etoll.s-linkt.info
Open in
urlscan Pro
104.21.64.149
Malicious Activity!
Public Scan
Effective URL: https://etoll.s-linkt.info/
Submission: On May 19 via manual from AU — Scanned from AU
Summary
TLS certificate: Issued by GTS CA 2P2 on May 18th 2023. Valid for: 3 months.
This is the only time etoll.s-linkt.info was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Linkt (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 54.209.205.77 54.209.205.77 | 14618 (AMAZON-AES) (AMAZON-AES) | |
11 | 104.21.64.149 104.21.64.149 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 172.253.118.95 172.253.118.95 | 15169 (GOOGLE) (GOOGLE) | |
3 | 45.60.48.24 45.60.48.24 | 19551 (INCAPSULA) (INCAPSULA) | |
1 | 74.125.68.94 74.125.68.94 | 15169 (GOOGLE) (GOOGLE) | |
16 | 4 |
ASN14618 (AMAZON-AES, US)
PTR: ec2-54-209-205-77.compute-1.amazonaws.com
rebrand.ly |
ASN15169 (GOOGLE, US)
PTR: sl-in-f95.1e100.net
fonts.googleapis.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
s-linkt.info
etoll.s-linkt.info |
366 KB |
3 |
linkt.com.au
manage.linkt.com.au |
|
1 |
gstatic.com
fonts.gstatic.com |
48 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 35 |
1 KB |
1 |
rebrand.ly
1 redirects
rebrand.ly — Cisco Umbrella Rank: 51593 |
166 B |
16 | 5 |
Domain | Requested by | |
---|---|---|
11 | etoll.s-linkt.info |
etoll.s-linkt.info
|
3 | manage.linkt.com.au |
etoll.s-linkt.info
|
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | fonts.googleapis.com |
etoll.s-linkt.info
|
1 | rebrand.ly | 1 redirects |
16 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
s-linkt.info GTS CA 2P2 |
2023-05-18 - 2023-08-16 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-04-24 - 2023-07-17 |
3 months | crt.sh |
MANAGE.CITYLINK.COM.AU Thawte RSA CA 2018 |
2022-09-28 - 2023-09-29 |
a year | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-04-24 - 2023-07-17 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://etoll.s-linkt.info/
Frame ID: D5FF49F03156825F5A10AD9FC06DECB0
Requests: 16 HTTP requests in this frame
Screenshot
Page Title
linktPage URL History Show full URLs
-
https://rebrand.ly/aig4cm9
HTTP 301
https://etoll.s-linkt.info/ Page URL
Detected technologies
Element UI (JavaScript Frameworks) ExpandDetected patterns
- <(?:div|button) class="el-(?:table-column|table-filter|popper|pagination|pager|select-group|form|form-item|color-predefine|color-hue-slider|color-svpanel|color-alpha-slider|color-dropdown|color-picker|badge|tree|tree-node|select|message|dialog|checkbox|checkbox-button|checkbox-group|container|steps|carousel|menu|menu-item|submenu|menu-item-group|button|button-group|card|table|select-dropdown|row|tabs|notification|radio|progress|progress-bar|tag|popover|tooltip|cascader|cascader-menus|cascader-menu|time-spinner|spinner|spinner-inner|transfer|transfer-panel|rate|slider|dropdown|dropdown-menu|textarea|input|input-group|popup-parent|radio-group|main|breadcrumb|time-range-picker|date-range-picker|year-table|date-editor|range-editor|time-spinner|date-picker|time-panel|date-table|month-table|picker-panel|collapse|collapse-item|alert|select-dropdown|select-dropdown__empty|select-dropdown__wrap|select-dropdown__list|scrollbar|switch|carousel|upload|upload-dragger|upload-list|upload-cover|aside|input-number|header|message-box|footer|radio-button|step|autocomplete|autocomplete-suggestion|loading-parent|loading-mask|loading-spinner|)
Vue.js (JavaScript Frameworks) Expand
Detected patterns
- <[^>]+\sdata-v(?:ue)?-
Google Font API (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://rebrand.ly/aig4cm9
HTTP 301
https://etoll.s-linkt.info/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
16 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
etoll.s-linkt.info/ Redirect Chain
|
828 B 865 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
5 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
config.js
etoll.s-linkt.info/ |
60 B 448 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
chunk-vendors.5f41e082.js
etoll.s-linkt.info/js/ |
959 KB 258 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.b3295e96.js
etoll.s-linkt.info/js/ |
13 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
chunk-vendors.2b35c01c.css
etoll.s-linkt.info/css/ |
206 KB 35 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.a8c9b542.css
etoll.s-linkt.info/css/ |
57 KB 11 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
visits
etoll.s-linkt.info/api/num/record/ |
41 B 372 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
user
etoll.s-linkt.info/api/card/websocket-domain/ |
121 B 501 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
linkt_logo.93d970a4.svg
etoll.s-linkt.info/img/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo-Transurban.cc5a7e14.png
etoll.s-linkt.info/img/ |
25 KB 26 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon-twitter.png
manage.linkt.com.au/retailweb/resources/retailer/linkt/img/icons/ |
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
facebook-icon.png
manage.linkt.com.au/retailweb/resources/retailer/linkt/img/icons/ |
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon-youtube.png
manage.linkt.com.au/retailweb/resources/retailer/linkt/img/icons/ |
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
element-icons.ff18efd1.woff
etoll.s-linkt.info/fonts/ |
28 KB 28 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v35/ |
47 KB 48 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Linkt (Transportation)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| webpackChunklinkt function| clearImmediate function| setImmediate function| _ object| $cookies6 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
etoll.s-linkt.info/api | Name: JSESSIONID Value: 1ADDFF1E5FBA9392AE31A0CD5F8D4A6C |
|
etoll.s-linkt.info/ | Name: domainName Value: wss%3A%2F%2Feeee.tolllinkt.online%2Fapi%2Fapprove%2F |
|
.linkt.com.au/ | Name: visid_incap_1644040 Value: gYSzg2K6T1Oti1UYj641N/uMZ2QAAAAAQUIPAAAAAADFs3ER2egbOSILkE3awaUD |
|
.linkt.com.au/ | Name: nlbi_1644040 Value: 3sBEZXsshUr+LYrl4XKpuwAAAABF52OlFFXrus3HGfx123yu |
|
.linkt.com.au/ | Name: incap_ses_404_1644040 Value: nsLMRtWmkXbgxMTx4E2bBfuMZ2QAAAAAvmda5y4qdbY3Y/1lerFEwQ== |
|
etoll.s-linkt.info/ | Name: userIp Value: 66.203.112.160 |
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
etoll.s-linkt.info
fonts.googleapis.com
fonts.gstatic.com
manage.linkt.com.au
rebrand.ly
104.21.64.149
172.253.118.95
45.60.48.24
54.209.205.77
74.125.68.94
0853aaa2d688c7126e27018d557e1ba07d11e1f5f45f1d0c318412006aa8fab8
1d26fb4550d79ddd00ed695c52e9f888abac94e0d3bc3ed161dffbe8b07d9bdb
34137cfbfe59a3b697f9394aaf0fca934b6a2e773473d7af57b53e9b37285e66
39f39b80a59f7656580f8cc2f037ed54a49a6415e03cbdb2a09584be63241330
54017c4e61a196d03954eb816f579cede10afb16ccb2e50bbc12c3737345e65b
7027e4afb19e78a2c7cf7ae2df5bd4d743e06deccefd4043ea7e4220a4b1bb32
785b3c6cc775a90a0c69c4ca9228dce8d19e91fdbea991ce3ed438f3e77e38c2
7c7818c25a18e8a38553fcbcbc2ad0b5e964103a7d2e494f82815e3f70bf3fc5
85cdaa21c8d06fc4322303a35cea7cd1acdfa9695ad1882598fd107cf3d17522
9fbfd27008b65331500624e892dc227171c779c24bfd257cbb4ac8e35de57d75
ab40a58972be2ceab32e7e35dab3131b959aae63835d7bda1a79ae51f9a73c17
b6c8d196e7ba5d78fe49e3c40cfa146f549f0edba08455f4fe3de75a79f94995
d5661d91e8d56409f4525f8f58265c356c204e9fde3eda57a61d1a8594483bc1
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855