order.p-linkt.org Open in urlscan Pro
2a06:98c1:3120::3 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://bit.ly/3FEI5tp
Effective URL:
https://order.p-linkt.org/
Submission Tags: falconsandbox
Submission: On March 21 via api (March 21st 2023, 6:56:54 pm UTC) from US — Scanned from DE

Summary HTTP 15 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 6 domains to perform 15 HTTP transactions. The main IP is 2a06:98c1:3120::3, located in United States and belongs to CLOUDFLARENET, US. The main domain is order.p-linkt.org.
TLS certificate: Issued by GTS CA 1P5 on March 17th 2023. Valid for: 3 months.

This is the only time order.p-linkt.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Linkt (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
1 1	67.199.248.11 67.199.248.11	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 1	2606:4700:303... 2606:4700:3035::6815:1698	13335 (CLOUDFLAR...) (CLOUDFLARENET)
10	2a06:98c1:312... 2a06:98c1:3120::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:80b::200a	15169 (GOOGLE) (GOOGLE)
3	45.60.46.24 45.60.46.24	19551 (INCAPSULA) (INCAPSULA)
1	2a00:1450:400... 2a00:1450:4001:80e::2003	15169 (GOOGLE) (GOOGLE)
15	4

1 67.199.248.11 (United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: bit.ly

bit.ly	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3035::6815:1698 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

link-linkt.info	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a06:98c1:3120::3 (United States)

ASN13335 (CLOUDFLARENET, US)

order.p-linkt.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 45.60.46.24 (United States)

ASN19551 (INCAPSULA, US)

manage.linkt.com.au	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	p-linkt.org order.p-linkt.org	366 KB
3	linkt.com.au manage.linkt.com.au	4 KB
1	gstatic.com fonts.gstatic.com	44 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 34	1 KB
1	link-linkt.info 1 redirects link-linkt.info	475 B
1	bit.ly 1 redirects bit.ly — Cisco Umbrella Rank: 5069	229 B
15	6

	Domain	Requested by
10	order.p-linkt.org	order.p-linkt.org
3	manage.linkt.com.au	order.p-linkt.org
1	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	order.p-linkt.org
1	link-linkt.info	1 redirects
1	bit.ly	1 redirects
15	6

This site contains no links.

Subject Issuer	Validity	Valid
*.p-linkt.org GTS CA 1P5	`2023-03-17` - `2023-06-15`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-03-06` - `2023-05-29`	3 months	crt.sh
MANAGE.CITYLINK.COM.AU Thawte RSA CA 2018	`2022-09-28` - `2023-09-29`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2023-03-06` - `2023-05-29`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://order.p-linkt.org/
Frame ID: C891CA80CD61034C79FB6CBCCF48EA85
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

linkt

Page URL History Show full URLs

https://bit.ly/3FEI5tp HTTP 301
https://link-linkt.info/m HTTP 301
https://order.p-linkt.org/ Page URL

Detected technologies

Vue.js (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+\sdata-v(?:ue)?-

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

15
Requests

100 %
HTTPS

67 %
IPv6

6
Domains

6
Subdomains

4
IPs

2
Countries

416 kB
Transfer

1341 kB
Size

7
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://bit.ly/3FEI5tp HTTP 301
https://link-linkt.info/m HTTP 301
https://order.p-linkt.org/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
order.p-linkt.org/
Redirect Chain

https://bit.ly/3FEI5tp
https://link-linkt.info/m
https://order.p-linkt.org/

795 B
872 B

617ms
568ms

Document
text/html

2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://order.p-linkt.org/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3493bff9d4719bfd94a0a31e462d4db3f37527eb608ab8234bda06f8e67d13b9

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7ab86ab40c9a30c6-FRA
content-encoding: br
content-type: text/html
date: Tue, 21 Mar 2023 18:56:47 GMT
last-modified: Sat, 18 Mar 2023 14:34:59 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=l%2Fi5KqVLdUVTlay%2FASlfY8%2BXEVkOCptbdm6CMkFCGkCRJId3QO1QUHZnrVP7yydW80P%2Bg01xhR5mztnReCjlcVdZztOuHbL0RxjL1q3cQW3YJfr5V8eWMUblR95BdXeJnhSYh54pN%2F8xZoGI7%2FKh%2FQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

Redirect headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=3600
cf-ray: 7ab86ab3acd09201-FRA
date: Tue, 21 Mar 2023 18:56:46 GMT
expires: Tue, 21 Mar 2023 19:56:46 GMT
location: https://order.p-linkt.org/#/m?
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yhuiWPzMBFg2NKujT1UqX%2Fg74%2Bip7MryYFnqkvDDru8bryLIyWxg3FXaimu2F81JCdIYjD2DsZxkHUTiwrQJgkvSn1jgjanJCc9zQ3QzLoMOcj%2BEdTsgAHPcyK0GCuOMB2svCZL7OfCiEvJ8uog%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H2 200 css
fonts.googleapis.com/ 5 KB
1 KB 42ms
16ms Stylesheet
text/css 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:400,300

Requested by

Host: order.p-linkt.org
URL: https://order.p-linkt.org/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c3baec46d1dd68b2a9d35ad4fa2f7883d122bb3e0af79cb0aea8e3c3ed529cd5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://order.p-linkt.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 21 Mar 2023 18:56:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 21 Mar 2023 16:58:38 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 21 Mar 2023 18:56:47 GMT

GET
H2 200 chunk-vendors.5f41e082.js Show response
order.p-linkt.org/js/ 959 KB
258 KB 1714ms
1712ms Script
application/javascript 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://order.p-linkt.org/js/chunk-vendors.5f41e082.js
Requested by: Host: order.p-linkt.org
URL: https://order.p-linkt.org/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9fbfd27008b65331500624e892dc227171c779c24bfd257cbb4ac8e35de57d75

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://order.p-linkt.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Tue, 21 Mar 2023 18:56:49 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Sat, 18 Mar 2023 14:35:05 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"6415cc19-efb09"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jzP6vwgNTXdqbhUJC3vnRp1X59o3BcWn5A4eUkfz7MGYuArtwC35bu%2FxinhBA%2FgG%2BF%2BTk7VbMHxcUSFQ3UdDFyhwCT4u9N2O7NUlyTCG2SnsnzXpHl1QYdxXRHPt2wWTmUOaz6%2F5z%2BQJlG%2FtaFw1LQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=43200
cf-ray: 7ab86ab7a99b30c6-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Wed, 22 Mar 2023 06:56:47 GMT

GET
H2 200 app.52362719.js Show response
order.p-linkt.org/js/ 14 KB
5 KB 577ms
577ms Script
application/javascript 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://order.p-linkt.org/js/app.52362719.js
Requested by: Host: order.p-linkt.org
URL: https://order.p-linkt.org/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d00264d674dba19d36034c0f5c84f3a1e38a8e68fb02b9e92078bc36928f5c20

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://order.p-linkt.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Tue, 21 Mar 2023 18:56:47 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Sat, 18 Mar 2023 14:35:04 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"6415cc18-3632"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FSUNGHuwXIKs7PW%2BpI9A7%2BolyaDFSB9yrYH8ay4vq1CwpUFvJpL1VBeUVBcHpS%2Brdh6WtagShjoo25hrThk8XRKdbtBRKWhAjwm1fcQzP2cO7cjlqTG%2FtYseSTMvCZqJRmks1u%2FaBPqui3V7LMFssA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=43200
cf-ray: 7ab86ab7c9c830c6-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Wed, 22 Mar 2023 06:56:47 GMT

GET
H2 200 chunk-vendors.2b35c01c.css
order.p-linkt.org/css/ 206 KB
35 KB 825ms
824ms Stylesheet
text/css 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://order.p-linkt.org/css/chunk-vendors.2b35c01c.css
Requested by: Host: order.p-linkt.org
URL: https://order.p-linkt.org/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0853aaa2d688c7126e27018d557e1ba07d11e1f5f45f1d0c318412006aa8fab8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://order.p-linkt.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Tue, 21 Mar 2023 18:56:48 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Sat, 18 Mar 2023 14:35:01 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"6415cc15-337a8"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wbLCwm9rXuOMaK6D2SNDXdUGH51LZ57eMlKGV9wthrTWMNbf%2B2nyfK8M1STEPSv3q2QYEz%2B4EUz%2FpTp9k20u2DFcm9ol03SKP4F%2BxnXf3gNxHBe3lfznwGj7G0aos9a2X8SHVhZ5xU8jSLhOec8X0A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=43200
cf-ray: 7ab86ab7a99930c6-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Wed, 22 Mar 2023 06:56:47 GMT

GET
H2 200 app.e47c3d90.css
order.p-linkt.org/css/ 57 KB
11 KB 558ms
557ms Stylesheet
text/css 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://order.p-linkt.org/css/app.e47c3d90.css
Requested by: Host: order.p-linkt.org
URL: https://order.p-linkt.org/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2ef84e48bc105ffb86814c292d7c5f9a047baa1a120ea3463cce7e2ad8a11442

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://order.p-linkt.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Tue, 21 Mar 2023 18:56:47 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Sat, 18 Mar 2023 14:35:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"6415cc14-e219"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7j%2FL9ljovyGLVx1HAxLfLLgKcElFz8YGtDSmU7DCKtMQiipcvxdhiTIiiHrret9I%2BKWXKA8PWa59pVPVfwhOWHV3rErvkdqTswVS9gbwrPKyuBNbzWJ264Sbp%2FatZkjNyQxfbZqFFXKFqiMXdLpSgg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=43200
cf-ray: 7ab86ab7a99c30c6-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Wed, 22 Mar 2023 06:56:47 GMT

GET
H3 200 visits Show response
order.p-linkt.org/api/num/record/ 41 B
569 B 856ms
855ms XHR
application/json 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://order.p-linkt.org/api/num/record/visits
Requested by: Host: order.p-linkt.org
URL: https://order.p-linkt.org/js/chunk-vendors.5f41e082.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1d26fb4550d79ddd00ed695c52e9f888abac94e0d3bc3ed161dffbe8b07d9bdb

Request headers

Accept: application/json, text/plain, */*
Referer: https://order.p-linkt.org/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Tue, 21 Mar 2023 18:56:49 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WuvdE5vPe8hkKxzjVt1HUV9BtW1Xu%2BeXeEmczMSdfIJqMLGqUAzAkocl3SSnqJFOxgzfoILD%2FuZJtlEa30eiB258vNh2i8xZOhtDHYKAGTSMY65KA83uWQRgjKr6qO0NLFaiHhQ2S4LA1FdXJJ1vcg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json
cf-ray: 7ab86ac32dec9bb6-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 user Show response
order.p-linkt.org/api/card/websocket-domain/ 115 B
623 B 602ms
602ms XHR
application/json 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://order.p-linkt.org/api/card/websocket-domain/user
Requested by: Host: order.p-linkt.org
URL: https://order.p-linkt.org/js/chunk-vendors.5f41e082.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b9cfb41a3fb774654c6c419216581243306225a90773132289076a0028d2b99b

Request headers

Accept: application/json, text/plain, */*
Referer: https://order.p-linkt.org/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Tue, 21 Mar 2023 18:56:49 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Wvh1eSUmpoCr9dA2b0etcyHAhwAggsxssZ3DoW%2FBnbjs4tI57cpNO7fJjQZm8sf7eBFKrEhmAiAoFf1iazl21i64tOHALkq4lxsibGeMVLoiF7zNiTx7anJPKo04%2BuoamKquoPcwcBdzseGijI7JzA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json
cf-ray: 7ab86ac32ded9bb6-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 linkt_logo.93d970a4.svg
order.p-linkt.org/img/ 2 KB
2 KB 586ms
585ms Image
image/svg+xml 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://order.p-linkt.org/img/linkt_logo.93d970a4.svg
Requested by: Host: order.p-linkt.org
URL: https://order.p-linkt.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d5661d91e8d56409f4525f8f58265c356c204e9fde3eda57a61d1a8594483bc1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://order.p-linkt.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Tue, 21 Mar 2023 18:56:49 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Sat, 18 Mar 2023 14:35:02 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"6415cc16-836"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0YiheJDe8W2UwGNz%2Fv7yvkyzXqkNqIsPK8r1UqZiABXpkSj34c8msXrAMPvquRdtLmnUeff55NeoGgunDtN8rhZswxBJrvp97Hiaam9INcjCOthSECdlEkvTvDM6opkNLfQUZdWYR6iQEwN%2F0Kn9NA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
cache-control: max-age=14400
cf-ray: 7ab86ac32df09bb6-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 logo-Transurban.cc5a7e14.png
order.p-linkt.org/img/ 25 KB
26 KB 846ms
845ms Image
image/png 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://order.p-linkt.org/img/logo-Transurban.cc5a7e14.png
Requested by: Host: order.p-linkt.org
URL: https://order.p-linkt.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 85cdaa21c8d06fc4322303a35cea7cd1acdfa9695ad1882598fd107cf3d17522

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://order.p-linkt.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Tue, 21 Mar 2023 18:56:49 GMT
cf-cache-status: MISS
last-modified: Sat, 18 Mar 2023 14:35:03 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "6415cc17-6496"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IM422MAOHiRWUj9RZvqdscjxM2OyOEQQzecUvcmEfTVEVpxRBAqqDY1sBoZduBrwdkcVmSN%2FIFc8TjkMgtNMmJsCm4XhL3YZZM2MDRF1wZv6AKZfLKF7Hn9XxDHWIPruayAz4QW%2Fnv118P8ZDhaYmw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 7ab86ac32df29bb6-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 25750
expires: Thu, 20 Apr 2023 18:56:49 GMT

GET
H2 200 icon-twitter.png
manage.linkt.com.au/retailweb/resources/retailer/linkt/img/icons/ 545 B
1 KB 933ms
791ms Image
image/png 45.60.46.24
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://manage.linkt.com.au/retailweb/resources/retailer/linkt/img/icons/icon-twitter.png

Requested by

Host: order.p-linkt.org
URL: https://order.p-linkt.org/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.46.24 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

TUHardened /

Resource Hash

55249775ca508b84f9ae864910450bd7d3f884f6a0b4fb9c8a4383e09961181f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://order.p-linkt.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Mar 2023 18:56:49 GMT
via: 1.1 e5b93012e2bfb81dc9846f43efd610a6.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000
last-modified: Fri, 24 Feb 2023 02:56:20 GMT
server: TUHardened
x-cdn: Imperva
x-amz-cf-pop: FRA2-C2
x-cache: Miss from cloudfront
content-type: image/png;charset=UTF-8
x-iinfo: 7-39253213-39253230 NNNN CT(6 9 0) RT(1679425009192 91) q(0 0 1 1) r(1 8) U24
cache-control: max-age=604800, must-revalidate
content-length: 545
x-amz-cf-id: fcQekYit4C9GslaIVDFVqtaxd-tNQzo8znEkdNQRFAeGjgQu3ulWVg==
expires: Tue, 28 Mar 2023 18:56:49 GMT

GET
H2 200 facebook-icon.png
manage.linkt.com.au/retailweb/resources/retailer/linkt/img/icons/ 494 B
1 KB 936ms
794ms Image
image/png 45.60.46.24
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://manage.linkt.com.au/retailweb/resources/retailer/linkt/img/icons/facebook-icon.png

Requested by

Host: order.p-linkt.org
URL: https://order.p-linkt.org/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.46.24 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

TUHardened /

Resource Hash

794e4bb51b9f1f7efeadab401b75b6f8c65038238b9f9bd694f0a451962a88bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://order.p-linkt.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Mar 2023 18:56:49 GMT
via: 1.1 e56e6732f380db727425bac2d6158760.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000
last-modified: Fri, 24 Feb 2023 02:56:20 GMT
server: TUHardened
x-cdn: Imperva
x-amz-cf-pop: FRA2-C2
x-cache: Miss from cloudfront
content-type: image/png;charset=UTF-8
x-iinfo: 7-39253213-39253233 NNNN CT(5 6 0) RT(1679425009192 96) q(0 0 1 0) r(1 8) U24
cache-control: max-age=604800, must-revalidate
content-length: 494
x-amz-cf-id: IFm0LaZfzd76cUO_YlWdx0Dgql1tNb6V_UVeRX1tLgHKVM15uJxRlA==
expires: Tue, 28 Mar 2023 18:56:49 GMT

GET
H2 200 icon-youtube.png
manage.linkt.com.au/retailweb/resources/retailer/linkt/img/icons/ 424 B
1 KB 930ms
788ms Image
image/png 45.60.46.24
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://manage.linkt.com.au/retailweb/resources/retailer/linkt/img/icons/icon-youtube.png

Requested by

Host: order.p-linkt.org
URL: https://order.p-linkt.org/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.46.24 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

TUHardened /

Resource Hash

67c5e1a39cce0c03cd5f194e9daa6f4c805ede1b6852258158bdfe87f6b3edad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://order.p-linkt.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Mar 2023 18:56:49 GMT
via: 1.1 52f0756596448c36265861853c0a44a4.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000
last-modified: Fri, 24 Feb 2023 02:56:20 GMT
server: TUHardened
x-cdn: Imperva
x-amz-cf-pop: FRA2-C2
x-cache: Miss from cloudfront
content-type: image/png;charset=UTF-8
x-iinfo: 7-39253213-39253234 NNNN CT(2 6 0) RT(1679425009192 96) q(0 1 1 3) r(1 8) U24
cache-control: max-age=604800, must-revalidate
content-length: 424
x-amz-cf-id: ko3nU7lmvt0dPhELrmmbjjr18kiIECT_GFkKxh0zzxGbTA2JnrAOew==
expires: Tue, 28 Mar 2023 18:56:49 GMT

GET
H3 200 element-icons.ff18efd1.woff
order.p-linkt.org/fonts/ 28 KB
28 KB 855ms
854ms Font
font/woff 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://order.p-linkt.org/fonts/element-icons.ff18efd1.woff
Requested by: Host: order.p-linkt.org
URL: https://order.p-linkt.org/css/chunk-vendors.2b35c01c.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ab40a58972be2ceab32e7e35dab3131b959aae63835d7bda1a79ae51f9a73c17

Request headers

Referer: https://order.p-linkt.org/css/chunk-vendors.2b35c01c.css
Origin: https://order.p-linkt.org
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Tue, 21 Mar 2023 18:56:49 GMT
cf-cache-status: MISS
last-modified: Sat, 18 Mar 2023 14:35:01 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "6415cc15-6e28"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Iu%2Bt1fQVRmjqYwnurQ1M4FZeG5doU72Q22Rw7PlTgYXNzTh0p0A7ZiMBoA2ekZn%2BX3eHjH2z7Rf8JN331eVRYfP9cF13vwTaA1UshB5n%2Fa8SgIrTMkzlH%2F2dOeEY5ZN%2FJqhnHyaNbYRNm%2Bjv%2BpiAvg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/woff
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 7ab86ac32df59bb6-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 28200

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v34/ 44 KB
44 KB 149ms
10ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v34/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:400,300

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://order.p-linkt.org
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Tue, 21 Mar 2023 08:37:39 GMT
x-content-type-options: nosniff
age: 37150
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44856
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 18:20:18 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Mar 2024 08:37:39 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Linkt (Transportation)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

7 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
order.p-linkt.org/api	1969-12-31 23:59:59	Name: JSESSIONID Value: 271AC264E028F20F7514CA4961BEAF58
.bit.ly/	1970-01-20 14:49:37	Name: _bit Value: n2liUK-1791dafe17c53a4e99-00t
order.p-linkt.org/	1970-01-20 10:30:28	Name: domainName Value: wss%3A%2F%2Ftol.l-linkt.net%2Fapi%2Fapprove%2F
.linkt.com.au/	1970-01-20 19:14:47	Name: visid_incap_1644040 Value: 3NWEOdXiQ/ariiubfc0knvH9GWQAAAAAQUIPAAAAAACXIFP58uU800K7s+IAANoJ
manage.linkt.com.au/	1970-01-20 10:40:29	Name: AWSALBCORS Value: z8c7xMKHt0Kd523nSfuh+rNrKh0OQ1xg8UdS1GLJA4v0Rw8IU4F2fK+i6fwCu6YM75ThvliXbKdrPWbyBLqTN2AEXEjAsATt0Fltqhpt/DBmRyvFXzIy2R6//Xen
.linkt.com.au/	1969-12-31 23:59:59	Name: nlbi_1644040 Value: ky/bHCSqwx7tOJpb4XKpuwAAAADDU6iV5D6jLmc8clw2bXuf
.linkt.com.au/	1969-12-31 23:59:59	Name: incap_ses_184_1644040 Value: GKwyLig0L3dEEPSOf7ONAvL9GWQAAAAAo5IjssTXRKCyNKUJ2+1VUg==

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://order.p-linkt.org/js/app.52362719.js Message: WebSocket connection to 'wss://tol.l-linkt.net/api/approve/IP_2dXtfwapneB6MB6i' failed: Error during WebSocket handshake: Unexpected response code: 403

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bit.ly
fonts.googleapis.com
fonts.gstatic.com
link-linkt.info
manage.linkt.com.au
order.p-linkt.org
2606:4700:3035::6815:1698
2a00:1450:4001:80b::200a
2a00:1450:4001:80e::2003
2a06:98c1:3120::3
45.60.46.24
67.199.248.11
0853aaa2d688c7126e27018d557e1ba07d11e1f5f45f1d0c318412006aa8fab8
1d26fb4550d79ddd00ed695c52e9f888abac94e0d3bc3ed161dffbe8b07d9bdb
2ef84e48bc105ffb86814c292d7c5f9a047baa1a120ea3463cce7e2ad8a11442
3493bff9d4719bfd94a0a31e462d4db3f37527eb608ab8234bda06f8e67d13b9
55249775ca508b84f9ae864910450bd7d3f884f6a0b4fb9c8a4383e09961181f
67c5e1a39cce0c03cd5f194e9daa6f4c805ede1b6852258158bdfe87f6b3edad
794e4bb51b9f1f7efeadab401b75b6f8c65038238b9f9bd694f0a451962a88bd
85cdaa21c8d06fc4322303a35cea7cd1acdfa9695ad1882598fd107cf3d17522
8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db
9fbfd27008b65331500624e892dc227171c779c24bfd257cbb4ac8e35de57d75
ab40a58972be2ceab32e7e35dab3131b959aae63835d7bda1a79ae51f9a73c17
b9cfb41a3fb774654c6c419216581243306225a90773132289076a0028d2b99b
c3baec46d1dd68b2a9d35ad4fa2f7883d122bb3e0af79cb0aea8e3c3ed529cd5
d00264d674dba19d36034c0f5c84f3a1e38a8e68fb02b9e92078bc36928f5c20
d5661d91e8d56409f4525f8f58265c356c204e9fde3eda57a61d1a8594483bc1

order.p-linkt.org Open in urlscan Pro 2a06:98c1:3120::3 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

15 Requests

100 %HTTPS

67 %IPv6

6 Domains

6 Subdomains

4 IPs

2 Countries

416 kBTransfer

1341 kBSize

7 Cookies

0 Outgoing links

Page URL History

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

6 JavaScript Global Variables

7 Cookies

1 Console Messages

Indicators

order.p-linkt.org Open in urlscan Pro
2a06:98c1:3120::3 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

100 %
HTTPS

67 %
IPv6

6
Domains

6
Subdomains

4
IPs

2
Countries

416 kB
Transfer

1341 kB
Size

7
Cookies

15 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!