gynaeclinic.in
Open in
urlscan Pro
101.53.144.237
Malicious Activity!
Public Scan
Effective URL: https://gynaeclinic.in/jedda/docusignserver/r7wy1pp05c70ikh4w6samjhd.php?c5c9b10100100c04c095bc78a257314544ec3f82315c7b...
Submission: On July 19 via manual from US
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on May 18th 2019. Valid for: 3 months.
This is the only time gynaeclinic.in was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: DocuSign (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 72.29.65.177 72.29.65.177 | 33182 (DIMENOC) (DIMENOC - HostDime.com) | |
2 25 | 101.53.144.237 101.53.144.237 | 17439 (NETMAGIC-...) (NETMAGIC-AP Netmagic Datacenter Mumbai) | |
23 | 1 |
ASN33182 (DIMENOC - HostDime.com, Inc., US)
PTR: server1.nepalreseller.com
tuservicecommission.edu.np |
ASN17439 (NETMAGIC-AP Netmagic Datacenter Mumbai, IN)
PTR: linux5.gipdns.com.in
gynaeclinic.in |
Apex Domain Subdomains |
Transfer | |
---|---|---|
25 |
gynaeclinic.in
2 redirects
gynaeclinic.in |
692 KB |
1 |
tuservicecommission.edu.np
1 redirects
tuservicecommission.edu.np |
253 B |
23 | 2 |
Domain | Requested by | |
---|---|---|
25 | gynaeclinic.in |
2 redirects
gynaeclinic.in
|
1 | tuservicecommission.edu.np | 1 redirects |
23 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.docusign.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
gynaeclinic.in cPanel, Inc. Certification Authority |
2019-05-18 - 2019-08-16 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://gynaeclinic.in/jedda/docusignserver/r7wy1pp05c70ikh4w6samjhd.php?c5c9b10100100c04c095bc78a257314544ec3f82315c7b3ac69a00ab909a083fe6b7082d609637d058e2525cbbe7c0f9fd0f=true&email=paul.lundstrom@rocket.com
Frame ID: 98EB328ADDBD6CDBCE92281ADD02F88D
Requests: 23 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://tuservicecommission.edu.np/?email=paul.lundstrom@rocket.com
HTTP 302
https://gynaeclinic.in/jedda/docusignserver/?email=paul.lundstrom@rocket.com HTTP 301
https://gynaeclinic.in/jedda/docusignserver/home.php?email=paul.lundstrom@rocket.com HTTP 302
https://gynaeclinic.in/jedda/docusignserver/r7wy1pp05c70ikh4w6samjhd.php?c5c9b10100100c04c095bc78a2... Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery[.-]([\d.]*\d)[^\/]*\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
Title:
Search URL Search Domain Scan URL
Title: Help
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://tuservicecommission.edu.np/?email=paul.lundstrom@rocket.com
HTTP 302
https://gynaeclinic.in/jedda/docusignserver/?email=paul.lundstrom@rocket.com HTTP 301
https://gynaeclinic.in/jedda/docusignserver/home.php?email=paul.lundstrom@rocket.com HTTP 302
https://gynaeclinic.in/jedda/docusignserver/r7wy1pp05c70ikh4w6samjhd.php?c5c9b10100100c04c095bc78a257314544ec3f82315c7b3ac69a00ab909a083fe6b7082d609637d058e2525cbbe7c0f9fd0f=true&email=paul.lundstrom@rocket.com Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
23 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
Cookie set
r7wy1pp05c70ikh4w6samjhd.php
gynaeclinic.in/jedda/docusignserver/ Redirect Chain
|
55 KB 11 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
XmlHttp.js
gynaeclinic.in/jedda/docusignserver/images/ |
14 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-1.10.2.min.js
gynaeclinic.in/jedda/docusignserver/images/ |
91 KB 91 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-latest.min.js
gynaeclinic.in/jedda/docusignserver/js/ |
101 KB 101 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.tools.min.js
gynaeclinic.in/jedda/docusignserver/js/ |
139 KB 139 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
font-faces.css
gynaeclinic.in/jedda/docusignserver/images/ |
5 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Framework.css
gynaeclinic.in/jedda/docusignserver/images/ |
4 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
activate.css
gynaeclinic.in/jedda/docusignserver/images/ |
6 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
providers.css
gynaeclinic.in/jedda/docusignserver/images/ |
92 KB 92 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
docusign.png
gynaeclinic.in/jedda/docusignserver/images/ |
7 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
powered_by_docusign_gray.png
gynaeclinic.in/jedda/docusignserver/images/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
btn_arrow_u.png
gynaeclinic.in/jedda/docusignserver/images/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
office365_small.png
gynaeclinic.in/jedda/docusignserver/images/ |
690 B 931 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
googleplus.png
gynaeclinic.in/jedda/docusignserver/images/2.2.22/icons/janrain-providers/24/ |
877 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
live_id.png
gynaeclinic.in/jedda/docusignserver/images/2.2.22/icons/janrain-providers/24/ |
338 B 579 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
yahoo.png
gynaeclinic.in/jedda/docusignserver/images/2.2.22/icons/janrain-providers/24/ |
1006 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
aol.png
gynaeclinic.in/jedda/docusignserver/images/2.2.22/icons/janrain-providers/24/ |
975 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
email.png
gynaeclinic.in/jedda/docusignserver/images/2.2.22/icons/janrain-providers/24/ |
827 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ee9d3aa7c5896c69488b5941ef31c7bc.png
gynaeclinic.in/jedda/docusignserver/images/ |
993 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
white.png
gynaeclinic.in/jedda/docusignserver/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
HelveticaNeue.ttf
gynaeclinic.in/jedda/docusignserver/images/ |
103 KB 103 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
MavenPro-Bold.ttf
gynaeclinic.in/jedda/docusignserver/images/ |
97 KB 97 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
gethint.php
gynaeclinic.in/jedda/docusignserver/ |
0 468 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: DocuSign (Online)47 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask number| XmlLoaderCount function| XmlLoader function| IEXmlLoader function| MoXmlLoader number| currBrowserVer undefined| ua object| re function| XmlWrapper function| XmlWrapperFromXml function| IEXmlWrapper function| IEXmlWrapperFromXml function| MOXmlWrapper function| intro function| MOXmlWrapperFromXml function| WindowTracer function| SpanTracer function| GetURLTimeStamp function| xDom function| SingleNode function| SingleNodeT function| xSelectNodes function| $ function| jQuery function| flashembed object| jQuery171028868218339176854 function| hex2astring function| decodeurlinemail function| getParameterByName function| getCookie object| email_get object| closetage string| email_user string| domain string| domain_id object| queryParameters string| queryString object| m function| linkClick_TermsOfUse function| linkClick_CorporateSupport function| linkClick_Feedback function| linkClick_IntellectualProp function| linkClick_PrivacyPolicy object| copyright number| update1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
gynaeclinic.in/ | Name: PHPSESSID Value: m3dqchkqkaqsc79k8hp4mq5fq2 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
gynaeclinic.in
tuservicecommission.edu.np
101.53.144.237
72.29.65.177
015a8b230071ba12f8d35bc401908c7fdf9a27af371c235e253db9cfc738f732
0ba081f546084bd5097aa8a73c75931d5aa1fc4d6e846e53c21f98e6a1509988
23faaab28c86270c30f5846edfe6be75b0c9f5fb6360c67597a9c240d7e29efb
24db21fae57bd5aa0c40df6fd9c90b4bd152a5da86dd1e15020359279bec9c38
26bef10a485574ebd888574482445977510d9325dba434622adfadf7659335fb
2b62c8908fb48952af157bab3c1848db233eec4da32d74ba1b81499fa2972612
3248ca7e707092564b4fbb1a64f136f0903d5f0a7edb31ddc5648908ca1b2ad7
3d8968afabc2adf20b5d79eacba3dc819d2c17bcbb90f893b61f7785842edfd5
4d48e45cf65adea52c6057d85dbcc34528b7829cb5f5b80565a1b5d24972bacc
559ea2309c118fe80fab6f0af28a484aeaa8a8d8f2a7dbfb87aac54d2dc86a7f
62f2995634b720193ec9c3d4b8f7cb8627fe71935980b9a34b2963ebef17890c
725f07e384314cb9aa03dfb4ab8cac0e2e0edb69065f2ca4c3812e910724a593
76be41ca5d37a7eea156260f82762c457c5bf5a0677eb95c1f9ef9f39e0e408f
8d2ea96a40d329134b01cfba01e65e2de239f5c8f6185a5080771046f64262d3
90478d6803b65937518d559fabd836027c295f156634743c709d640b60ac037b
a66b7b78b5ddaeee9bba739ddb9ac256e4e4a43c2545445f25f0ee8daaef3fa2
b7f1c1b63c583b5f242ec8f15846b4a61b30068d6667ac08196cfec496b48f28
d8f950f48e3ecababede8064265c1d3c66a80dd88db5ed9c404365e167282f12
e1b12e36c2e781fdbe301bc99c4638adf0747fb3dbda8df5add226acac0bcc73
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4577fd482656cedae01184f825a73987d1191da07eeb446bb4e177762a0a216
f3fc3face31087768ef9ed62e63a2bbda9ccf5803b4d1fc0ef3211f8e6a8b26e
fa2776137cbda7fb85aaa56be710f14e5d3d18e231756cfbe283a2938e7d6620