urlscan.io logo urlscan.io
SecurityTrails logo

deck-shared-2023.us-ord-1.linodeobjects.com Open in urlscan Pro
2600:3c06::f03c:93ff:fe54:27c8  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://trk.klclick3.com/ls/click?upn=Vtrs3xURK-2Bc2pVdHID18VOefqn-2B-2FNO0xs8DuV2pVuh0EILZQF9WyCqB7SqFJRcRMwt-2FM387izgb...
Effective URL: https://deck-shared-2023.us-ord-1.linodeobjects.com/DecGrace.html
Submission: On December 07 via manual from GB — Scanned from GB
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 3 HTTP transactions. The main IP is 2600:3c06::f03c:93ff:fe54:27c8, located in Chicago, United States and belongs to AKAMAI-LINODE-AP Akamai Connected Cloud, SG. The main domain is deck-shared-2023.us-ord-1.linodeobjects.com.
TLS certificate: Issued by R3 on October 2nd 2023. Valid for: 3 months.
This is the only time deck-shared-2023.us-ord-1.linodeobjects.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 1 2600:9000:225... 16509 (AMAZON-02)
1 2 103.253.43.4 133398 (TELE-AS T...)
1 2600:3c06::f0... 63949 (AKAMAI-LI...)
1 212.70.149.197 204428 (SS-NET)
3 4
Apex Domain
Subdomains		 Transfer
2 sensualite.art.br
docapicvr.sensualite.art.br
751 B
1 officialcountdown9.com
ruthowlevtui.officialcountdown9.com
131 KB
1 linodeobjects.com
deck-shared-2023.us-ord-1.linodeobjects.com
166 KB
1 klclick3.com
trk.klclick3.com — Cisco Umbrella Rank: 24271
444 B
3 4
Domain Requested by
2 docapicvr.sensualite.art.br 1 redirects
1 ruthowlevtui.officialcountdown9.com deck-shared-2023.us-ord-1.linodeobjects.com
1 deck-shared-2023.us-ord-1.linodeobjects.com
1 trk.klclick3.com 1 redirects
3 4

This site contains no links.

Subject Issuer Validity Valid
docapicvr.sensualite.art.br
R3		 2023-12-07 -
2024-03-06		 3 months crt.sh
us-ord-1.linodeobjects.com
R3		 2023-10-02 -
2023-12-31		 3 months crt.sh
officialcountdown9.com
R3		 2023-12-06 -
2024-03-05		 3 months crt.sh

This page contains 2 frames:

Primary Page: https://deck-shared-2023.us-ord-1.linodeobjects.com/DecGrace.html
Frame ID: 8A10C359324430502669EB9780E14270
Requests: 2 HTTP requests in this frame

Frame: https://ruthowlevtui.officialcountdown9.com/?8Y6v=ojK
Frame ID: 0B826C2CE06326666A293108467F8A4B
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://trk.klclick3.com/ls/click?upn=Vtrs3xURK-2Bc2pVdHID18VOefqn-2B-2FNO0xs8DuV2pVuh0EILZQF9WyCqB7S... HTTP 302
    https://docapicvr.sensualite.art.br/privacy-policy-2-utm_source=Herefish&utm_medium=email&utm_campaign=client_em... Page URL
  2. https://docapicvr.sensualite.art.br/index.php?continue2 HTTP 302
    https://deck-shared-2023.us-ord-1.linodeobjects.com/DecGrace.html Page URL

Page Statistics

3
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

298 kB
Transfer

531 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://trk.klclick3.com/ls/click?upn=Vtrs3xURK-2Bc2pVdHID18VOefqn-2B-2FNO0xs8DuV2pVuh0EILZQF9WyCqB7SqFJRcRMwt-2FM387izgbmcWbWJXiryTgrwsP985-2F-2F0O8NbiQTaFllBe0NvdU1ne2w-2BiMp0pVcToxhDchAJiK-2FteHb-2FO4EDso9VZH2GmAx4BmvZbj9lK-2FF5-2BIEyi-2BM7rAjEXihfCMcOGWkQvT1pvEuXMcPrznK2eprP-2FQJprCTRJ4A2m88uFFJ-2FqOdli-2BBeX-2BcW8wIvfoq7vnvJGJmsA-2BZHO2P2iWE98wOr0CG2bYA8VYypRJgrofOTxBDIrlHurIHUDkHwfoX4Egnv8GiqXDajmoKRYMA7GTPNv2TqSKBbe4LRLePusg-3D6ifE_-2FtrkJYtssUveXERYVbGgKpodoStjimyExhfM3ejAfzuVlFsd2sMyrjZ3RyQMoa-2BVsLNT-2FwykvHuxKNblO8W3QXhEcU6bTMhnhe-2FN5kt-2BbG-2FS-2B3LA7uES-2Bhss5TJ3ATeaUCWjMcAHbm47KoyA8sZ8-2FYDYOacWo2jpwbmIGFzMqesbu3LJq5CX74qzEEp8sY-2BljrKwPDZ4aCZa2k4xwADNGof-2FMU-2FE5O-2FF6BsXFMO0QY-2BGHKItrLp6Q8QI1DzJlRaBDt6b6q6iX5sZ2iagbnuq6DT-2BNIvHzYeGG6478OXcdHlwP8KhcutuodLFvJ3LVKV2VrRs5XUbRzSPCwOV5q2fiFyX-2FN5-2F8MhJRM4VAKp7-2Fcr3Y-2Bfsc4KHpmoqGU6vA6fw7R7H2A-2B-2BNzZpS532XNOoGPMKspp7BhhxZGkr89MR29Jo0KyW6A8yXyjYHPMuTx5oxDUHYHuulDaYcK9WX6w9xg-3D-3D HTTP 302
    https://docapicvr.sensualite.art.br/privacy-policy-2-utm_source=Herefish&utm_medium=email&utm_campaign=client_email&hf=68610841&utm_campaign=website&utm_medium=shared_with_me?_kx=sbKHk0ytyVYuK9F1mbg1TV31tG-1xcPhEYpUGotKvMfUvHQ93dGHSQyXBYrr1aH7.RPSYU6 Page URL
  2. https://docapicvr.sensualite.art.br/index.php?continue2 HTTP 302
    https://deck-shared-2023.us-ord-1.linodeobjects.com/DecGrace.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://trk.klclick3.com/ls/click?upn=Vtrs3xURK-2Bc2pVdHID18VOefqn-2B-2FNO0xs8DuV2pVuh0EILZQF9WyCqB7SqFJRcRMwt-2FM387izgbmcWbWJXiryTgrwsP985-2F-2F0O8NbiQTaFllBe0NvdU1ne2w-2BiMp0pVcToxhDchAJiK-2FteHb-2FO4EDso9VZH2GmAx4BmvZbj9lK-2FF5-2BIEyi-2BM7rAjEXihfCMcOGWkQvT1pvEuXMcPrznK2eprP-2FQJprCTRJ4A2m88uFFJ-2FqOdli-2BBeX-2BcW8wIvfoq7vnvJGJmsA-2BZHO2P2iWE98wOr0CG2bYA8VYypRJgrofOTxBDIrlHurIHUDkHwfoX4Egnv8GiqXDajmoKRYMA7GTPNv2TqSKBbe4LRLePusg-3D6ifE_-2FtrkJYtssUveXERYVbGgKpodoStjimyExhfM3ejAfzuVlFsd2sMyrjZ3RyQMoa-2BVsLNT-2FwykvHuxKNblO8W3QXhEcU6bTMhnhe-2FN5kt-2BbG-2FS-2B3LA7uES-2Bhss5TJ3ATeaUCWjMcAHbm47KoyA8sZ8-2FYDYOacWo2jpwbmIGFzMqesbu3LJq5CX74qzEEp8sY-2BljrKwPDZ4aCZa2k4xwADNGof-2FMU-2FE5O-2FF6BsXFMO0QY-2BGHKItrLp6Q8QI1DzJlRaBDt6b6q6iX5sZ2iagbnuq6DT-2BNIvHzYeGG6478OXcdHlwP8KhcutuodLFvJ3LVKV2VrRs5XUbRzSPCwOV5q2fiFyX-2FN5-2F8MhJRM4VAKp7-2Fcr3Y-2Bfsc4KHpmoqGU6vA6fw7R7H2A-2B-2BNzZpS532XNOoGPMKspp7BhhxZGkr89MR29Jo0KyW6A8yXyjYHPMuTx5oxDUHYHuulDaYcK9WX6w9xg-3D-3D HTTP 302
  • https://docapicvr.sensualite.art.br/privacy-policy-2-utm_source=Herefish&utm_medium=email&utm_campaign=client_email&hf=68610841&utm_campaign=website&utm_medium=shared_with_me?_kx=sbKHk0ytyVYuK9F1mbg1TV31tG-1xcPhEYpUGotKvMfUvHQ93dGHSQyXBYrr1aH7.RPSYU6

3 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
privacy-policy-2-utm_source=Herefish&utm_medium=email&utm_campaign=client_email&hf=68610841&utm_campaign=website&utm_medium=shared_with_me
docapicvr.sensualite.art.br/
Redirect Chain
  • https://trk.klclick3.com/ls/click?upn=Vtrs3xURK-2Bc2pVdHID18VOefqn-2B-2FNO0xs8DuV2pVuh0EILZQF9WyCqB7SqFJRcRMwt-2FM387izgbmcWbWJXiryTgrwsP985-2F-2F0O8NbiQTaFllBe0NvdU1ne2w-2BiMp0pVcToxhDchAJiK-2FteH...
  • https://docapicvr.sensualite.art.br/privacy-policy-2-utm_source=Herefish&utm_medium=email&utm_campaign=client_email&hf=68610841&utm_campaign=website&utm_medium=shared_with_me?_kx=sbKHk0ytyVYuK9F1mb...
1 KB
678 B 		Document
General
Check archive.org
Download Go to
Full URL
https://docapicvr.sensualite.art.br/privacy-policy-2-utm_source=Herefish&utm_medium=email&utm_campaign=client_email&hf=68610841&utm_campaign=website&utm_medium=shared_with_me?_kx=sbKHk0ytyVYuK9F1mbg1TV31tG-1xcPhEYpUGotKvMfUvHQ93dGHSQyXBYrr1aH7.RPSYU6
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.253.43.4 , Hong Kong, ASN133398 (TELE-AS Tele Asia Limited, HK),
Reverse DNS
slot9.ge-re.com
Software
Apache /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

content-encoding
gzip
content-length
581
content-type
text/html; charset=UTF-8
date
Thu, 07 Dec 2023 17:54:13 GMT
server
Apache
vary
Accept-Encoding

Redirect headers

content-length
293
content-type
text/html; charset=utf-8
date
Thu, 07 Dec 2023 17:54:12 GMT
location
https://docapicvr.sensualite.art.br/privacy-policy-2-utm_source=Herefish&utm_medium=email&utm_campaign=client_email&hf=68610841&utm_campaign=website&utm_medium=shared_with_me?_kx=sbKHk0ytyVYuK9F1mbg1TV31tG-1xcPhEYpUGotKvMfUvHQ93dGHSQyXBYrr1aH7.RPSYU6
server
nginx
via
1.1 0a71d283a25c1e3f082b4dbc9d844dfe.cloudfront.net (CloudFront)
x-amz-cf-id
hJ95xlVH61Dmogge5t9zA2Uhn4RSIX5bZypdVJX3i2mmz_MjO92oyg==
x-amz-cf-pop
FRA60-P3
x-cache
Miss from cloudfront
x-robots-tag
noindex, nofollow
Primary Request DecGrace.html
deck-shared-2023.us-ord-1.linodeobjects.com/
Redirect Chain
  • https://docapicvr.sensualite.art.br/index.php?continue2
  • https://deck-shared-2023.us-ord-1.linodeobjects.com/DecGrace.html
166 KB
166 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://deck-shared-2023.us-ord-1.linodeobjects.com/DecGrace.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2600:3c06::f03c:93ff:fe54:27c8 Chicago, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS
Software
/
Resource Hash
4ded796f8719ca509cebe2f051ccef7ea35cd0b50efd4f7a90840696909768b4

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://docapicvr.sensualite.art.br
Referer
https://docapicvr.sensualite.art.br/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Length
170036
Content-Type
text/html
Date
Thu, 07 Dec 2023 17:54:14 GMT
ETag
"e2d6610a57b4d64a69ed28273355cd16"
Last-Modified
Wed, 06 Dec 2023 16:09:01 GMT
x-amz-request-id
tx00000497fd79aaa49b425-00657206c6-772747-default
x-rgw-object-type
Normal

Redirect headers

content-encoding
gzip
content-length
581
content-type
text/html; charset=UTF-8
date
Thu, 07 Dec 2023 17:54:13 GMT
location
https://deck-shared-2023.us-ord-1.linodeobjects.com/DecGrace.html
server
Apache
vary
Accept-Encoding
/
ruthowlevtui.officialcountdown9.com/ Frame 0B82 		324 KB
131 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ruthowlevtui.officialcountdown9.com/?8Y6v=ojK
Requested by
Host: deck-shared-2023.us-ord-1.linodeobjects.com
URL: https://deck-shared-2023.us-ord-1.linodeobjects.com/DecGrace.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
212.70.149.197 Dimitrovgrad, Bulgaria, ASN204428 (SS-NET, BG),
Reverse DNS
Software
nginx /
Resource Hash
66e5bd387bf188dc46660135fdb599b0235b0263318baca6c76d227a6db5a10f

Request headers

Referer
https://deck-shared-2023.us-ord-1.linodeobjects.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

content-encoding
gzip
content-type
text/html; charset=utf-8
date
Thu, 07 Dec 2023 17:54:15 GMT
server
nginx
vary
Accept-Encoding
truncated
/ Frame 0B82 		858 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
19b8ee66ab60c45d5d24988d090b61c938b44c2ee9a5f8558335b27a2f315072

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/ Frame 0B82 		40 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
64c2019b369b4f3b45009d1740f4c7ae0856bb2608aea7d7628b78f43cecb3fa

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| documentPictureInPicture function| a0_0x375d function| a0_0xe541

0 Cookies