lnksforyou.com
Open in
urlscan Pro
172.67.135.63
Malicious Activity!
Public Scan
Submission Tags: 7389794
Submission: On December 19 via api from US — Scanned from DE
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on December 1st 2021. Valid for: a year.
This is the only time lnksforyou.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Netflix (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 172.67.135.63 172.67.135.63 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
5 | 2a00:1450:400... 2a00:1450:4001:80f::2010 | 15169 (GOOGLE) (GOOGLE) | |
2 | 2606:4700:303... 2606:4700:3031::ac43:d645 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 | 172.67.182.9 172.67.182.9 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 151.101.194.137 151.101.194.137 | 54113 (FASTLY) (FASTLY) | |
1 | 162.247.243.146 162.247.243.146 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
13 | 6 |
ASN15169 (GOOGLE, US)
storage.googleapis.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
googleapis.com
storage.googleapis.com |
116 KB |
3 |
zcontentlockerws6tm3.xyz
zcontentlockerws6tm3.xyz |
131 KB |
2 |
fontawesome.com
use.fontawesome.com |
83 KB |
1 |
nr-data.net
bam-cell.nr-data.net |
725 B |
1 |
newrelic.com
js-agent.newrelic.com |
13 KB |
1 |
lnksforyou.com
lnksforyou.com |
9 KB |
13 | 6 |
Domain | Requested by | |
---|---|---|
5 | storage.googleapis.com |
lnksforyou.com
|
3 | zcontentlockerws6tm3.xyz |
lnksforyou.com
|
2 | use.fontawesome.com |
lnksforyou.com
use.fontawesome.com |
1 | bam-cell.nr-data.net |
js-agent.newrelic.com
|
1 | js-agent.newrelic.com |
lnksforyou.com
|
1 | lnksforyou.com | |
13 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-12-01 - 2022-11-30 |
a year | crt.sh |
*.storage.googleapis.com GTS CA 1C3 |
2021-11-29 - 2022-02-21 |
3 months | crt.sh |
js-agent.newrelic.com GlobalSign Atlas R3 DV TLS CA H2 2021 |
2021-10-06 - 2022-11-07 |
a year | crt.sh |
*.nr-data.net DigiCert SHA2 Secure Server CA |
2020-02-05 - 2022-02-08 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://lnksforyou.com/97H0
Frame ID: 504B12821F2A74E958D03B8513A7EEC9
Requests: 13 HTTP requests in this frame
Screenshot
Page Title
net-flix acc-ountsDetected technologies
Font Awesome (Font Scripts) ExpandDetected patterns
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Google Font API (Font Scripts) Expand
Detected patterns
- googleapis\.com/.+webfont
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
13 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
97H0
lnksforyou.com/ |
42 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
storage.googleapis.com/appspot-cdn/assets/tmpl-17/ |
9 KB 9 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.css
use.fontawesome.com/releases/v5.4.2/css/ |
49 KB 12 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
28351
zcontentlockerws6tm3.xyz/images/pages/ |
17 KB 18 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
storage.googleapis.com/appspot-cdn/assets/tmpl-17/ |
85 KB 85 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
typed.js
storage.googleapis.com/appspot-cdn/assets/tmpl-17/ |
11 KB 11 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.animatenumber.js
storage.googleapis.com/appspot-cdn/assets/tmpl-17/ |
1 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.js
storage.googleapis.com/appspot-cdn/assets/tmpl-17/ |
9 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gateway_v5.php
zcontentlockerws6tm3.xyz/ |
13 KB 4 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
28350
zcontentlockerws6tm3.xyz/images/pages/ |
109 KB 109 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
fa-solid-900.woff2
use.fontawesome.com/releases/v5.4.2/webfonts/ |
70 KB 71 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
nr-1212.min.js
js-agent.newrelic.com/ |
34 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
62915533ca
bam-cell.nr-data.net/1/ |
49 B 725 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Netflix (Online)36 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| NREUM object| newrelic function| __nr_require function| $ function| jQuery function| Typed function| animateConsole function| getToken function| deleteFirst function| handleClick object| click function| usersOnline boolean| _locker_loaded boolean| _locker_unlocked object| locker_options object| html_doc object| locker_transaction_id object| _locker_base64 function| _locker_inject_jq function| do_ie_replaces9 function| do_ie_replaces function| _locker_fix_layers function| _locker_maintain_width function| _locker_load function| _receive_message undefined| ゚ω゚ノ number| _ number| ゚ー゚ number| o number| ゚Θ゚ number| c object| ゚Д゚ string| ゚o゚ string| ゚ε゚ string| o゚ー゚o3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
lnksforyou.com/ | Name: PHPSESSID Value: 4Dy8RN8CLGj6cvVS89VmELWVSOeFricX2iQUzTlvq8COybM_RpW_XZtRfQs2ycQc |
|
lnksforyou.com/ | Name: SERVERID Value: web4 |
|
.nr-data.net/ | Name: JSESSIONID Value: e0e8311edb77c5fc |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bam-cell.nr-data.net
js-agent.newrelic.com
lnksforyou.com
storage.googleapis.com
use.fontawesome.com
zcontentlockerws6tm3.xyz
151.101.194.137
162.247.243.146
172.67.135.63
172.67.182.9
2606:4700:3031::ac43:d645
2a00:1450:4001:80f::2010
11d3a220cc1f89742cb21b4deb13c20861b2a0b4b62dc957c503bb3d41bc0aa5
1ef89f8b032f15b11f642742f6200d5dabeba03d876944ed392029c9dd8fe12f
218bc2b47bb718e6c65206f46f0c9791edcfdf5ccff6e6abcecb7637be7cf33b
2bb237ab2464f0c66d17f211c9ab4129b5b0704839605c6330395529b2affe4c
2f002d8663b3700dff6ec567da54075c4d55d075feca5cab6c18b232f27ecaf9
62c1c19a511900e719f691b40a67e383540a685727ba6fd3a79d18354a0fd9b1
86e8a08748806959794df2465e449b3b3da2baf7e9727941ba21dc57e6e86fdb
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
ac1a655367b02648fe8217ee11d1b272786605b78989ff614cb0beab5f6f547c
b98e52bb36c65910eab43d3e94c88276db469c77d6fda8b31ef7cef90510eaf8
d3db3a07cd01a325326de52822be97f34e9977ea6d2d3b90ae318f87c3daf374
dac715f087720dd7ff7067f5d2ec1988851fa93140ae8a9cbfaa15659dd7fd82
e8fd6832e13fca9622a46af5fddb394c358ef083d84002896aca34613d77780e