antprimary.com Open in urlscan Pro
162.241.149.153 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://antprimary.com/linkedin/
Submission: On September 10 via manual (September 10th 2021, 11:16:30 pm UTC) from US — Scanned from DE

Summary HTTP 18 Redirects Behaviour Indicators

Summary

This website contacted 7 IPs in 3 countries across 6 domains to perform 18 HTTP transactions. The main IP is 162.241.149.153, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is antprimary.com.

This is the only time antprimary.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: LinkedIn (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
1 3	162.241.149.153 162.241.149.153	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
7	2606:2800:233... 2606:2800:233:6a53:4ac1:3bc8:ee4e:5990	15133 (EDGECAST) (EDGECAST)
4	2606:2800:233... 2606:2800:233:66b5:799a:7cd3:f74d:7071	15133 (EDGECAST) (EDGECAST)
1	18.203.8.109 18.203.8.109	16509 (AMAZON-02) (AMAZON-02)
1	2620:1ec:21::16 2620:1ec:21::16	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2a02:26f0:d9:... 2a02:26f0:d9::58dd:3042	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
18	7

3 162.241.149.153 (United States) 1 redirects

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 162-241-149-153.unifiedlayer.com

antprimary.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2606:2800:233:6a53:4ac1:3bc8:ee4e:5990 (United States)

ASN15133 (EDGECAST, US)

static-exp1.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:2800:233:66b5:799a:7cd3:f74d:7071 (United States)

ASN15133 (EDGECAST, US)

platform.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.203.8.109 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-203-8-109.eu-west-1.compute.amazonaws.com

lnkd.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::16 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.linkedin-ei.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:d9::58dd:3042 (London, United Kingdom)

ASN20940 (AKAMAI-ASN1, NL)

platform.linkedin-ei.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	licdn.com static-exp1.licdn.com	168 KB
4	linkedin.com platform.linkedin.com	51 KB
3	antprimary.com 1 redirects antprimary.com	42 KB
2	linkedin-ei.com www.linkedin-ei.com platform.linkedin-ei.com	44 KB
1	demdex.net lnkd.demdex.net dpm.demdex.net Failed	3 KB
0	google.com Failed accounts.google.com Failed
18	6

	Domain	Requested by
7	static-exp1.licdn.com	antprimary.com
4	platform.linkedin.com	antprimary.com
3	antprimary.com	1 redirects static-exp1.licdn.com
1	platform.linkedin-ei.com	static-exp1.licdn.com
1	www.linkedin-ei.com	static-exp1.licdn.com
1	lnkd.demdex.net	antprimary.com
0	accounts.google.com Failed
0	dpm.demdex.net Failed	platform.linkedin-ei.com
18	8

This site contains no links.

Subject Issuer	Validity	Valid
*.licdn.com DigiCert SHA2 Secure Server CA	`2019-10-10` - `2021-10-14`	2 years	crt.sh
platform.linkedin.com DigiCert SHA2 Secure Server CA	`2019-10-10` - `2021-10-14`	2 years	crt.sh
*.demdex.net DigiCert TLS RSA SHA256 2020 CA1	`2020-12-02` - `2022-01-02`	a year	crt.sh
www.linkedin-ei.com DigiCert SHA2 Secure Server CA	`2021-04-30` - `2021-10-30`	6 months	crt.sh

This page contains 2 frames:

Primary Page: http://antprimary.com/linkedin/
Frame ID: 419F717E3ADEF06A70512BECA1EFF5E1
Requests: 17 HTTP requests in this frame

Frame: https://lnkd.demdex.net/dest5.html?d_nsid=0
Frame ID: 53633FD465CFE93EDC6C93A69B04CF05
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

LinkedIn Login, Sign in | LinkedIn

Page URL History Show full URLs

http://antprimary.com/linkedin HTTP 301
http://antprimary.com/linkedin/ Page URL

Page Statistics

18
Requests

61 %
HTTPS

67 %
IPv6

6
Domains

8
Subdomains

7
IPs

3
Countries

309 kB
Transfer

1107 kB
Size

7
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://antprimary.com/linkedin HTTP 301
http://antprimary.com/linkedin/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
antprimary.com/linkedin/
Redirect Chain

http://antprimary.com/linkedin
http://antprimary.com/linkedin/

41 KB
42 KB

134ms
134ms

Document
text/html

162.241.149.153
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: http://antprimary.com/linkedin/
Protocol: HTTP/1.1
Server: 162.241.149.153 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 162-241-149-153.unifiedlayer.com
Software: Apache /
Resource Hash: 46e942b88cc1d5cfed96a384d7fa8dff33961f24400536c265992f6d7d8c0684

Request headers

Host: antprimary.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

Date: Fri, 10 Sep 2021 23:16:13 GMT
Server: Apache
Last-Modified: Thu, 09 Sep 2021 20:53:26 GMT
Accept-Ranges: bytes
Content-Length: 42262
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html

Redirect headers

Date: Fri, 10 Sep 2021 23:16:13 GMT
Server: Apache
Location: http://antprimary.com/linkedin/
Content-Length: 239
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

GET
H2 200 b65e8ovcinye0pcd3qs7rus9u Show response
static-exp1.licdn.com/sc/h/ 155 KB
38 KB 5063ms
20ms Script
text/javascript 2606:2800:233:6a53:4ac1:3bc8:ee4e:5990
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://static-exp1.licdn.com/sc/h/b65e8ovcinye0pcd3qs7rus9u
Requested by: Host: antprimary.com
URL: http://antprimary.com/linkedin/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:6a53:4ac1:3bc8:ee4e:5990 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8E8A) /
Resource Hash: d25766a048ff80ed49cf7e345dabe00879b6143868f4499fccdab441302acc3a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://antprimary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 10 Sep 2021 23:16:20 GMT
content-encoding: br
content-type: text/javascript
x-cdn-client-ip-version: IPV6
x-cdn: ECST
age: 756312
x-cache: HIT
x-cdn-proto: HTTP2
content-length: 39238
x-li-uuid: xidBfzLpoBagT04j6ioAAA==
server: ECAcc (frc/8E8A)
timing-allow-origin: *
last-modified: Mon, 05 Nov 2012 04:00:51 GMT
x-li-pop: prod-edc2
cache-control: max-age=31536000, immutable
vary: Accept-Encoding
x-li-fabric: prod-ltx1
access-control-allow-origin: *
access-control-expose-headers: X-CDN, X-CDN-CLIENT-IP-VERSION, X-CDN-Proto
x-li-proto: http/1.1
accept-ranges: bytes
x-li-static-content: 1
x-fs-uuid: c627417f32e9a016a04f4e23ea2a0000
expires: Fri, 02 Sep 2022 05:11:08 GMT

GET
H2 200 9t0ibl3u6kzmm3xkauxilt140 Show response
static-exp1.licdn.com/sc/h/ 62 KB
18 KB 5075ms
33ms Script
text/javascript 2606:2800:233:6a53:4ac1:3bc8:ee4e:5990
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://static-exp1.licdn.com/sc/h/9t0ibl3u6kzmm3xkauxilt140
Requested by: Host: antprimary.com
URL: http://antprimary.com/linkedin/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:6a53:4ac1:3bc8:ee4e:5990 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8E92) /
Resource Hash: 7110daa4bb9b8cc37d21a49acecd4a4e7f62f41d45eb2b8be7f0fe9ea8507234

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://antprimary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 10 Sep 2021 23:16:20 GMT
content-encoding: br
content-type: text/javascript
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-cdn: ECST
age: 1265045
x-cache: HIT
x-cdn-proto: HTTP2
content-length: 18642
x-li-uuid: 1c34CoIanxaAdc5E7CoAAA==
server: ECAcc (frc/8E92)
timing-allow-origin: *
last-modified: Mon, 05 Nov 2012 04:00:51 GMT
x-li-pop: prod-eda6
cache-control: max-age=31536000, immutable
x-cdn-client-ip-version: IPV6
vary: Accept-Encoding
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-fabric: prod-ltx1
access-control-allow-origin: *
access-control-expose-headers: X-CDN, X-CDN-CLIENT-IP-VERSION, X-CDN-Proto
x-li-proto: http/1.1
accept-ranges: bytes
x-li-static-content: 1
x-fs-uuid: d5cdf80a821a9f168075ce44ec2a0000
expires: Sat, 27 Aug 2022 07:52:15 GMT

GET
H2 200 6jblk5oqhlo45xbkmcr7s4zix Show response
static-exp1.licdn.com/sc/h/ 64 KB
13 KB 5073ms
31ms Script
text/javascript 2606:2800:233:6a53:4ac1:3bc8:ee4e:5990
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://static-exp1.licdn.com/sc/h/6jblk5oqhlo45xbkmcr7s4zix
Requested by: Host: antprimary.com
URL: http://antprimary.com/linkedin/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:6a53:4ac1:3bc8:ee4e:5990 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8F28) /
Resource Hash: 2072637eca86b31333f03dd2f363993776d87ec85be0f0970d80a08347cbe43f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://antprimary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 10 Sep 2021 23:16:20 GMT
content-encoding: br
content-type: text/javascript
x-cdn-client-ip-version: IPV6
x-cdn: ECST
age: 2158012
x-cache: HIT
x-cdn-proto: HTTP2
content-length: 13554
x-li-uuid: q5SK2VvumxbQJm1LFCsAAA==
server: ECAcc (frc/8F28)
timing-allow-origin: *
last-modified: Mon, 05 Nov 2012 04:00:51 GMT
x-li-pop: prod-edc2
cache-control: max-age=31536000, immutable
vary: Accept-Encoding
x-li-fabric: prod-lva1
access-control-allow-origin: *
access-control-expose-headers: X-CDN, X-CDN-CLIENT-IP-VERSION, X-CDN-Proto
x-li-proto: http/1.1
accept-ranges: bytes
x-li-static-content: 1
x-fs-uuid: 0134c1cbdc868c16404c5e57572b0000
expires: Mon, 27 Jun 2022 19:24:08 GMT

GET
H2 200 48p0pumuvwn6gf14efb9gdp4v Show response
static-exp1.licdn.com/sc/h/ 2 KB
838 B 5059ms
17ms Script
text/javascript 2606:2800:233:6a53:4ac1:3bc8:ee4e:5990
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://static-exp1.licdn.com/sc/h/48p0pumuvwn6gf14efb9gdp4v
Requested by: Host: antprimary.com
URL: http://antprimary.com/linkedin/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:6a53:4ac1:3bc8:ee4e:5990 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8F10) /
Resource Hash: 5af2dfee0b7dd68e56ad1e1c5f6818f6812f484d39d4495d60a6666fd0c057fb

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://antprimary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 10 Sep 2021 23:16:20 GMT
content-encoding: br
content-type: text/javascript
x-cdn-client-ip-version: IPV6
x-cdn: ECST
age: 1265045
x-cache: HIT
x-cdn-proto: HTTP2
content-length: 683
x-li-uuid: CW5AC4IanxawX54iECsAAA==
server: ECAcc (frc/8F10)
timing-allow-origin: *
last-modified: Mon, 05 Nov 2012 04:00:51 GMT
x-li-pop: prod-eda6
cache-control: max-age=31536000, immutable
vary: Accept-Encoding
x-li-fabric: prod-ltx1
access-control-allow-origin: *
access-control-expose-headers: X-CDN, X-CDN-CLIENT-IP-VERSION, X-CDN-Proto
x-li-proto: http/1.1
accept-ranges: bytes
x-li-static-content: 1
x-fs-uuid: 096e400b821a9f16b05f9e22102b0000
expires: Sat, 27 Aug 2022 07:52:15 GMT

GET
H2 200 dux5pmry7fu9btbz2isdqym2q Show response
static-exp1.licdn.com/sc/h/ 67 KB
20 KB 5056ms
14ms Script
text/javascript 2606:2800:233:6a53:4ac1:3bc8:ee4e:5990
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://static-exp1.licdn.com/sc/h/dux5pmry7fu9btbz2isdqym2q
Requested by: Host: antprimary.com
URL: http://antprimary.com/linkedin/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:6a53:4ac1:3bc8:ee4e:5990 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8F77) /
Resource Hash: d9a2efb86be0801c3d1a97d0b5a125053fdbc40c9540ebeac182e0f46dbf3261

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://antprimary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 10 Sep 2021 23:16:20 GMT
content-encoding: br
content-type: text/javascript
x-cdn-client-ip-version: IPV6
x-cdn: ECST
age: 1265051
x-cache: HIT
x-cdn-proto: HTTP2
content-length: 19811
x-li-uuid: ttTAjIAanxZApoXOIysAAA==
server: ECAcc (frc/8F77)
timing-allow-origin: *
last-modified: Mon, 05 Nov 2012 04:00:51 GMT
x-li-pop: prod-edc2
cache-control: max-age=31536000, immutable
vary: Accept-Encoding
x-li-fabric: prod-lva1
access-control-allow-origin: *
access-control-expose-headers: X-CDN, X-CDN-CLIENT-IP-VERSION, X-CDN-Proto
x-li-proto: http/1.1
accept-ranges: bytes
x-li-static-content: 1
x-fs-uuid: b6d4c08c801a9f1640a685ce232b0000
expires: Sat, 27 Aug 2022 07:52:09 GMT

GET
H2 200 304mgi5j23vqo26trnz6auzve
static-exp1.licdn.com/sc/h/ 210 KB
19 KB 5074ms
32ms Stylesheet
text/css 2606:2800:233:6a53:4ac1:3bc8:ee4e:5990
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://static-exp1.licdn.com/sc/h/304mgi5j23vqo26trnz6auzve
Requested by: Host: antprimary.com
URL: http://antprimary.com/linkedin/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:6a53:4ac1:3bc8:ee4e:5990 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8F1B) /
Resource Hash: 2bcca5003dde9197922f96cf949f3bb2760bf26a86ab5ed6263fe816aaba8578

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://antprimary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 10 Sep 2021 23:16:20 GMT
content-encoding: br
content-type: text/css
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-cdn: ECST
age: 1264802
x-cache: HIT
x-cdn-proto: HTTP2
content-length: 19128
x-li-uuid: 7/iMhLoanxaw2i3alisAAA==
server: ECAcc (frc/8F1B)
timing-allow-origin: *
last-modified: Mon, 05 Nov 2012 04:00:51 GMT
x-li-pop: prod-edc2
cache-control: max-age=31536000, immutable
x-cdn-client-ip-version: IPV6
vary: Accept-Encoding
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-fabric: prod-lva1
access-control-allow-origin: *
access-control-expose-headers: X-CDN, X-CDN-CLIENT-IP-VERSION, X-CDN-Proto
x-li-proto: http/1.1
accept-ranges: bytes
x-li-static-content: 1
x-fs-uuid: eff88c84ba1a9f16b0da2dda962b0000
expires: Sat, 27 Aug 2022 07:56:18 GMT

GET
H2 200 8ddascte8uiyhhufy6qlnhw2b Show response
static-exp1.licdn.com/sc/h/ 218 KB
59 KB 5067ms
26ms Script
text/javascript 2606:2800:233:6a53:4ac1:3bc8:ee4e:5990
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://static-exp1.licdn.com/sc/h/8ddascte8uiyhhufy6qlnhw2b
Requested by: Host: antprimary.com
URL: http://antprimary.com/linkedin/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:6a53:4ac1:3bc8:ee4e:5990 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8FCC) /
Resource Hash: 190472cc8b749d317cc6d4c27a5022d250df931fb04507c307ef640a452200da

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://antprimary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 10 Sep 2021 23:16:20 GMT
content-encoding: br
content-type: text/javascript
x-cdn-client-ip-version: IPV6
x-cdn: ECST
age: 689202
x-cache: HIT
x-cdn-proto: HTTP2
content-length: 59843
x-li-uuid: xdxU3zsmoRYAbY4ylysAAA==
server: ECAcc (frc/8FCC)
timing-allow-origin: *
last-modified: Mon, 05 Nov 2012 04:00:51 GMT
x-li-pop: prod-eda6
cache-control: max-age=31536000, immutable
vary: Accept-Encoding
x-li-fabric: prod-ltx1
access-control-allow-origin: *
access-control-expose-headers: X-CDN, X-CDN-CLIENT-IP-VERSION, X-CDN-Proto
x-li-proto: http/1.1
accept-ranges: bytes
x-li-static-content: 1
x-fs-uuid: c5dc54df3b26a116006d8e32972b0000
expires: Fri, 02 Sep 2022 23:49:38 GMT

GET
H2 200 utag.js Show response
platform.linkedin.com/litms/utag/checkpoint-frontend/ 129 KB
41 KB 5536ms
486ms Script
application/javascript 2606:2800:233:66b5:799a:7cd3:f74d:7071
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.linkedin.com/litms/utag/checkpoint-frontend/utag.js?cb=1631176800000
Requested by: Host: antprimary.com
URL: http://antprimary.com/linkedin/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:66b5:799a:7cd3:f74d:7071 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Play /
Resource Hash: 6632763e797e0e05588d82fcb2d74f83b482c155cd9a700e70826215c0e2a51a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://antprimary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 10 Sep 2021 23:16:25 GMT
content-encoding: gzip
vary: Accept-Encoding
x-cdn-client-ip-version: IPV6
x-cdn: ECST
x-cache: MISS
x-cdn-proto: HTTP2
x-li-uuid: 9FLOWxCZoxaQJ8a5misAAA==
server: Play
last-modified: Wed, 01 Sep 2021 22:17:10 GMT
x-li-pop: prod-eda6
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
content-type: application/javascript; charset=utf-8
cache-control: max-age=300
accept-ranges: bytes
x-li-proto: http/1.1
x-li-fabric: prod-ltx1
expires: Sat, 10 Sep 2022 23:16:25 GMT

GET
H/1.1 200
OK utag.107.js Show response
platform.linkedin.com/litms/utag/checkpoint-frontend/ 9 KB
4 KB 5523ms
500ms Script
application/javascript 2606:2800:233:66b5:799a:7cd3:f74d:7071
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: http://platform.linkedin.com/litms/utag/checkpoint-frontend/utag.107.js?utv=ut4.46.202108061923
Requested by: Host: antprimary.com
URL: http://antprimary.com/linkedin/
Protocol: HTTP/1.1
Server: 2606:2800:233:66b5:799a:7cd3:f74d:7071 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Play /
Resource Hash: 704c03388d696028b43d5a1c5d4b4b7d6de3305ab5da61f507e552595544b0c0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://antprimary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Fri, 10 Sep 2021 23:16:25 GMT
Content-Encoding: gzip
X-CDN-CLIENT-IP-VERSION: IPV6
X-CDN: ECST
X-Cache: MISS
X-CDN-Proto: HTTP1
Content-Length: 3147
X-LI-UUID: DAznWBCZoxbAZUMBoisAAA==
Server: Play
Last-Modified: Wed, 01 Sep 2021 22:17:10 GMT
X-Li-Pop: prod-edc2
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Cache-Control: max-age=300
Accept-Ranges: bytes
X-LI-Proto: http/1.1
X-Li-Fabric: prod-lva1
Expires: Sat, 10 Sep 2022 23:16:25 GMT

GET
H/1.1 200
OK utag.116.js Show response
platform.linkedin.com/litms/utag/checkpoint-frontend/ 3 KB
2 KB 5606ms
592ms Script
application/javascript 2606:2800:233:66b5:799a:7cd3:f74d:7071
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: http://platform.linkedin.com/litms/utag/checkpoint-frontend/utag.116.js?utv=ut4.46.202108061923
Requested by: Host: antprimary.com
URL: http://antprimary.com/linkedin/
Protocol: HTTP/1.1
Server: 2606:2800:233:66b5:799a:7cd3:f74d:7071 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Play /
Resource Hash: cd776aa311400c90accd07b01cf79a23278d85d536ecccd66b895586be32c23d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://antprimary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Fri, 10 Sep 2021 23:16:25 GMT
Content-Encoding: gzip
X-CDN-CLIENT-IP-VERSION: IPV6
X-CDN: ECST
X-Cache: MISS
X-CDN-Proto: HTTP1
Content-Length: 1485
X-LI-UUID: n9yzXhCZoxbAAA9kYisAAA==
Server: Play
Last-Modified: Wed, 01 Sep 2021 22:17:10 GMT
X-Li-Pop: prod-eda6
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Cache-Control: max-age=300
Accept-Ranges: bytes
X-LI-Proto: http/1.1
X-Li-Fabric: prod-ltx1
Expires: Sat, 10 Sep 2022 23:16:25 GMT

GET
H/1.1 200
OK utag.117.js Show response
platform.linkedin.com/litms/utag/checkpoint-frontend/ 10 KB
4 KB 5408ms
394ms Script
application/javascript 2606:2800:233:66b5:799a:7cd3:f74d:7071
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: http://platform.linkedin.com/litms/utag/checkpoint-frontend/utag.117.js?utv=ut4.46.202108061923
Requested by: Host: antprimary.com
URL: http://antprimary.com/linkedin/
Protocol: HTTP/1.1
Server: 2606:2800:233:66b5:799a:7cd3:f74d:7071 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Play /
Resource Hash: 962d24fdaffaabc712ef425e30b013455416f8d14ddb5166482d04c89421e25d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://antprimary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Fri, 10 Sep 2021 23:16:25 GMT
Content-Encoding: gzip
X-CDN-CLIENT-IP-VERSION: IPV6
X-CDN: ECST
X-Cache: MISS
X-CDN-Proto: HTTP1
Content-Length: 3265
X-LI-UUID: rti6VRCZoxbwEM5p7yoAAA==
Server: Play
Last-Modified: Wed, 01 Sep 2021 22:17:10 GMT
X-Li-Pop: prod-edc2
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Cache-Control: max-age=300
Accept-Ranges: bytes
X-LI-Proto: http/1.1
X-Li-Fabric: prod-lva1
Expires: Sat, 10 Sep 2022 23:16:25 GMT

GET
H/1.1 200
OK dest5.html Show response
lnkd.demdex.net/ Frame 5363 7 KB
3 KB 5194ms
33ms Document
text/html 18.203.8.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://lnkd.demdex.net/dest5.html?d_nsid=0

Requested by

Host: antprimary.com
URL: http://antprimary.com/linkedin/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.203.8.109 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-203-8-109.eu-west-1.compute.amazonaws.com

Software

Resource Hash

7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Host: lnkd.demdex.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: http://antprimary.com/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: http://antprimary.com/

Response headers

Accept-Ranges: bytes
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
Content-Type: text/html;charset=UTF-8
date: Fri, 10 Sep 2021 23:16:25 GMT
DCS: dcs-prod-irl1-1-v016-0a32585df.edge-irl1.demdex.com UNKNOWN
Expires: Thu, 01 Jan 1970 00:00:00 UTC
last-modified: Wed, 8 Sep 2021 14:56:10 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
vary: accept-encoding
X-TID: PWVZphrgT/8=
Content-Length: 2791
Connection: keep-alive

GET
H2 200 user Show response
www.linkedin-ei.com/litms/api/metadata/ 324 B
2 KB 5769ms
690ms XHR
application/json 2620:1ec:21::16
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.linkedin-ei.com/litms/api/metadata/user

Requested by

Host: static-exp1.licdn.com
URL: https://static-exp1.licdn.com/sc/h/9t0ibl3u6kzmm3xkauxilt140

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:21::16 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

1c0721da17aa059a086dd6c902970c1ee977d14b56b8853a8d6aa16f319fd6d0

Security Headers

Name	Value
Content-Security-Policy	default-src ; connect-src 'self' ffi.st static.licdn-ei.com media.licdn-ei.com static-exp1.licdn-ei.com static-exp2.licdn-ei.com media-exp1.licdn-ei.com media-exp2.licdn-ei.com https://media-src.linkedin-ei.com/media/ www.linkedin.com www.linkedin-ei.com spdy.linkedin-ei.com dms.licdn-ei.com https://dpm.demdex.net/id lnkd.demdex.net blob: https://linkedin.sc.omtrdc.net/b/ss/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; img-src data: blob: ; font-src data: ; style-src 'unsafe-inline' 'self' static-src.linkedin.com .licdn.com static-src.linkedin-ei.com .licdn-ei.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' ffi.st spdy.linkedin.com static-src.linkedin.com .ads.linkedin.com .licdn.com platform.linkedin-ei.com spdy.linkedin-ei.com static-src.linkedin-ei.com .licdn-ei.com lix.corp.linkedin.com lva1-lixr01.linkedin.biz wus2-pd-lixr1.linkedin.biz static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com www.linkedin.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: ; child-src blob: lnkd-communities: voyager: ; frame-ancestors 'self' http://qa-mailbox.corp.linkedin.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://antprimary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
x-cache: CONFIG_NOCACHE
content-length: 218
x-li-uuid: AAXLrE39bYgqQIjFuNZCCA==
pragma: no-cache
x-li-pop: afd-ei4-x
x-msedge-ref: Ref A: D31FA50531184B6988F31B5750B0CDEB Ref B: FRAEDGE0821 Ref C: 2021-09-10T23:16:26Z
x-frame-options: sameorigin
date: Fri, 10 Sep 2021 23:16:26 GMT
expect-ct: max-age=86400, report-uri="https://www.linkedin-ei.com/platform-telemetry/ct"
vary: Origin,Accept-Encoding
content-type: application/json
access-control-allow-origin: http://antprimary.com
cache-control: no-cache, no-store
access-control-allow-credentials: true
content-security-policy: default-src *; connect-src 'self' ffi.st static.licdn-ei.com media.licdn-ei.com static-exp1.licdn-ei.com static-exp2.licdn-ei.com media-exp1.licdn-ei.com media-exp2.licdn-ei.com https://media-src.linkedin-ei.com/media/ www.linkedin.com www.linkedin-ei.com spdy.linkedin-ei.com dms.licdn-ei.com https://dpm.demdex.net/id lnkd.demdex.net blob: https://linkedin.sc.omtrdc.net/b/ss/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com static-src.linkedin-ei.com *.licdn-ei.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' ffi.st spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com platform.linkedin-ei.com spdy.linkedin-ei.com static-src.linkedin-ei.com *.licdn-ei.com lix.corp.linkedin.com lva1-lixr01.linkedin.biz wus2-pd-lixr1.linkedin.biz static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com www.linkedin.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self' http://qa-mailbox.corp.linkedin.com
x-li-proto: http/2
x-li-fabric: ei4
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 utag.js Show response
platform.linkedin-ei.com/litms/utag/checkpoint-frontend/ 129 KB
42 KB 5826ms
674ms Script
application/javascript 2a02:26f0:d9::58dd:3042
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.linkedin-ei.com/litms/utag/checkpoint-frontend/utag.js?cb=1631315700000
Requested by: Host: static-exp1.licdn.com
URL: https://static-exp1.licdn.com/sc/h/9t0ibl3u6kzmm3xkauxilt140
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:d9::58dd:3042 London, United Kingdom, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Play /
Resource Hash: 76d35616ac46fdb775fa2179763e28f6e103849831977ed1f11a20be1c3a78b2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://antprimary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 10 Sep 2021 23:16:26 GMT
content-encoding: gzip
content-type: application/javascript; charset=utf-8
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.0001,"failure_fraction":1,"include_subdomains":true}
x-cdn: AKAM
p3p: CP="CAO CUR ADM DEV PSA PSD OUR"
x-li-uuid: DxfhoBCZoxagmARDMSsAAA==
server: Play
last-modified: Tue, 07 Sep 2021 22:58:32 GMT
x-li-pop: ei-ltx1
etag: "0373955fcb937a35be4d0492dc43bcf3660c056c"
vary: Accept-Encoding
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin-ei.com/li/rep"}],"include_subdomains":true}
x-li-fabric: ei-ltx1
cache-control: max-age=300
accept-ranges: bytes
x-li-proto: http/1.1

GET id
dpm.demdex.net/ 0
0

GET status
accounts.google.com/gsi/ 0
0

POST
H/1.1 404
Not Found track Show response
antprimary.com/li/ 315 B
516 B 272ms
266ms XHR
text/html 162.241.149.153
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: http://antprimary.com/li/track
Requested by: Host: static-exp1.licdn.com
URL: https://static-exp1.licdn.com/sc/h/9t0ibl3u6kzmm3xkauxilt140
Protocol: HTTP/1.1
Server: 162.241.149.153 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 162-241-149-153.unifiedlayer.com
Software: Apache /
Resource Hash: d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

Pragma: no-cache
Origin: http://antprimary.com
Accept-Encoding: gzip, deflate
Host: antprimary.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-type: application/json
Accept: */*
Csrf-Token
Referer: http://antprimary.com/linkedin/
Cookie: AMCV_14215E3D5995C57C0A495C55%40AdobeOrg=-637568504%7CMCIDTS%7C18881%7CvVersion%7C5.1.1
Connection: keep-alive
Content-Length: 1563
Cache-Control: no-cache
Csrf-Token
Referer: http://antprimary.com/linkedin/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-type: application/json

Response headers

Date: Fri, 10 Sep 2021 23:16:25 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: dpm.demdex.net
URL: https://dpm.demdex.net/id?d_visid_ver=5.1.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=14215E3D5995C57C0A495C55%40AdobeOrg&d_nsid=0&ts=1631315787112

Domain: accounts.google.com
URL: https://accounts.google.com/gsi/status?client_id=990339570472-k6nqn1tpmitg8pui82bfaun3jrpmiuhs.apps.googleusercontent.com&as=ZQNySUB8AhSlSey3aermuA

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: LinkedIn (Social Network)

30 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

7 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.linkedin.com/	1970-01-19 21:10:02	Name: lidc Value: "b=TGST04:s=T:r=T:a=T:p=T:g=2514:u=1:x=1:i=1631315785:t=1631402185:v=2:sig=AQFUwNG5fbJqkuVJqhdsIHjBa-eS7lct"
.www.linkedin-ei.com/	1969-12-31 23:59:59	Name: JSESSIONID Value: ajax:2996925834747368806
.linkedin-ei.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=de-de
.linkedin-ei.com/	1970-01-20 14:40:29	Name: bcookie Value: "v=2&1b2539f0-bc20-477e-8331-3792e5d71a00"
.www.linkedin-ei.com/	1970-01-20 14:40:29	Name: bscookie Value: "v=1&20210910231626fa16a576-b77e-4a81-81aa-2e2a77f1d169AQFoECMQI1_EAyw4kYgCeM7Ytb8sA4DM"
.linkedin-ei.com/	1970-01-19 21:10:02	Name: lidc Value: "b=ETGST00:s=ET:r=ET:a=ET:p=ET:g=73:u=1:x=1:i=1631315786:t=1631402186:v=2:sig=AQFo1m5a5gzlRCK-fjBifJnPHq0O6ANN"
.antprimary.com/	1970-01-20 01:27:47	Name: AMCV_14215E3D5995C57C0A495C55%40AdobeOrg Value: -637568504%7CMCIDTS%7C18881%7CvVersion%7C5.1.1

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://lnkd.demdex.net/dest5.html?d_nsid=0(Line 12) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.linkedin.com') does not match the recipient window's origin ('http://antprimary.com').
deprecation	warning	URL: https://static-exp1.licdn.com/sc/h/6jblk5oqhlo45xbkmcr7s4zix Message: RTP data channels are no longer supported. The "RtpDataChannels" constraint is currently ignored, and may cause an error at a later date.
network	error	URL: http://antprimary.com/li/track Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

accounts.google.com
antprimary.com
dpm.demdex.net
lnkd.demdex.net
platform.linkedin-ei.com
platform.linkedin.com
static-exp1.licdn.com
www.linkedin-ei.com
accounts.google.com
dpm.demdex.net
162.241.149.153
18.203.8.109
2606:2800:233:66b5:799a:7cd3:f74d:7071
2606:2800:233:6a53:4ac1:3bc8:ee4e:5990
2620:1ec:21::16
2a02:26f0:d9::58dd:3042
190472cc8b749d317cc6d4c27a5022d250df931fb04507c307ef640a452200da
1c0721da17aa059a086dd6c902970c1ee977d14b56b8853a8d6aa16f319fd6d0
2072637eca86b31333f03dd2f363993776d87ec85be0f0970d80a08347cbe43f
2bcca5003dde9197922f96cf949f3bb2760bf26a86ab5ed6263fe816aaba8578
46e942b88cc1d5cfed96a384d7fa8dff33961f24400536c265992f6d7d8c0684
5af2dfee0b7dd68e56ad1e1c5f6818f6812f484d39d4495d60a6666fd0c057fb
6632763e797e0e05588d82fcb2d74f83b482c155cd9a700e70826215c0e2a51a
704c03388d696028b43d5a1c5d4b4b7d6de3305ab5da61f507e552595544b0c0
7110daa4bb9b8cc37d21a49acecd4a4e7f62f41d45eb2b8be7f0fe9ea8507234
76d35616ac46fdb775fa2179763e28f6e103849831977ed1f11a20be1c3a78b2
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
962d24fdaffaabc712ef425e30b013455416f8d14ddb5166482d04c89421e25d
cd776aa311400c90accd07b01cf79a23278d85d536ecccd66b895586be32c23d
d25766a048ff80ed49cf7e345dabe00879b6143868f4499fccdab441302acc3a
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
d9a2efb86be0801c3d1a97d0b5a125053fdbc40c9540ebeac182e0f46dbf3261

antprimary.com Open in urlscan Pro 162.241.149.153 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

18 Requests

61 %HTTPS

67 %IPv6

6 Domains

8 Subdomains

7 IPs

3 Countries

309 kBTransfer

1107 kBSize

7 Cookies

0 Outgoing links

Page URL History

Redirected requests

18 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

30 JavaScript Global Variables

7 Cookies

3 Console Messages

Indicators

antprimary.com Open in urlscan Pro
162.241.149.153 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

18
Requests

61 %
HTTPS

67 %
IPv6

6
Domains

8
Subdomains

7
IPs

3
Countries

309 kB
Transfer

1107 kB
Size

7
Cookies

18 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!