i.lnknad.com
Open in
urlscan Pro
185.133.192.218
Malicious Activity!
Public Scan
Submitted URL: https://i.lnknad.com/?l=spencer.p.eccles@wellscap.com
Effective URL: https://i.lnknad.com/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&qqJngXLTGSXCIGh...
Submission: On July 02 via manual from IN
Effective URL: https://i.lnknad.com/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&qqJngXLTGSXCIGh...
Submission: On July 02 via manual from IN
Summary
This website contacted 3 IPs
in 2 countries
across 3 domains to perform 7 HTTP transactions.
The main IP is 185.133.192.218, located in
United Kingdom and
belongs to HOSTUS-GLOBAL-AS HostUS, HK.
The main domain is i.lnknad.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on July 1st 2019. Valid for: 3 months.
This is the only time i.lnknad.com was scanned on urlscan.io!
TLS certificate: Issued by cPanel, Inc. Certification Authority on July 1st 2019. Valid for: 3 months.
This is the only time i.lnknad.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: LinkedIn (Social Network)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 2 | 185.133.192.218 185.133.192.218 | 7489 (HOSTUS-GL...) (HOSTUS-GLOBAL-AS HostUS) | |
| 4 | 2a02:26f0:6c0... 2a02:26f0:6c00:2be::25ea | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
| 7 | 3 |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 4 |
licdn.com
static.licdn.com |
59 KB |
| 2 |
lnknad.com
i.lnknad.com |
22 KB |
| 0 |
alibaba.com
Failed
passport.alibaba.com Failed |
|
| 7 | 3 |
| Domain | Requested by | |
|---|---|---|
| 4 | static.licdn.com |
i.lnknad.com
|
| 2 | i.lnknad.com | |
| 0 | passport.alibaba.com Failed |
i.lnknad.com
|
| 7 | 3 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| i.lnknad.com cPanel, Inc. Certification Authority |
2019-07-01 - 2019-09-29 |
3 months | crt.sh |
| *.licdn.com DigiCert SHA2 Secure Server CA |
2019-04-01 - 2021-05-07 |
2 years | crt.sh |
This page contains 2 frames:
Primary Page:
https://i.lnknad.com/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&qqJngXLTGSXCIGhnQWkYAmsb9Lm53wo0rdoyBUO6DN4SDSZskPuzMbzguEN4eN8LjDC3fLMFbxqZCzXL3mcUFmX1AkV7dqRNw4edQk9SobRZNFpoDKnRGTXnXz1nF9kJKSOqTR2PhUv2&id=spencer.p.eccles@wellscap.com
Frame ID: 278C5CBE03880FC8FD90162CF4AE01AF
Requests: 6 HTTP requests in this frame
Frame:
https://passport.alibaba.com/icbu_login.htm?return_url=https%3A%2F%2Fwww.alibaba.com%2F
Frame ID: 72DA220222238E2826AB59A79DE8D00F
Requests: 1 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- https://i.lnknad.com/?l=spencer.p.eccles@wellscap.com Page URL
- https://i.lnknad.com/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-si... Page URL
Detected technologies
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://i.lnknad.com/?l=spencer.p.eccles@wellscap.com Page URL
- https://i.lnknad.com/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&qqJngXLTGSXCIGhnQWkYAmsb9Lm53wo0rdoyBUO6DN4SDSZskPuzMbzguEN4eN8LjDC3fLMFbxqZCzXL3mcUFmX1AkV7dqRNw4edQk9SobRZNFpoDKnRGTXnXz1nF9kJKSOqTR2PhUv2&id=spencer.p.eccles@wellscap.com Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
/
i.lnknad.com/ |
299 B 507 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Primary Request
/
i.lnknad.com/l.php/ |
21 KB 22 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
%2Fcheckpoint-frontend%2Fstylesheets%2Flogin%2Ffastrack%2Fdesktop_en_US.css
static.licdn.com/sc/p/com.linkedin.checkpoint%3Acheckpoint-static-content%2B2.0.262/f/ |
190 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
7iptgtauoer8as7pb8k008o4c
static.licdn.com/sc/h/br/ |
55 KB 14 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ce5359m270sii9ud195l3tlfz
static.licdn.com/sc/h/br/ |
72 KB 20 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
icbu_login.htm
passport.alibaba.com/ Frame 72DA |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
djzv59yelk5urv2ujlazfyvrk
static.licdn.com/sc/h/ |
9 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- passport.alibaba.com
- URL
- https://passport.alibaba.com/icbu_login.htm?return_url=https%3A%2F%2Fwww.alibaba.com%2F
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: LinkedIn (Social Network)8 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask function| nospaces function| validate object| LI object| artdeco object| _artdecoBakedCurves0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
i.lnknad.com
passport.alibaba.com
static.licdn.com
passport.alibaba.com
185.133.192.218
2a02:26f0:6c00:2be::25ea
ba0e4a9f2b657bc00c4abcf7219517c9846d079a3d7abb7e778270949ba92a9d
f165af10f04c3852fccb6500761ca16126a86acf7f6138e7c75a98caa33c0fa1
f22081906f87637d3fc7f822eedf67e37b3d9e2bb780bc533404e95f753b7433
fadf34ab3a5d0c22f46af87308c62bf8deb79e6c684f15963aeb656943eb51e4
fcaea8f8347e9e5ba2b3e7351379fc74fc4ddae29878307cad7ae85fdbfe132a