antprimary.com Open in urlscan Pro
162.241.149.153 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://antprimary.com/linkedin/
Submission: On September 10 via automatic, source openphish (September 10th 2021, 1:26:29 am UTC) — Scanned from DE

Summary HTTP 20 Redirects Behaviour Indicators

Summary

This website contacted 8 IPs in 4 countries across 6 domains to perform 20 HTTP transactions. The main IP is 162.241.149.153, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is antprimary.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on September 8th 2021. Valid for: 3 months.

This is the only time antprimary.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: LinkedIn (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
1 4	162.241.149.153 162.241.149.153	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
7	2a02:26f0:300... 2a02:26f0:3000::170a:f923	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	2a02:26f0:300... 2a02:26f0:3000::170a:f909	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	52.208.28.104 52.208.28.104	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:400a:808::200d	15169 (GOOGLE) (GOOGLE)
1	2620:1ec:21::16 2620:1ec:21::16	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2a02:26f0:2b0... 2a02:26f0:2b00:5::5c7a:3242	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	54.247.138.82 54.247.138.82	16509 (AMAZON-02) (AMAZON-02)
20	8

4 162.241.149.153 (United States) 1 redirects

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 162-241-149-153.unifiedlayer.com

antprimary.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a02:26f0:3000::170a:f923 (Glattbrugg, Switzerland)

ASN20940 (AKAMAI-ASN1, NL)

static-exp1.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a02:26f0:3000::170a:f909 (Glattbrugg, Switzerland)

ASN20940 (AKAMAI-ASN1, NL)

platform.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.208.28.104 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-208-28-104.eu-west-1.compute.amazonaws.com

lnkd.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400a:808::200d (Zurich, Switzerland)

ASN15169 (GOOGLE, US)

accounts.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::16 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.linkedin-ei.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:2b00:5::5c7a:3242 (Paris, France)

ASN20940 (AKAMAI-ASN1, NL)

platform.linkedin-ei.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.247.138.82 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-247-138-82.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	licdn.com static-exp1.licdn.com	172 KB
4	linkedin.com platform.linkedin.com	51 KB
4	antprimary.com 1 redirects antprimary.com	43 KB
3	demdex.net lnkd.demdex.net dpm.demdex.net	6 KB
2	linkedin-ei.com www.linkedin-ei.com platform.linkedin-ei.com	44 KB
1	google.com accounts.google.com	1008 B
20	6

	Domain	Requested by
7	static-exp1.licdn.com	antprimary.com
4	platform.linkedin.com	antprimary.com
4	antprimary.com	1 redirects static-exp1.licdn.com
2	lnkd.demdex.net	antprimary.com platform.linkedin.com
1	dpm.demdex.net	platform.linkedin-ei.com
1	platform.linkedin-ei.com	static-exp1.licdn.com
1	www.linkedin-ei.com	static-exp1.licdn.com
1	accounts.google.com
20	8

This site contains no links.

Subject Issuer	Validity	Valid
antprimary.com cPanel, Inc. Certification Authority	`2021-09-08` - `2021-12-07`	3 months	crt.sh
*.licdn.com DigiCert SHA2 Secure Server CA	`2021-07-15` - `2022-07-20`	a year	crt.sh
platform.linkedin.com DigiCert SHA2 Secure Server CA	`2020-07-03` - `2022-07-08`	2 years	crt.sh
*.demdex.net DigiCert TLS RSA SHA256 2020 CA1	`2020-12-02` - `2022-01-02`	a year	crt.sh
accounts.google.com GTS CA 1C3	`2021-08-23` - `2021-11-15`	3 months	crt.sh
www.linkedin-ei.com DigiCert SHA2 Secure Server CA	`2021-04-30` - `2021-10-30`	6 months	crt.sh

This page contains 2 frames:

Primary Page: https://antprimary.com/linkedin/
Frame ID: 9383982BE459E8077100AC7807C79E16
Requests: 19 HTTP requests in this frame

Frame: https://lnkd.demdex.net/dest5.html?d_nsid=0
Frame ID: EFDD4727B32FF4DDCC4B6FCAACD7783E
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

LinkedIn Login, Sign in | LinkedIn

Page URL History Show full URLs

https://antprimary.com/linkedin HTTP 301
https://antprimary.com/linkedin/ Page URL

Page Statistics

20
Requests

100 %
HTTPS

63 %
IPv6

6
Domains

8
Subdomains

8
IPs

4
Countries

316 kB
Transfer

1108 kB
Size

11
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://antprimary.com/linkedin HTTP 301
https://antprimary.com/linkedin/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

20 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
antprimary.com/linkedin/
Redirect Chain

https://antprimary.com/linkedin
https://antprimary.com/linkedin/

41 KB
42 KB

128ms
128ms

Document
text/html

162.241.149.153
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://antprimary.com/linkedin/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.241.149.153 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 162-241-149-153.unifiedlayer.com
Software: Apache /
Resource Hash: 46e942b88cc1d5cfed96a384d7fa8dff33961f24400536c265992f6d7d8c0684

Request headers

Host: antprimary.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

Date: Fri, 10 Sep 2021 01:26:23 GMT
Server: Apache
Last-Modified: Thu, 09 Sep 2021 20:53:26 GMT
Accept-Ranges: bytes
Content-Length: 42262
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html

Redirect headers

Date: Fri, 10 Sep 2021 01:26:23 GMT
Server: Apache
Location: https://antprimary.com/linkedin/
Content-Length: 240
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK b65e8ovcinye0pcd3qs7rus9u Show response
static-exp1.licdn.com/sc/h/ 155 KB
39 KB 67ms
17ms Script
text/javascript 2a02:26f0:3000::170a:f923
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://static-exp1.licdn.com/sc/h/b65e8ovcinye0pcd3qs7rus9u
Requested by: Host: antprimary.com
URL: https://antprimary.com/linkedin/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3000::170a:f923 Glattbrugg, Switzerland, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Play /
Resource Hash: d25766a048ff80ed49cf7e345dabe00879b6143868f4499fccdab441302acc3a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://antprimary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

X-LI-Proto: http/1.1
Date: Fri, 10 Sep 2021 01:26:24 GMT
Content-Encoding: br
Content-Type: text/javascript
X-CDN-CLIENT-IP-VERSION: IPV6
X-CDN: AKAM
X-CDN-Proto: HTTP1
Remote-Cache-Status: TCP_HIT, TCP_HIT, TCP_HIT
Connection: keep-alive
Content-Length: 39238
X-LI-UUID: QzGszGXpoBbgyUsIvioAAA==
Server: Play
Timing-Allow-Origin: *
Last-Modified: Mon, 05 Nov 2012 04:00:51 GMT
X-Li-Pop: prod-eda6
X-Li-Fabric: prod-ltx1
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-CDN, X-CDN-CLIENT-IP-VERSION, X-CDN-Proto
Cache-Control: max-age=31536000, immutable
X-LI-Static-Content: 1
X-FS-UUID: 4331accc65e9a016e0c94b08be2a0000
Expires: Fri, 02 Sep 2022 05:14:48 GMT

GET
H/1.1 200
OK 9t0ibl3u6kzmm3xkauxilt140 Show response
static-exp1.licdn.com/sc/h/ 62 KB
19 KB 67ms
17ms Script
text/javascript 2a02:26f0:3000::170a:f923
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://static-exp1.licdn.com/sc/h/9t0ibl3u6kzmm3xkauxilt140
Requested by: Host: antprimary.com
URL: https://antprimary.com/linkedin/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3000::170a:f923 Glattbrugg, Switzerland, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Play /
Resource Hash: 7110daa4bb9b8cc37d21a49acecd4a4e7f62f41d45eb2b8be7f0fe9ea8507234

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://antprimary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

X-LI-Proto: http/1.1
Date: Fri, 10 Sep 2021 01:26:24 GMT
Content-Encoding: br
Content-Type: text/javascript
X-CDN-CLIENT-IP-VERSION: IPV6
X-CDN: AKAM
X-CDN-Proto: HTTP1
Remote-Cache-Status: TCP_HIT
Connection: keep-alive
Content-Length: 18642
X-LI-UUID: V311cVsanxbAegGzGSsAAA==
Server: Play
Timing-Allow-Origin: *
Last-Modified: Mon, 05 Nov 2012 04:00:51 GMT
X-Li-Pop: prod-eda6
X-Li-Fabric: prod-ltx1
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-CDN, X-CDN-CLIENT-IP-VERSION, X-CDN-Proto
Cache-Control: max-age=31536000, immutable
X-LI-Static-Content: 1
X-FS-UUID: 577d75715b1a9f16c07a01b3192b0000
Expires: Sat, 27 Aug 2022 07:49:30 GMT

GET
H/1.1 200
OK 6jblk5oqhlo45xbkmcr7s4zix Show response
static-exp1.licdn.com/sc/h/ 64 KB
14 KB 64ms
14ms Script
text/javascript 2a02:26f0:3000::170a:f923
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://static-exp1.licdn.com/sc/h/6jblk5oqhlo45xbkmcr7s4zix
Requested by: Host: antprimary.com
URL: https://antprimary.com/linkedin/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3000::170a:f923 Glattbrugg, Switzerland, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Play /
Resource Hash: 2072637eca86b31333f03dd2f363993776d87ec85be0f0970d80a08347cbe43f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://antprimary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

X-LI-Proto: http/1.1
Date: Fri, 10 Sep 2021 01:26:24 GMT
Content-Encoding: br
Content-Type: text/javascript
X-CDN-CLIENT-IP-VERSION: IPV6
X-CDN: AKAM
X-CDN-Proto: HTTP1
Remote-Cache-Status: TCP_HIT
Connection: keep-alive
Content-Length: 13554
X-LI-UUID: J07nwmONeBYwwZgArSoAAA==
Server: Play
Timing-Allow-Origin: *
Last-Modified: Mon, 05 Nov 2012 04:00:51 GMT
X-Li-Pop: prod-ech2
X-Li-Fabric: prod-lva1
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-CDN, X-CDN-CLIENT-IP-VERSION, X-CDN-Proto
Cache-Control: max-age=31536000, immutable
X-LI-Static-Content: 1
X-FS-UUID: 274ee7c2638d781630c19800ad2a0000
Expires: Sat, 23 Apr 2022 17:38:45 GMT

GET
H/1.1 200
OK 48p0pumuvwn6gf14efb9gdp4v Show response
static-exp1.licdn.com/sc/h/ 2 KB
1 KB 63ms
14ms Script
text/javascript 2a02:26f0:3000::170a:f923
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://static-exp1.licdn.com/sc/h/48p0pumuvwn6gf14efb9gdp4v
Requested by: Host: antprimary.com
URL: https://antprimary.com/linkedin/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3000::170a:f923 Glattbrugg, Switzerland, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Play /
Resource Hash: 5af2dfee0b7dd68e56ad1e1c5f6818f6812f484d39d4495d60a6666fd0c057fb

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://antprimary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

X-LI-Proto: http/1.1
Date: Fri, 10 Sep 2021 01:26:24 GMT
Content-Encoding: br
Content-Type: text/javascript
X-CDN-CLIENT-IP-VERSION: IPV6
X-CDN: AKAM
X-CDN-Proto: HTTP1
Remote-Cache-Status: TCP_HIT
Connection: keep-alive
Content-Length: 683
X-LI-UUID: lE8zcVsanxYQKc7POisAAA==
Server: Play
Timing-Allow-Origin: *
Last-Modified: Mon, 05 Nov 2012 04:00:51 GMT
X-Li-Pop: prod-edc2
X-Li-Fabric: prod-lva1
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-CDN, X-CDN-CLIENT-IP-VERSION, X-CDN-Proto
Cache-Control: max-age=31536000, immutable
X-LI-Static-Content: 1
X-FS-UUID: 944f33715b1a9f161029cecf3a2b0000
Expires: Sat, 27 Aug 2022 07:49:30 GMT

GET
H/1.1 200
OK dux5pmry7fu9btbz2isdqym2q Show response
static-exp1.licdn.com/sc/h/ 67 KB
20 KB 67ms
17ms Script
text/javascript 2a02:26f0:3000::170a:f923
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://static-exp1.licdn.com/sc/h/dux5pmry7fu9btbz2isdqym2q
Requested by: Host: antprimary.com
URL: https://antprimary.com/linkedin/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3000::170a:f923 Glattbrugg, Switzerland, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Play /
Resource Hash: d9a2efb86be0801c3d1a97d0b5a125053fdbc40c9540ebeac182e0f46dbf3261

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://antprimary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

X-LI-Proto: http/1.1
Date: Fri, 10 Sep 2021 01:26:24 GMT
Content-Encoding: br
Content-Type: text/javascript
X-CDN-CLIENT-IP-VERSION: IPV6
X-CDN: AKAM
X-CDN-Proto: HTTP1
Remote-Cache-Status: TCP_HIT
Connection: keep-alive
Content-Length: 19811
X-LI-UUID: U/87eVsanxawVGvVaisAAA==
Server: Play
Timing-Allow-Origin: *
Last-Modified: Mon, 05 Nov 2012 04:00:51 GMT
X-Li-Pop: prod-eda6
X-Li-Fabric: prod-ltx1
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-CDN, X-CDN-CLIENT-IP-VERSION, X-CDN-Proto
Cache-Control: max-age=31536000, immutable
X-LI-Static-Content: 1
X-FS-UUID: 53ff3b795b1a9f16b0546bd56a2b0000
Expires: Sat, 27 Aug 2022 07:49:30 GMT

GET
H/1.1 200
OK 304mgi5j23vqo26trnz6auzve
static-exp1.licdn.com/sc/h/ 210 KB
19 KB 65ms
16ms Stylesheet
text/css 2a02:26f0:3000::170a:f923
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://static-exp1.licdn.com/sc/h/304mgi5j23vqo26trnz6auzve
Requested by: Host: antprimary.com
URL: https://antprimary.com/linkedin/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3000::170a:f923 Glattbrugg, Switzerland, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Play /
Resource Hash: 2bcca5003dde9197922f96cf949f3bb2760bf26a86ab5ed6263fe816aaba8578

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://antprimary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

X-LI-Proto: http/1.1
Date: Fri, 10 Sep 2021 01:26:24 GMT
Content-Encoding: br
Content-Type: text/css
X-CDN-CLIENT-IP-VERSION: IPV6
X-CDN: AKAM
X-CDN-Proto: HTTP1
Connection: keep-alive
Content-Length: 19128
X-LI-UUID: uL4xDgkbnxYAIrS30SoAAA==
Server: Play
Timing-Allow-Origin: *
Last-Modified: Mon, 05 Nov 2012 04:00:51 GMT
X-Li-Pop: prod-eda6
X-Li-Fabric: prod-ltx1
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-CDN, X-CDN-CLIENT-IP-VERSION, X-CDN-Proto
Cache-Control: max-age=31536000, immutable
X-LI-Static-Content: 1
X-FS-UUID: b8be310e091b9f160022b4b7d12a0000
Expires: Sat, 27 Aug 2022 08:01:55 GMT

GET
H/1.1 200
OK 8ddascte8uiyhhufy6qlnhw2b Show response
static-exp1.licdn.com/sc/h/ 218 KB
59 KB 78ms
14ms Script
text/javascript 2a02:26f0:3000::170a:f923
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://static-exp1.licdn.com/sc/h/8ddascte8uiyhhufy6qlnhw2b
Requested by: Host: antprimary.com
URL: https://antprimary.com/linkedin/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3000::170a:f923 Glattbrugg, Switzerland, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Play /
Resource Hash: 190472cc8b749d317cc6d4c27a5022d250df931fb04507c307ef640a452200da

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://antprimary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

X-LI-Proto: http/1.1
Date: Fri, 10 Sep 2021 01:26:24 GMT
Content-Encoding: br
Content-Type: text/javascript
X-CDN-CLIENT-IP-VERSION: IPV6
X-CDN: AKAM
X-CDN-Proto: HTTP1
Connection: keep-alive
Content-Length: 59843
X-LI-UUID: nE8UDJdRnBYwO9WaFCsAAA==
Server: Play
Timing-Allow-Origin: *
Last-Modified: Mon, 05 Nov 2012 04:00:51 GMT
X-Li-Pop: prod-edc2
X-Li-Fabric: prod-lva1
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-CDN, X-CDN-CLIENT-IP-VERSION, X-CDN-Proto
Cache-Control: max-age=31536000, immutable
X-LI-Static-Content: 1
X-FS-UUID: 9c4f140c97519c16303bd59a142b0000
Expires: Thu, 18 Aug 2022 06:07:54 GMT

GET
H/1.1 200
OK utag.js Show response
platform.linkedin.com/litms/utag/checkpoint-frontend/ 129 KB
42 KB 356ms
242ms Script
application/javascript 2a02:26f0:3000::170a:f909
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.linkedin.com/litms/utag/checkpoint-frontend/utag.js?cb=1631176800000
Requested by: Host: antprimary.com
URL: https://antprimary.com/linkedin/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3000::170a:f909 Glattbrugg, Switzerland, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Play /
Resource Hash: 6632763e797e0e05588d82fcb2d74f83b482c155cd9a700e70826215c0e2a51a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://antprimary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

X-EdgeConnect-Origin-MEX-Latency: 189
Date: Fri, 10 Sep 2021 01:26:24 GMT
Content-Encoding: gzip
Content-Type: application/javascript; charset=utf-8
X-CDN-CLIENT-IP-VERSION: IPV6
X-CDN: AKAM
X-EdgeConnect-MidMile-RTT: 0
Connection: keep-alive
Content-Length: 41710
X-LI-UUID: 4TA403Qaoxagmh9s7CoAAA==
Server: Play
Last-Modified: Wed, 01 Sep 2021 22:17:10 GMT
X-Li-Pop: prod-edc2
ETag: "903d678f18fc6d8e8afc4aa967bf40ce21e12855"
Vary: Accept-Encoding
X-Li-Fabric: prod-ltx1
Cache-Control: max-age=300
Accept-Ranges: bytes
X-LI-Proto: http/1.1

GET
H/1.1 200
OK utag.107.js Show response
platform.linkedin.com/litms/utag/checkpoint-frontend/ 9 KB
4 KB 113ms
14ms Script
application/javascript 2a02:26f0:3000::170a:f909
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.linkedin.com/litms/utag/checkpoint-frontend/utag.107.js?utv=ut4.46.202108061923
Requested by: Host: antprimary.com
URL: https://antprimary.com/linkedin/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3000::170a:f909 Glattbrugg, Switzerland, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Play /
Resource Hash: 704c03388d696028b43d5a1c5d4b4b7d6de3305ab5da61f507e552595544b0c0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://antprimary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Fri, 10 Sep 2021 01:26:24 GMT
Content-Encoding: gzip
X-CDN-CLIENT-IP-VERSION: IPV6
X-CDN: AKAM
Connection: keep-alive
Content-Length: 3147
X-LI-UUID: eC9Pv//WoBYgmgwl3ioAAA==
Server: Play
Last-Modified: Wed, 01 Sep 2021 22:17:10 GMT
X-Li-Pop: prod-eda6
ETag: "7102c830da3af9fe101094c6b817ba8554a3a56c"
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Cache-Control: max-age=300
Accept-Ranges: bytes
X-LI-Proto: http/1.1
X-Li-Fabric: prod-ltx1

GET
H/1.1 200
OK utag.116.js Show response
platform.linkedin.com/litms/utag/checkpoint-frontend/ 3 KB
2 KB 106ms
17ms Script
application/javascript 2a02:26f0:3000::170a:f909
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.linkedin.com/litms/utag/checkpoint-frontend/utag.116.js?utv=ut4.46.202108061923
Requested by: Host: antprimary.com
URL: https://antprimary.com/linkedin/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3000::170a:f909 Glattbrugg, Switzerland, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Play /
Resource Hash: cd776aa311400c90accd07b01cf79a23278d85d536ecccd66b895586be32c23d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://antprimary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Fri, 10 Sep 2021 01:26:24 GMT
Content-Encoding: gzip
NEL: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
X-CDN: AKAM
Connection: keep-alive
Content-Length: 1485
X-LI-UUID: ImhHyaHWoBaAdw3a9SoAAA==
Server: Play
Last-Modified: Wed, 01 Sep 2021 22:17:10 GMT
X-Li-Pop: prod-edc2
X-CDN-CLIENT-IP-VERSION: IPV6
ETag: "93d98a401f81fcf276099d2d56add904e8115b0b"
Vary: Accept-Encoding
Report-To: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
Content-Type: application/javascript; charset=utf-8
Cache-Control: max-age=300
Accept-Ranges: bytes
X-LI-Proto: http/1.1
X-Li-Fabric: prod-ltx1

GET
H/1.1 200
OK utag.117.js Show response
platform.linkedin.com/litms/utag/checkpoint-frontend/ 10 KB
4 KB 105ms
16ms Script
application/javascript 2a02:26f0:3000::170a:f909
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.linkedin.com/litms/utag/checkpoint-frontend/utag.117.js?utv=ut4.46.202108061923
Requested by: Host: antprimary.com
URL: https://antprimary.com/linkedin/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3000::170a:f909 Glattbrugg, Switzerland, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Play /
Resource Hash: 962d24fdaffaabc712ef425e30b013455416f8d14ddb5166482d04c89421e25d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://antprimary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Fri, 10 Sep 2021 01:26:24 GMT
Content-Encoding: gzip
X-CDN-CLIENT-IP-VERSION: IPV6
X-CDN: AKAM
Connection: keep-alive
Content-Length: 3265
X-LI-UUID: 4genzv/WoBYw4U6m3ioAAA==
Server: Play
Last-Modified: Wed, 01 Sep 2021 22:17:10 GMT
X-Li-Pop: prod-eda6
ETag: "cb108071d238cd15f5c3c9e2913d2b19f9d71211"
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Cache-Control: max-age=300
Accept-Ranges: bytes
X-LI-Proto: http/1.1
X-Li-Fabric: prod-ltx1

GET
H/1.1 200
OK dest5.html Show response
lnkd.demdex.net/ Frame EFDD 7 KB
3 KB 228ms
30ms Document
text/html 52.208.28.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://lnkd.demdex.net/dest5.html?d_nsid=0

Requested by

Host: antprimary.com
URL: https://antprimary.com/linkedin/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.208.28.104 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-208-28-104.eu-west-1.compute.amazonaws.com

Software

Resource Hash

7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Host: lnkd.demdex.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://antprimary.com/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://antprimary.com/

Response headers

Accept-Ranges: bytes
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
Content-Type: text/html;charset=UTF-8
date: Fri, 10 Sep 2021 01:26:24 GMT
DCS: dcs-prod-irl1-2-v016-07aa1f8a3.edge-irl1.demdex.com UNKNOWN
Expires: Thu, 01 Jan 1970 00:00:00 UTC
last-modified: Wed, 8 Sep 2021 15:27:47 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
vary: accept-encoding
X-TID: N46IfcYyTt4=
Content-Length: 2791
Connection: keep-alive

GET
H2 403 status Show response
accounts.google.com/gsi/ 37 B
1008 B 292ms
241ms XHR
application/json 2a00:1450:400a:808::200d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com/gsi/status?client_id=990339570472-k6nqn1tpmitg8pui82bfaun3jrpmiuhs.apps.googleusercontent.com&as=Lo%2BUOf3FzBIdVxII%2BnjpPw

Requested by

Host:
URL: /_/gsi/_/js/k=gsi.gsi.en.2f0d9inoam4.O/am=cg/d=1/ct=zgms/rs=AF0KOtW8IEF-TGSiZ5fJdPlfbYNG4zpbRg/m=gis_client_library

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400a:808::200d Zurich, Switzerland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

88cdaea60c904ce69cfdd8dc52d4c9ea43108bbadae3673878d1afe2595609c4

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-LuYQTdyc/Q2WrooINXrr8Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://antprimary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 10 Sep 2021 01:26:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
content-disposition: attachment; filename="json.txt"; filename*=UTF-8''json.txt
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
pragma: no-cache
server: ESF
x-frame-options: SAMEORIGIN
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://antprimary.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-security-policy: script-src 'report-sample' 'nonce-LuYQTdyc/Q2WrooINXrr8Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 404
Not Found track Show response
antprimary.com/li/ 315 B
515 B 127ms
126ms XHR
text/html 162.241.149.153
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://antprimary.com/li/track
Requested by: Host: static-exp1.licdn.com
URL: https://static-exp1.licdn.com/sc/h/b65e8ovcinye0pcd3qs7rus9u
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.241.149.153 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 162-241-149-153.unifiedlayer.com
Software: Apache /
Resource Hash: d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

Sec-Fetch-Mode: cors
Origin: https://antprimary.com
Accept-Encoding: gzip, deflate, br
Accept-Language: de-DE,de;q=0.9
Sec-Fetch-Dest: empty
Connection: keep-alive
Content-Length: 583
Cache-Control: no-cache
Pragma: no-cache
Host: antprimary.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-type: application/json
Accept: */*
Csrf-Token
Referer: https://antprimary.com/linkedin/
Sec-Fetch-Site: same-origin
Csrf-Token
Referer: https://antprimary.com/linkedin/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-type: application/json

Response headers

Date: Fri, 10 Sep 2021 01:26:24 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=98
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H2 200 user Show response
www.linkedin-ei.com/litms/api/metadata/ 324 B
2 KB 811ms
684ms XHR
application/json 2620:1ec:21::16
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.linkedin-ei.com/litms/api/metadata/user

Requested by

Host: static-exp1.licdn.com
URL: https://static-exp1.licdn.com/sc/h/9t0ibl3u6kzmm3xkauxilt140

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:21::16 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

413dcac687347fda31020577d90102126ed5bd03b783596da7648334a19f15d1

Security Headers

Name	Value
Content-Security-Policy	default-src ; connect-src 'self' ffi.st static.licdn-ei.com media.licdn-ei.com static-exp1.licdn-ei.com static-exp2.licdn-ei.com media-exp1.licdn-ei.com media-exp2.licdn-ei.com https://media-src.linkedin-ei.com/media/ www.linkedin.com www.linkedin-ei.com spdy.linkedin-ei.com dms.licdn-ei.com https://dpm.demdex.net/id lnkd.demdex.net blob: https://linkedin.sc.omtrdc.net/b/ss/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; img-src data: blob: ; font-src data: ; style-src 'unsafe-inline' 'self' static-src.linkedin.com .licdn.com static-src.linkedin-ei.com .licdn-ei.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' ffi.st spdy.linkedin.com static-src.linkedin.com .ads.linkedin.com .licdn.com platform.linkedin-ei.com spdy.linkedin-ei.com static-src.linkedin-ei.com .licdn-ei.com lix.corp.linkedin.com lva1-lixr01.linkedin.biz wus2-pd-lixr1.linkedin.biz static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com www.linkedin.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: ; child-src blob: lnkd-communities: voyager: ; frame-ancestors 'self' http://qa-mailbox.corp.linkedin.com; report-uri /security/csp?f=l
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://antprimary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
x-cache: CONFIG_NOCACHE
content-length: 219
x-li-uuid: AAXLmgEIes+hD7flkYNj5w==
pragma: no-cache
x-li-pop: afd-ei4-x
x-msedge-ref: Ref A: A46569B1DF154E1FBBAB400EBD8DF884 Ref B: FRAEDGE1317 Ref C: 2021-09-10T01:26:25Z
x-frame-options: sameorigin
date: Fri, 10 Sep 2021 01:26:25 GMT
expect-ct: max-age=86400, report-uri="https://www.linkedin-ei.com/platform-telemetry/ct"
vary: Origin,Accept-Encoding
content-type: application/json
access-control-allow-origin: https://antprimary.com
cache-control: no-cache, no-store
access-control-allow-credentials: true
content-security-policy: default-src *; connect-src 'self' ffi.st static.licdn-ei.com media.licdn-ei.com static-exp1.licdn-ei.com static-exp2.licdn-ei.com media-exp1.licdn-ei.com media-exp2.licdn-ei.com https://media-src.linkedin-ei.com/media/ www.linkedin.com www.linkedin-ei.com spdy.linkedin-ei.com dms.licdn-ei.com https://dpm.demdex.net/id lnkd.demdex.net blob: https://linkedin.sc.omtrdc.net/b/ss/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com static-src.linkedin-ei.com *.licdn-ei.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' ffi.st spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com platform.linkedin-ei.com spdy.linkedin-ei.com static-src.linkedin-ei.com *.licdn-ei.com lix.corp.linkedin.com lva1-lixr01.linkedin.biz wus2-pd-lixr1.linkedin.biz static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com www.linkedin.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self' http://qa-mailbox.corp.linkedin.com; report-uri /security/csp?f=l
x-li-proto: http/2
x-li-fabric: ei4
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 utag.js Show response
platform.linkedin-ei.com/litms/utag/checkpoint-frontend/ 129 KB
42 KB 1267ms
1036ms Script
application/javascript 2a02:26f0:2b00:5::5c7a:3242
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.linkedin-ei.com/litms/utag/checkpoint-frontend/utag.js?cb=1631237100000
Requested by: Host: static-exp1.licdn.com
URL: https://static-exp1.licdn.com/sc/h/9t0ibl3u6kzmm3xkauxilt140
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:2b00:5::5c7a:3242 Paris, France, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Play /
Resource Hash: 76d35616ac46fdb775fa2179763e28f6e103849831977ed1f11a20be1c3a78b2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://antprimary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 10 Sep 2021 01:26:26 GMT
content-encoding: gzip
content-type: application/javascript; charset=utf-8
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.0001,"failure_fraction":1,"include_subdomains":true}
x-cdn: AKAM
p3p: CP="CAO CUR ADM DEV PSA PSD OUR"
x-li-uuid: yifFH5RRoxaAd01EMSsAAA==
server: Play
last-modified: Tue, 07 Sep 2021 22:58:32 GMT
x-li-pop: ei-ltx1
etag: "0373955fcb937a35be4d0492dc43bcf3660c056c"
vary: Accept-Encoding
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin-ei.com/li/rep"}],"include_subdomains":true}
x-li-fabric: ei-ltx1
cache-control: max-age=300
accept-ranges: bytes
x-li-proto: http/1.1

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 611 B
1 KB 137ms
32ms XHR
application/json 54.247.138.82
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=5.1.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=14215E3D5995C57C0A495C55%40AdobeOrg&d_nsid=0&ts=1631237187015

Requested by

Host: platform.linkedin-ei.com
URL: https://platform.linkedin-ei.com/litms/utag/checkpoint-frontend/utag.js?cb=1631237100000

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.247.138.82 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-247-138-82.eu-west-1.compute.amazonaws.com

Software

Resource Hash

962ed56caab62577586066983265570a754f377e61740e0b5bc77dbb15a2a266

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://antprimary.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-1-v016-03f17ee76.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: Mnf8ob97Rzc=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://antprimary.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 448
Expires: Thu, 01 Jan 1970 00:00:00 UTC

POST
H/1.1 404
Not Found track Show response
antprimary.com/li/ 315 B
515 B 128ms
128ms XHR
text/html 162.241.149.153
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://antprimary.com/li/track
Requested by: Host: static-exp1.licdn.com
URL: https://static-exp1.licdn.com/sc/h/9t0ibl3u6kzmm3xkauxilt140
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.241.149.153 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 162-241-149-153.unifiedlayer.com
Software: Apache /
Resource Hash: d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

Sec-Fetch-Mode: cors
Origin: https://antprimary.com
Accept-Encoding: gzip, deflate, br
Accept-Language: de-DE,de;q=0.9
Sec-Fetch-Dest: empty
Cookie: AMCV_14215E3D5995C57C0A495C55%40AdobeOrg=-637568504%7CMCIDTS%7C18881%7CvVersion%7C5.1.1
Connection: keep-alive
Content-Length: 1565
Cache-Control: no-cache
Pragma: no-cache
Host: antprimary.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-type: application/json
Accept: */*
Csrf-Token
Referer: https://antprimary.com/linkedin/
Sec-Fetch-Site: same-origin
Csrf-Token
Referer: https://antprimary.com/linkedin/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-type: application/json

Response headers

Date: Fri, 10 Sep 2021 01:26:26 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=97
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

POST
H/1.1 200
OK event Show response
lnkd.demdex.net/ 689 B
1 KB 34ms
34ms XHR
application/json 52.208.28.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://lnkd.demdex.net/event?d_dil_ver=9.4&_ts=1631237187020

Requested by

Host: platform.linkedin.com
URL: https://platform.linkedin.com/litms/utag/checkpoint-frontend/utag.js?cb=1631176800000

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.208.28.104 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-208-28-104.eu-west-1.compute.amazonaws.com

Software

Resource Hash

bee2e57a9e38d73bdd6fa4ee6ee3f212c203986cfff8872d13d5aee53b36c5b5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://antprimary.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-2-v016-0cb3b8942.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: Srvh/HYDT5c=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://antprimary.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 469
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: LinkedIn (Social Network)

30 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

11 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.linkedin.com/	1970-01-19 21:08:43	Name: lidc Value: "b=OGST06:s=O:r=O:a=O:p=O:g=2203:u=1:x=1:i=1631237184:t=1631323584:v=2:sig=AQGKJf5jqnzweUcxbcwpgAk_DgG4qPYr"
.google.com/	1970-01-20 01:30:48	Name: NID Value: 223=aTwiep20_AfHZ6kOLWuHO7_vGhpVo1xyP683DnLCNu9J6Oh0ANMf4Q5CdmY9tgYS4S38b4fAoZ5-uWWfXvpjH1QFE2sewMGWL_2vuZF_a79DGsNacDuMPvyCtxFYwI-qz7xAuZ4tx_1wyPkmX2OmLmWDECQWHVqej5r612VE_KM
.www.linkedin-ei.com/	1969-12-31 23:59:59	Name: JSESSIONID Value: ajax:8793806812446667579
.linkedin-ei.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=de-de
.linkedin-ei.com/	1970-01-20 14:39:11	Name: bcookie Value: "v=2&65e11ac8-0b01-4281-896a-bafb3e07be12"
.www.linkedin-ei.com/	1970-01-20 14:39:11	Name: bscookie Value: "v=1&2021091001262615080feb-6fc6-4c49-87f4-014874181612AQF76A-pD3XypFdeXfITZwZoHf_ctaR3"
.linkedin-ei.com/	1970-01-19 21:08:43	Name: lidc Value: "b=ETGST05:s=ET:r=ET:a=ET:p=ET:g=72:u=1:x=1:i=1631237186:t=1631323586:v=2:sig=AQFqECHJqVaB_qSfM0KUyL2vrF6M3j37"
.demdex.net/	1970-01-20 01:26:29	Name: demdex Value: 16850130419353696172124659998230394211
.antprimary.com/	1969-12-31 23:59:59	Name: AMCVS_14215E3D5995C57C0A495C55%40AdobeOrg Value: 1
.antprimary.com/	1970-01-20 01:26:29	Name: AMCV_14215E3D5995C57C0A495C55%40AdobeOrg Value: -637568504%7CMCIDTS%7C18881%7CMCMID%7C17061444378663133062140160068743841448%7CMCAAMLH-1631841987%7C6%7CMCAAMB-1631841987%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1631244387s%7CNONE%7CvVersion%7C5.1.1
.antprimary.com/	1970-01-19 21:50:29	Name: aam_uuid Value: 16850130419353696172124659998230394211

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://lnkd.demdex.net/dest5.html?d_nsid=0(Line 12) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.linkedin.com') does not match the recipient window's origin ('https://antprimary.com').
deprecation	warning	URL: https://static-exp1.licdn.com/sc/h/6jblk5oqhlo45xbkmcr7s4zix Message: RTP data channels are no longer supported. The "RtpDataChannels" constraint is currently ignored, and may cause an error at a later date.
network	error	URL: https://accounts.google.com/gsi/status?client_id=990339570472-k6nqn1tpmitg8pui82bfaun3jrpmiuhs.apps.googleusercontent.com&as=Lo%2BUOf3FzBIdVxII%2BnjpPw Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://antprimary.com/li/track Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://antprimary.com/li/track Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

accounts.google.com
antprimary.com
dpm.demdex.net
lnkd.demdex.net
platform.linkedin-ei.com
platform.linkedin.com
static-exp1.licdn.com
www.linkedin-ei.com
162.241.149.153
2620:1ec:21::16
2a00:1450:400a:808::200d
2a02:26f0:2b00:5::5c7a:3242
2a02:26f0:3000::170a:f909
2a02:26f0:3000::170a:f923
52.208.28.104
54.247.138.82
190472cc8b749d317cc6d4c27a5022d250df931fb04507c307ef640a452200da
2072637eca86b31333f03dd2f363993776d87ec85be0f0970d80a08347cbe43f
2bcca5003dde9197922f96cf949f3bb2760bf26a86ab5ed6263fe816aaba8578
413dcac687347fda31020577d90102126ed5bd03b783596da7648334a19f15d1
46e942b88cc1d5cfed96a384d7fa8dff33961f24400536c265992f6d7d8c0684
5af2dfee0b7dd68e56ad1e1c5f6818f6812f484d39d4495d60a6666fd0c057fb
6632763e797e0e05588d82fcb2d74f83b482c155cd9a700e70826215c0e2a51a
704c03388d696028b43d5a1c5d4b4b7d6de3305ab5da61f507e552595544b0c0
7110daa4bb9b8cc37d21a49acecd4a4e7f62f41d45eb2b8be7f0fe9ea8507234
76d35616ac46fdb775fa2179763e28f6e103849831977ed1f11a20be1c3a78b2
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
88cdaea60c904ce69cfdd8dc52d4c9ea43108bbadae3673878d1afe2595609c4
962d24fdaffaabc712ef425e30b013455416f8d14ddb5166482d04c89421e25d
962ed56caab62577586066983265570a754f377e61740e0b5bc77dbb15a2a266
bee2e57a9e38d73bdd6fa4ee6ee3f212c203986cfff8872d13d5aee53b36c5b5
cd776aa311400c90accd07b01cf79a23278d85d536ecccd66b895586be32c23d
d25766a048ff80ed49cf7e345dabe00879b6143868f4499fccdab441302acc3a
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
d9a2efb86be0801c3d1a97d0b5a125053fdbc40c9540ebeac182e0f46dbf3261

antprimary.com Open in urlscan Pro 162.241.149.153 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

20 Requests

100 %HTTPS

63 %IPv6

6 Domains

8 Subdomains

8 IPs

4 Countries

316 kBTransfer

1108 kBSize

11 Cookies

0 Outgoing links

Page URL History

Redirected requests

20 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

30 JavaScript Global Variables

11 Cookies

5 Console Messages

Indicators

antprimary.com Open in urlscan Pro
162.241.149.153 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

20
Requests

100 %
HTTPS

63 %
IPv6

6
Domains

8
Subdomains

8
IPs

4
Countries

316 kB
Transfer

1108 kB
Size

11
Cookies

20 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!