urlscan.io logo urlscan.io
SecurityTrails logo

instantdelivery.us-ord-1.linodeobjects.com Open in urlscan Pro
2600:3c06::f03c:93ff:fe54:2fd2  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://trk.klclick3.com/ls/click?upn=Vtrs3xURK-2Bc2pVdHID18VKKbomEjEOcNsWZOBESTe-2FjnB-2FOlBwSr-2Bvm8KVYGZRqs4fOi8eNkM5P...
Effective URL: https://instantdelivery.us-ord-1.linodeobjects.com/Instdelivery.html
Submission: On December 12 via manual from GB — Scanned from GB
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 3 HTTP transactions. The main IP is 2600:3c06::f03c:93ff:fe54:2fd2, located in Chicago, United States and belongs to AKAMAI-LINODE-AP Akamai Connected Cloud, SG. The main domain is instantdelivery.us-ord-1.linodeobjects.com.
TLS certificate: Issued by R3 on December 11th 2023. Valid for: 3 months.
This is the only time instantdelivery.us-ord-1.linodeobjects.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 1 2600:9000:223... 16509 (AMAZON-02)
1 2 103.253.43.4 133398 (TELE-AS T...)
1 2600:3c06::f0... 63949 (AKAMAI-LI...)
1 212.70.149.197 12615 (GCN-AS GC...)
3 4
Apex Domain
Subdomains		 Transfer
2 bilalsmedicare.com
apiservi.bilalsmedicare.com
772 B
1 officialcountdown9.com
ruthowlevtui.officialcountdown9.com
131 KB
1 linodeobjects.com
instantdelivery.us-ord-1.linodeobjects.com
166 KB
1 klclick3.com
trk.klclick3.com — Cisco Umbrella Rank: 24271
592 B
3 4
Domain Requested by
2 apiservi.bilalsmedicare.com 1 redirects
1 ruthowlevtui.officialcountdown9.com instantdelivery.us-ord-1.linodeobjects.com
1 instantdelivery.us-ord-1.linodeobjects.com
1 trk.klclick3.com 1 redirects
3 4

This site contains no links.

Subject Issuer Validity Valid
*.apiservi.bilalsmedicare.com
R3		 2023-11-21 -
2024-02-19		 3 months crt.sh
us-ord-1.linodeobjects.com
R3		 2023-12-11 -
2024-03-10		 3 months crt.sh
officialcountdown9.com
R3		 2023-12-06 -
2024-03-05		 3 months crt.sh

This page contains 2 frames:

Primary Page: https://instantdelivery.us-ord-1.linodeobjects.com/Instdelivery.html
Frame ID: 2EFA38639BB0D6A16C42B3702D2B07B3
Requests: 2 HTTP requests in this frame

Frame: https://ruthowlevtui.officialcountdown9.com/?UmuT=JLJ6sa
Frame ID: B2392843D7099AA169F618D638FF12C0
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://trk.klclick3.com/ls/click?upn=Vtrs3xURK-2Bc2pVdHID18VKKbomEjEOcNsWZOBESTe-2FjnB-2FOlBwSr-2Bvm... HTTP 302
    https://apiservi.bilalsmedicare.com/tr/cl/CVHCLss3KYb9H1dtk3RQgpKgSx37AkrbuUyBOQpTlW-t8C19TXNwB_BkV_tfyYyh-us9Bb... Page URL
  2. https://apiservi.bilalsmedicare.com/index.php?continue2 HTTP 302
    https://instantdelivery.us-ord-1.linodeobjects.com/Instdelivery.html Page URL

Page Statistics

3
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

298 kB
Transfer

531 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://trk.klclick3.com/ls/click?upn=Vtrs3xURK-2Bc2pVdHID18VKKbomEjEOcNsWZOBESTe-2FjnB-2FOlBwSr-2Bvm8KVYGZRqs4fOi8eNkM5P0-2Bna5P5YERuZ6fAzSIaBwS8DebmpoHozV78Ev1VbXExe12E-2B1enmAP8ZUDpl2UTFUkv8ZJ-2BMDTZ-2F2wewtBlsd4eUgcmsXbPsmr49XObahgcvrNXr5kmrwL-2FhjgZk1NIICubQOxofx7vFTMVXiQbawhGQLoeEp-2FVjrDI9PlctocFiVQIRRhCw0mVewJG0fXIz10c01MQ1ONk-2BeYcFdMlY4zQ9XJ2nRoVvkXGeTFZug8vmC2KiYrWpePNTVf4-2BBWzWuv3FbjF0YxxTgJY2XevaTSyFSPiuq3iQSxyrf92CE7FgeqGzzSziy7GLFR9Ys41m0Qy1OJeicASHmNFAQ-2BZXcRSYayBDVmZzoJwcr9xSjtoop523p-2B5dLiXBbw-2BI-2BAx91RLj-2B6g6kWXiBX4dZ7VLpB5sIsP2fUmsNhtfMGxvJCY-2BRD8IRj8AOgXnlZOA-2B7Ov9DSL-2BQ8KJyz5pNrAJS-2FCamm4wJHhtWxlfWJoBH79yiAapZw-2Fa7HlOq7LW_-2FtrkJYtssUveXERYVbGgKpodoStjimyExhfM3ejAfzuVlFsd2sMyrjZ3RyQMoa-2BVsLNT-2FwykvHuxKNblO8W3QWQoCqwrbwiWsJjSeTiFhRAxR3pbmUH0Kc3X8jIrozMI4JsufamuW8BGQnteEeDGxnua3psVHcEYMheycP6-2FLt6IbX4l31tGoj1bS1D7Q-2BjveTvr-2FdOqCtql8yL4JBKFdHf5zKMeUbfuku1gMF4BuDc8-2Bw8DY0XHH-2FYS0Txxn-2B1xhkKGpY-2Fcg561qqFhDV1hoXNvGr1wDMMNLoTfrpC64NE-2FTne0UULKKErvS3GI4P1r-2FJckJOequKpxvTFLBOo88DR1-2FL0RYISJJKSlmQKn6o1RlWiTTOxt6RXYBRgEM2MQX8BTo7zhfoo9hYgAysrJBJbIREFChbpR2uvEwiXsGdnE855Aa31HiEKo-2Fh31qpuSpYv1kWi331qDDSQRxyZVew-3D-3D HTTP 302
    https://apiservi.bilalsmedicare.com/tr/cl/CVHCLss3KYb9H1dtk3RQgpKgSx37AkrbuUyBOQpTlW-t8C19TXNwB_BkV_tfyYyh-us9BbP1M038WkndZEobLMueqVySvSW7daMuOq_gn_QAIKiRBUSpy89YlfZwPEul8DFi5nUBqvFRQTITTF9Yd2hM7PR0COCI-p87XsFVa41ffLfN3lnUoYbjeSueWyvyJ8D09CBsn_6w96Dm6-omqg9eRF-8B3LID_0puG1WVmGPyKnamJF4aJdmrRrQJPP9GOrsid2YSkRK35C4L_fBIUf8MmGMkKhLcni4aYCyDtYLqg?_kx=sbKHk0ytyVYuK9F1mbg1TV31tG-1xcPhEYpUGotKvMfUvHQ93dGHSQyXBYrr1aH7.RPSYU6 Page URL
  2. https://apiservi.bilalsmedicare.com/index.php?continue2 HTTP 302
    https://instantdelivery.us-ord-1.linodeobjects.com/Instdelivery.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://trk.klclick3.com/ls/click?upn=Vtrs3xURK-2Bc2pVdHID18VKKbomEjEOcNsWZOBESTe-2FjnB-2FOlBwSr-2Bvm8KVYGZRqs4fOi8eNkM5P0-2Bna5P5YERuZ6fAzSIaBwS8DebmpoHozV78Ev1VbXExe12E-2B1enmAP8ZUDpl2UTFUkv8ZJ-2BMDTZ-2F2wewtBlsd4eUgcmsXbPsmr49XObahgcvrNXr5kmrwL-2FhjgZk1NIICubQOxofx7vFTMVXiQbawhGQLoeEp-2FVjrDI9PlctocFiVQIRRhCw0mVewJG0fXIz10c01MQ1ONk-2BeYcFdMlY4zQ9XJ2nRoVvkXGeTFZug8vmC2KiYrWpePNTVf4-2BBWzWuv3FbjF0YxxTgJY2XevaTSyFSPiuq3iQSxyrf92CE7FgeqGzzSziy7GLFR9Ys41m0Qy1OJeicASHmNFAQ-2BZXcRSYayBDVmZzoJwcr9xSjtoop523p-2B5dLiXBbw-2BI-2BAx91RLj-2B6g6kWXiBX4dZ7VLpB5sIsP2fUmsNhtfMGxvJCY-2BRD8IRj8AOgXnlZOA-2B7Ov9DSL-2BQ8KJyz5pNrAJS-2FCamm4wJHhtWxlfWJoBH79yiAapZw-2Fa7HlOq7LW_-2FtrkJYtssUveXERYVbGgKpodoStjimyExhfM3ejAfzuVlFsd2sMyrjZ3RyQMoa-2BVsLNT-2FwykvHuxKNblO8W3QWQoCqwrbwiWsJjSeTiFhRAxR3pbmUH0Kc3X8jIrozMI4JsufamuW8BGQnteEeDGxnua3psVHcEYMheycP6-2FLt6IbX4l31tGoj1bS1D7Q-2BjveTvr-2FdOqCtql8yL4JBKFdHf5zKMeUbfuku1gMF4BuDc8-2Bw8DY0XHH-2FYS0Txxn-2B1xhkKGpY-2Fcg561qqFhDV1hoXNvGr1wDMMNLoTfrpC64NE-2FTne0UULKKErvS3GI4P1r-2FJckJOequKpxvTFLBOo88DR1-2FL0RYISJJKSlmQKn6o1RlWiTTOxt6RXYBRgEM2MQX8BTo7zhfoo9hYgAysrJBJbIREFChbpR2uvEwiXsGdnE855Aa31HiEKo-2Fh31qpuSpYv1kWi331qDDSQRxyZVew-3D-3D HTTP 302
  • https://apiservi.bilalsmedicare.com/tr/cl/CVHCLss3KYb9H1dtk3RQgpKgSx37AkrbuUyBOQpTlW-t8C19TXNwB_BkV_tfyYyh-us9BbP1M038WkndZEobLMueqVySvSW7daMuOq_gn_QAIKiRBUSpy89YlfZwPEul8DFi5nUBqvFRQTITTF9Yd2hM7PR0COCI-p87XsFVa41ffLfN3lnUoYbjeSueWyvyJ8D09CBsn_6w96Dm6-omqg9eRF-8B3LID_0puG1WVmGPyKnamJF4aJdmrRrQJPP9GOrsid2YSkRK35C4L_fBIUf8MmGMkKhLcni4aYCyDtYLqg?_kx=sbKHk0ytyVYuK9F1mbg1TV31tG-1xcPhEYpUGotKvMfUvHQ93dGHSQyXBYrr1aH7.RPSYU6

3 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
CVHCLss3KYb9H1dtk3RQgpKgSx37AkrbuUyBOQpTlW-t8C19TXNwB_BkV_tfyYyh-us9BbP1M038WkndZEobLMueqVySvSW7daMuOq_gn_QAIKiRBUSpy89YlfZwPEul8DFi5nUBqvFRQTITTF9Yd2hM7PR0COCI-p87XsFVa41ffLfN3lnUoYbjeSueWyvyJ8D09...
apiservi.bilalsmedicare.com/tr/cl/
Redirect Chain
  • https://trk.klclick3.com/ls/click?upn=Vtrs3xURK-2Bc2pVdHID18VKKbomEjEOcNsWZOBESTe-2FjnB-2FOlBwSr-2Bvm8KVYGZRqs4fOi8eNkM5P0-2Bna5P5YERuZ6fAzSIaBwS8DebmpoHozV78Ev1VbXExe12E-2B1enmAP8ZUDpl2UTFUkv8ZJ-2...
  • https://apiservi.bilalsmedicare.com/tr/cl/CVHCLss3KYb9H1dtk3RQgpKgSx37AkrbuUyBOQpTlW-t8C19TXNwB_BkV_tfyYyh-us9BbP1M038WkndZEobLMueqVySvSW7daMuOq_gn_QAIKiRBUSpy89YlfZwPEul8DFi5nUBqvFRQTITTF9Yd2hM7PR...
1 KB
673 B 		Document
General
Check archive.org
Download Go to
Full URL
https://apiservi.bilalsmedicare.com/tr/cl/CVHCLss3KYb9H1dtk3RQgpKgSx37AkrbuUyBOQpTlW-t8C19TXNwB_BkV_tfyYyh-us9BbP1M038WkndZEobLMueqVySvSW7daMuOq_gn_QAIKiRBUSpy89YlfZwPEul8DFi5nUBqvFRQTITTF9Yd2hM7PR0COCI-p87XsFVa41ffLfN3lnUoYbjeSueWyvyJ8D09CBsn_6w96Dm6-omqg9eRF-8B3LID_0puG1WVmGPyKnamJF4aJdmrRrQJPP9GOrsid2YSkRK35C4L_fBIUf8MmGMkKhLcni4aYCyDtYLqg?_kx=sbKHk0ytyVYuK9F1mbg1TV31tG-1xcPhEYpUGotKvMfUvHQ93dGHSQyXBYrr1aH7.RPSYU6
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.253.43.4 , Hong Kong, ASN133398 (TELE-AS Tele Asia Limited, HK),
Reverse DNS
slot9.ge-re.com
Software
Apache /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

content-encoding
gzip
content-length
576
content-type
text/html; charset=UTF-8
date
Tue, 12 Dec 2023 09:31:08 GMT
server
Apache
vary
Accept-Encoding

Redirect headers

content-length
443
content-type
text/html; charset=utf-8
date
Tue, 12 Dec 2023 09:31:07 GMT
location
https://apiservi.bilalsmedicare.com/tr/cl/CVHCLss3KYb9H1dtk3RQgpKgSx37AkrbuUyBOQpTlW-t8C19TXNwB_BkV_tfyYyh-us9BbP1M038WkndZEobLMueqVySvSW7daMuOq_gn_QAIKiRBUSpy89YlfZwPEul8DFi5nUBqvFRQTITTF9Yd2hM7PR0COCI-p87XsFVa41ffLfN3lnUoYbjeSueWyvyJ8D09CBsn_6w96Dm6-omqg9eRF-8B3LID_0puG1WVmGPyKnamJF4aJdmrRrQJPP9GOrsid2YSkRK35C4L_fBIUf8MmGMkKhLcni4aYCyDtYLqg?_kx=sbKHk0ytyVYuK9F1mbg1TV31tG-1xcPhEYpUGotKvMfUvHQ93dGHSQyXBYrr1aH7.RPSYU6
server
nginx
via
1.1 e9101023ffbe04130b9d4cac0cf9eebc.cloudfront.net (CloudFront)
x-amz-cf-id
X39JxAT6XEnlFm_aBSifjqaS82omHFknSFoMPlCDsTvbO76KCrKz5Q==
x-amz-cf-pop
FRA56-P2
x-cache
Miss from cloudfront
x-robots-tag
noindex, nofollow
Primary Request Instdelivery.html
instantdelivery.us-ord-1.linodeobjects.com/
Redirect Chain
  • https://apiservi.bilalsmedicare.com/index.php?continue2
  • https://instantdelivery.us-ord-1.linodeobjects.com/Instdelivery.html
166 KB
166 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://instantdelivery.us-ord-1.linodeobjects.com/Instdelivery.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2600:3c06::f03c:93ff:fe54:2fd2 Chicago, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS
Software
/
Resource Hash
0557ff324ccc783296a4b878217eebfb92000690da7cdbd803cb6dd9b408ad2d

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://apiservi.bilalsmedicare.com
Referer
https://apiservi.bilalsmedicare.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Length
170004
Content-Type
text/html
Date
Tue, 12 Dec 2023 09:31:11 GMT
ETag
"89f1690793b202f786e0982d2dc8aa14"
Last-Modified
Mon, 11 Dec 2023 10:24:01 GMT
x-amz-request-id
tx00000432bbc2bcbeff291-006578285f-79b1e5-default
x-rgw-object-type
Normal

Redirect headers

content-encoding
gzip
content-length
576
content-type
text/html; charset=UTF-8
date
Tue, 12 Dec 2023 09:31:09 GMT
location
https://instantdelivery.us-ord-1.linodeobjects.com/Instdelivery.html
server
Apache
vary
Accept-Encoding
/
ruthowlevtui.officialcountdown9.com/ Frame B239 		324 KB
131 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ruthowlevtui.officialcountdown9.com/?UmuT=JLJ6sa
Requested by
Host: instantdelivery.us-ord-1.linodeobjects.com
URL: https://instantdelivery.us-ord-1.linodeobjects.com/Instdelivery.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
212.70.149.197 Dimitrovgrad, Bulgaria, ASN12615 (GCN-AS GCN AD - Sofia, Bulgaria, BG),
Reverse DNS
Software
nginx /
Resource Hash
df07c39ca3b3fdd3173be4395ca79c93de5be615c33f4203c2bb2dd3c4cdcff2

Request headers

Referer
https://instantdelivery.us-ord-1.linodeobjects.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

content-encoding
gzip
content-type
text/html; charset=utf-8
date
Tue, 12 Dec 2023 09:31:12 GMT
server
nginx
vary
Accept-Encoding
truncated
/ Frame B239 		858 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
19b8ee66ab60c45d5d24988d090b61c938b44c2ee9a5f8558335b27a2f315072

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/ Frame B239 		40 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
64c2019b369b4f3b45009d1740f4c7ae0856bb2608aea7d7628b78f43cecb3fa

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| documentPictureInPicture function| a0_0x375d function| a0_0xe541

0 Cookies