymedicure.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* https://www.polymedicure.com/cgi/DocuSign/DocuSign/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto= Connection keep-alive Cache-Control no-cache Referer https://www.polymedicure.com/cgi/DocuSign/DocuSign/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Mon, 20 Aug 2018 22:24:59 GMT Last-Modified Tue, 07 Nov 2017 08:43:38 GMT Server Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 mod_qos/11.5 ETag "1180a32-6a6b-55d6091358280" Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 27243

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DocuSign (Online) DHL (Transportation)

23 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery object| jQuery16206440677320436674 function| script function| click_to_download function| make_the_delay function| redirect_the function| now_download function| updateclock function| WorldClock number| zone boolean| isitlocal string| ampm object| now number| ofst number| secs number| sec number| mins number| min number| hr number| hrs string| statusampm number| hr2

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.polymedicure.com
103.11.84.216
016f9cfa001792db7ad2be1e1ea1424cea09f108f68e7efb1caf4c5e65ac1335
37c69dd0cf49f80d3b13d52c3cc4a2d5d80def209135b42397699d2b7594207c
5e26cca4db1293367b57b261d69d6252174214950820cf6431775fb116b6e114
80f4f0fef93d99ae6a0ef3f6a583f6eba8d73655ad5a7c2b9febe4aae1eeead6
84a75ad61d0404ae29810295acffc370e195b64227a5445c30613ea316bdafdc
90931f890c362a6624f5f79c4dddaa8f891c57ff30582b15ae78b88f1feef89b
9d57619bd1338db2ee3a7fb1dd7774b4e76e49113b21a07be33d70818433d869
c614122e326d88fffd8495fc3ccbac314634f3c36ea1f003cd222288bf67686b
fc1051ff8ece6493b643873b420df97c3cb5037337891450cad3051a9bba1754
fd9249bcb8bf277f4db71cbc03a12f1b39b4da133e4661e3a72be3baf5303623