urlscan.io logo urlscan.io
SecurityTrails logo

deck-shared-2023.us-ord-1.linodeobjects.com Open in urlscan Pro
172.232.0.221  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://trk.klclick3.com/ls/click?upn=Vtrs3xURK-2Bc2pVdHID18VKKbomEjEOcNsWZOBESTe-2FjnB-2FOlBwSr-2Bvm8KVYGZRqs4fOi8eNkM5P...
Effective URL: https://deck-shared-2023.us-ord-1.linodeobjects.com/DecGrace.html
Submission: On December 06 via api from AU — Scanned from AU
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 3 HTTP transactions. The main IP is 172.232.0.221, located in Chicago, United States and belongs to AKAMAI-LINODE-AP Akamai Connected Cloud, SG. The main domain is deck-shared-2023.us-ord-1.linodeobjects.com.
TLS certificate: Issued by R3 on October 2nd 2023. Valid for: 3 months.
This is the only time deck-shared-2023.us-ord-1.linodeobjects.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 1 18.67.93.108 16509 (AMAZON-02)
1 2 103.253.43.4 133398 (TELE-AS T...)
1 172.232.0.221 63949 (AKAMAI-LI...)
1 212.70.149.197 12615 (GCN-AS GC...)
3 4
Domain Requested by
2 apiservi.bilalsmedicare.com 1 redirects
1 ruthowlevtui.officialcountdown9.com deck-shared-2023.us-ord-1.linodeobjects.com
1 deck-shared-2023.us-ord-1.linodeobjects.com
1 trk.klclick3.com 1 redirects
3 4

This site contains no links.

Subject Issuer Validity Valid
*.apiservi.bilalsmedicare.com
R3		 2023-11-21 -
2024-02-19		 3 months crt.sh
us-ord-1.linodeobjects.com
R3		 2023-10-02 -
2023-12-31		 3 months crt.sh
officialcountdown9.com
R3		 2023-12-06 -
2024-03-05		 3 months crt.sh

This page contains 2 frames:

Primary Page: https://deck-shared-2023.us-ord-1.linodeobjects.com/DecGrace.html
Frame ID: 88BFCE5602D5B2926F08F848F2C4BDC5
Requests: 2 HTTP requests in this frame

Frame: https://ruthowlevtui.officialcountdown9.com/?8Y6v=ojK
Frame ID: A8B46C292A982DCFC5AD208016FDCC29
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://trk.klclick3.com/ls/click?upn=Vtrs3xURK-2Bc2pVdHID18VKKbomEjEOcNsWZOBESTe-2FjnB-2FOlBwSr-2Bvm... HTTP 302
    https://apiservi.bilalsmedicare.com/tr/cl/CVHCLss3KYb9H1dtk3RQgpKgSx37AkrbuUyBOQpTlW-t8C19TXNwB_BkV_tfyYyh-us9Bb... Page URL
  2. https://apiservi.bilalsmedicare.com/index.php?continue2 HTTP 302
    https://deck-shared-2023.us-ord-1.linodeobjects.com/DecGrace.html Page URL

Page Statistics

3
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

298 kB
Transfer

531 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://trk.klclick3.com/ls/click?upn=Vtrs3xURK-2Bc2pVdHID18VKKbomEjEOcNsWZOBESTe-2FjnB-2FOlBwSr-2Bvm8KVYGZRqs4fOi8eNkM5P0-2Bna5P5YERuZ6fAzSIaBwS8DebmpoHozV78Ev1VbXExe12E-2B1enmAP8ZUDpl2UTFUkv8ZJ-2BMDTZ-2F2wewtBlsd4eUgcmsXbPsmr49XObahgcvrNXr5kmrwL-2FhjgZk1NIICubQOxofx7vFTMVXiQbawhGQLoeEp-2FVjrDI9PlctocFiVQIRRhCw0mVewJG0fXIz10c01MQ1ONk-2BeYcFdMlY4zQ9XJ2nRoVvkXGeTFZug8vmC2KiYrWpePNTVf4-2BBWzWuv3FbjF0YxxTgJY2XevaTSyFSPiuq3iQSxyrf92CE7FgeqGzzSziy7GLFR9Ys41m0Qy1OJeicASHmNFAQ-2BZXcRSYayBDVmZzoJwcr9xSjtoop523p-2B5dLiXBbw-2BI-2BAx91RLj-2B6g6kWXiBX4dZ7VLpB5sIsP2fUmsNhtfMGxvJCY-2BRD8IRj8AOgXnlZOA-2B7Ov9DSL-2BQ8KJyz5pNrAJS-2FCamm4wJHhtWxlfWJoBH79yiAapZw-2Fa7HlOq7LW_-2FtrkJYtssUveXERYVbGgKpodoStjimyExhfM3ejAfzuVlFsd2sMyrjZ3RyQMoa-2BVsLNT-2FwykvHuxKNblO8W3QWQoCqwrbwiWsJjSeTiFhRAxR3pbmUH0Kc3X8jIrozMI4JsufamuW8BGQnteEeDGxnua3psVHcEYMheycP6-2FLt6IbX4l31tGoj1bS1D7Q-2BjveTvr-2FdOqCtql8yL4JBKFdHf5zKMeUbfuku1gMF4BuDc8-2Bw8DY0XHH-2FYS0Txxn-2B1xhkKGpY-2Fcg561qqFhDV1hoXNvGr1wDMMNLoTfrpC64NE-2FTne0UULKKErvS3GI4P1r-2FJckJOequKpxvTFLBOo88DR1-2FL0RYISJJKSlmQKn6o1RlWiTTOxt6RXYBRgEM2MQX8BTo7zhfoo9hYgAysrJBJbIREFChbpR2uvEwiXsGdnE855Aa31HiEKo-2Fh31qpuSpYv1kWi331qDDSQRxyZVew-3D-3D HTTP 302
    https://apiservi.bilalsmedicare.com/tr/cl/CVHCLss3KYb9H1dtk3RQgpKgSx37AkrbuUyBOQpTlW-t8C19TXNwB_BkV_tfyYyh-us9BbP1M038WkndZEobLMueqVySvSW7daMuOq_gn_QAIKiRBUSpy89YlfZwPEul8DFi5nUBqvFRQTITTF9Yd2hM7PR0COCI-p87XsFVa41ffLfN3lnUoYbjeSueWyvyJ8D09CBsn_6w96Dm6-omqg9eRF-8B3LID_0puG1WVmGPyKnamJF4aJdmrRrQJPP9GOrsid2YSkRK35C4L_fBIUf8MmGMkKhLcni4aYCyDtYLqg?_kx=sbKHk0ytyVYuK9F1mbg1TV31tG-1xcPhEYpUGotKvMfUvHQ93dGHSQyXBYrr1aH7.RPSYU6 Page URL
  2. https://apiservi.bilalsmedicare.com/index.php?continue2 HTTP 302
    https://deck-shared-2023.us-ord-1.linodeobjects.com/DecGrace.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://trk.klclick3.com/ls/click?upn=Vtrs3xURK-2Bc2pVdHID18VKKbomEjEOcNsWZOBESTe-2FjnB-2FOlBwSr-2Bvm8KVYGZRqs4fOi8eNkM5P0-2Bna5P5YERuZ6fAzSIaBwS8DebmpoHozV78Ev1VbXExe12E-2B1enmAP8ZUDpl2UTFUkv8ZJ-2BMDTZ-2F2wewtBlsd4eUgcmsXbPsmr49XObahgcvrNXr5kmrwL-2FhjgZk1NIICubQOxofx7vFTMVXiQbawhGQLoeEp-2FVjrDI9PlctocFiVQIRRhCw0mVewJG0fXIz10c01MQ1ONk-2BeYcFdMlY4zQ9XJ2nRoVvkXGeTFZug8vmC2KiYrWpePNTVf4-2BBWzWuv3FbjF0YxxTgJY2XevaTSyFSPiuq3iQSxyrf92CE7FgeqGzzSziy7GLFR9Ys41m0Qy1OJeicASHmNFAQ-2BZXcRSYayBDVmZzoJwcr9xSjtoop523p-2B5dLiXBbw-2BI-2BAx91RLj-2B6g6kWXiBX4dZ7VLpB5sIsP2fUmsNhtfMGxvJCY-2BRD8IRj8AOgXnlZOA-2B7Ov9DSL-2BQ8KJyz5pNrAJS-2FCamm4wJHhtWxlfWJoBH79yiAapZw-2Fa7HlOq7LW_-2FtrkJYtssUveXERYVbGgKpodoStjimyExhfM3ejAfzuVlFsd2sMyrjZ3RyQMoa-2BVsLNT-2FwykvHuxKNblO8W3QWQoCqwrbwiWsJjSeTiFhRAxR3pbmUH0Kc3X8jIrozMI4JsufamuW8BGQnteEeDGxnua3psVHcEYMheycP6-2FLt6IbX4l31tGoj1bS1D7Q-2BjveTvr-2FdOqCtql8yL4JBKFdHf5zKMeUbfuku1gMF4BuDc8-2Bw8DY0XHH-2FYS0Txxn-2B1xhkKGpY-2Fcg561qqFhDV1hoXNvGr1wDMMNLoTfrpC64NE-2FTne0UULKKErvS3GI4P1r-2FJckJOequKpxvTFLBOo88DR1-2FL0RYISJJKSlmQKn6o1RlWiTTOxt6RXYBRgEM2MQX8BTo7zhfoo9hYgAysrJBJbIREFChbpR2uvEwiXsGdnE855Aa31HiEKo-2Fh31qpuSpYv1kWi331qDDSQRxyZVew-3D-3D HTTP 302
  • https://apiservi.bilalsmedicare.com/tr/cl/CVHCLss3KYb9H1dtk3RQgpKgSx37AkrbuUyBOQpTlW-t8C19TXNwB_BkV_tfyYyh-us9BbP1M038WkndZEobLMueqVySvSW7daMuOq_gn_QAIKiRBUSpy89YlfZwPEul8DFi5nUBqvFRQTITTF9Yd2hM7PR0COCI-p87XsFVa41ffLfN3lnUoYbjeSueWyvyJ8D09CBsn_6w96Dm6-omqg9eRF-8B3LID_0puG1WVmGPyKnamJF4aJdmrRrQJPP9GOrsid2YSkRK35C4L_fBIUf8MmGMkKhLcni4aYCyDtYLqg?_kx=sbKHk0ytyVYuK9F1mbg1TV31tG-1xcPhEYpUGotKvMfUvHQ93dGHSQyXBYrr1aH7.RPSYU6

3 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
CVHCLss3KYb9H1dtk3RQgpKgSx37AkrbuUyBOQpTlW-t8C19TXNwB_BkV_tfyYyh-us9BbP1M038WkndZEobLMueqVySvSW7daMuOq_gn_QAIKiRBUSpy89YlfZwPEul8DFi5nUBqvFRQTITTF9Yd2hM7PR0COCI-p87XsFVa41ffLfN3lnUoYbjeSueWyvyJ8D09...
apiservi.bilalsmedicare.com/tr/cl/
Redirect Chain
  • https://trk.klclick3.com/ls/click?upn=Vtrs3xURK-2Bc2pVdHID18VKKbomEjEOcNsWZOBESTe-2FjnB-2FOlBwSr-2Bvm8KVYGZRqs4fOi8eNkM5P0-2Bna5P5YERuZ6fAzSIaBwS8DebmpoHozV78Ev1VbXExe12E-2B1enmAP8ZUDpl2UTFUkv8ZJ-2...
  • https://apiservi.bilalsmedicare.com/tr/cl/CVHCLss3KYb9H1dtk3RQgpKgSx37AkrbuUyBOQpTlW-t8C19TXNwB_BkV_tfyYyh-us9BbP1M038WkndZEobLMueqVySvSW7daMuOq_gn_QAIKiRBUSpy89YlfZwPEul8DFi5nUBqvFRQTITTF9Yd2hM7PR...
1 KB
678 B 		Document
General
Check archive.org
Download Go to
Full URL
https://apiservi.bilalsmedicare.com/tr/cl/CVHCLss3KYb9H1dtk3RQgpKgSx37AkrbuUyBOQpTlW-t8C19TXNwB_BkV_tfyYyh-us9BbP1M038WkndZEobLMueqVySvSW7daMuOq_gn_QAIKiRBUSpy89YlfZwPEul8DFi5nUBqvFRQTITTF9Yd2hM7PR0COCI-p87XsFVa41ffLfN3lnUoYbjeSueWyvyJ8D09CBsn_6w96Dm6-omqg9eRF-8B3LID_0puG1WVmGPyKnamJF4aJdmrRrQJPP9GOrsid2YSkRK35C4L_fBIUf8MmGMkKhLcni4aYCyDtYLqg?_kx=sbKHk0ytyVYuK9F1mbg1TV31tG-1xcPhEYpUGotKvMfUvHQ93dGHSQyXBYrr1aH7.RPSYU6
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.253.43.4 , Hong Kong, ASN133398 (TELE-AS Tele Asia Limited, HK),
Reverse DNS
slot9.ge-re.com
Software
Apache /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-AU,en;q=0.9

Response headers

content-encoding
gzip
content-length
581
content-type
text/html; charset=UTF-8
date
Wed, 06 Dec 2023 18:26:23 GMT
server
Apache
vary
Accept-Encoding

Redirect headers

content-length
443
content-type
text/html; charset=utf-8
date
Wed, 06 Dec 2023 18:26:22 GMT
location
https://apiservi.bilalsmedicare.com/tr/cl/CVHCLss3KYb9H1dtk3RQgpKgSx37AkrbuUyBOQpTlW-t8C19TXNwB_BkV_tfyYyh-us9BbP1M038WkndZEobLMueqVySvSW7daMuOq_gn_QAIKiRBUSpy89YlfZwPEul8DFi5nUBqvFRQTITTF9Yd2hM7PR0COCI-p87XsFVa41ffLfN3lnUoYbjeSueWyvyJ8D09CBsn_6w96Dm6-omqg9eRF-8B3LID_0puG1WVmGPyKnamJF4aJdmrRrQJPP9GOrsid2YSkRK35C4L_fBIUf8MmGMkKhLcni4aYCyDtYLqg?_kx=sbKHk0ytyVYuK9F1mbg1TV31tG-1xcPhEYpUGotKvMfUvHQ93dGHSQyXBYrr1aH7.RPSYU6
server
nginx
via
1.1 4279a60193243ca3cf62feedc7fe581e.cloudfront.net (CloudFront)
x-amz-cf-id
rksqslh65YICHo9l1x3jioQOEqvd9SwbGYXaK-ADTA2slGHn6fbu6A==
x-amz-cf-pop
SYD62-P1
x-cache
Miss from cloudfront
x-robots-tag
noindex, nofollow
Primary Request DecGrace.html
deck-shared-2023.us-ord-1.linodeobjects.com/
Redirect Chain
  • https://apiservi.bilalsmedicare.com/index.php?continue2
  • https://deck-shared-2023.us-ord-1.linodeobjects.com/DecGrace.html
166 KB
166 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://deck-shared-2023.us-ord-1.linodeobjects.com/DecGrace.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
172.232.0.221 Chicago, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS
osproxy-1.ord2.us.prod.linode.com
Software
/
Resource Hash
4ded796f8719ca509cebe2f051ccef7ea35cd0b50efd4f7a90840696909768b4

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://apiservi.bilalsmedicare.com
Referer
https://apiservi.bilalsmedicare.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-AU,en;q=0.9

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Length
170036
Content-Type
text/html
Date
Wed, 06 Dec 2023 18:26:25 GMT
ETag
"e2d6610a57b4d64a69ed28273355cd16"
Last-Modified
Wed, 06 Dec 2023 16:09:01 GMT
x-amz-request-id
tx00000d75cfff457df8792-006570bcd1-785687-default
x-rgw-object-type
Normal

Redirect headers

content-encoding
gzip
content-length
581
content-type
text/html; charset=UTF-8
date
Wed, 06 Dec 2023 18:26:23 GMT
location
https://deck-shared-2023.us-ord-1.linodeobjects.com/DecGrace.html
server
Apache
vary
Accept-Encoding
/
ruthowlevtui.officialcountdown9.com/ Frame A8B4 		324 KB
131 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ruthowlevtui.officialcountdown9.com/?8Y6v=ojK
Requested by
Host: deck-shared-2023.us-ord-1.linodeobjects.com
URL: https://deck-shared-2023.us-ord-1.linodeobjects.com/DecGrace.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
212.70.149.197 , Bulgaria, ASN12615 (GCN-AS GCN AD - Sofia, Bulgaria, BG),
Reverse DNS
Software
nginx /
Resource Hash
17ef9154fb173a6416950b617e53dca833cf713dad597f4d7e3ce8351af71248

Request headers

Referer
https://deck-shared-2023.us-ord-1.linodeobjects.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-AU,en;q=0.9

Response headers

content-encoding
gzip
content-type
text/html; charset=utf-8
date
Wed, 06 Dec 2023 18:26:27 GMT
server
nginx
vary
Accept-Encoding
truncated
/ Frame A8B4 		858 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
19b8ee66ab60c45d5d24988d090b61c938b44c2ee9a5f8558335b27a2f315072

Request headers

accept-language
en-AU,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/ Frame A8B4 		40 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
64c2019b369b4f3b45009d1740f4c7ae0856bb2608aea7d7628b78f43cecb3fa

Request headers

accept-language
en-AU,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| documentPictureInPicture function| a0_0x375d function| a0_0xe541

0 Cookies