acc.inkneldi.co Open in urlscan Pro
193.169.255.250 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://acc.inkneldi.co/
Effective URL:
http://acc.inkneldi.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&jtUxckWz1o0HkB6...
Submission: On June 11 via manual (June 11th 2019, 5:52:43 pm UTC) from US

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 9 HTTP transactions. The main IP is 193.169.255.250, located in Poland and belongs to WHF-LTD-AS, PL. The main domain is acc.inkneldi.co.

This is the only time acc.inkneldi.co was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: LinkedIn (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
4	193.169.255.250 193.169.255.250	210273 (WHF-LTD-AS) (WHF-LTD-AS)
4	2a02:26f0:6c0... 2a02:26f0:6c00:296::25ea	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	205.204.101.142 205.204.101.142	45102 (CNNIC-ALI...) (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co.)
9	3

4 193.169.255.250 (Poland)

ASN210273 (WHF-LTD-AS, PL)

acc.inkneldi.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a02:26f0:6c00:296::25ea (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

static.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 205.204.101.142 (San Mateo, United States)

ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN)

passport.alibaba.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	licdn.com static.licdn.com	58 KB
4	inkneldi.co acc.inkneldi.co	23 KB
1	alibaba.com passport.alibaba.com
9	3

	Domain	Requested by
4	static.licdn.com	acc.inkneldi.co
4	acc.inkneldi.co	static.licdn.com
1	passport.alibaba.com	acc.inkneldi.co
9	3

This site contains no links.

Subject Issuer	Validity	Valid
*.licdn.com DigiCert SHA2 Secure Server CA	`2019-04-01` - `2021-05-07`	2 years	crt.sh
*.alibaba.com GlobalSign Organization Validation CA - SHA256 - G2	`2019-03-03` - `2019-09-26`	7 months	crt.sh
	`1970-01-01` - `1970-01-01`	a few seconds	crt.sh

This page contains 2 frames:

Primary Page: http://acc.inkneldi.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&jtUxckWz1o0HkB6IPqumVEjUdkoY0VhtrCIcM5CEHP3wPW5J1Bc8exVltYYKiNumJ63QpnBYI7PW1cj3s3gTuMoxHJ3aWH91ylDQidgSCbszWZPr3oIYp1lQ1anqB5zuf1Bhrk6ALCJt&id=
Frame ID: 4E9D2C2A807BC5EC1340A57757BC2354
Requests: 8 HTTP requests in this frame

Frame: https://passport.alibaba.com/icbu_login.htm?return_url=https%3A%2F%2Fwww.alibaba.com%2F
Frame ID: 5DEDB0083EE718E6AFC2183961DDBC4D
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://acc.inkneldi.co/ Page URL
http://acc.inkneldi.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-si... Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

9
Requests

56 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

82 kB
Transfer

349 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://acc.inkneldi.co/ Page URL
http://acc.inkneldi.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&jtUxckWz1o0HkB6IPqumVEjUdkoY0VhtrCIcM5CEHP3wPW5J1Bc8exVltYYKiNumJ63QpnBYI7PW1cj3s3gTuMoxHJ3aWH91ylDQidgSCbszWZPr3oIYp1lQ1anqB5zuf1Bhrk6ALCJt&id= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK / Show response
acc.inkneldi.co/ 270 B
478 B 100ms
41ms Document
text/html 193.169.255.250
WHF-LTD-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://acc.inkneldi.co/
Protocol: HTTP/1.1
Server: 193.169.255.250 , Poland, ASN210273 (WHF-LTD-AS, PL),
Reverse DNS
Software: Apache /
Resource Hash: 4139df8117252f67227b567b992ac4966e29970a3083f9e742942e9fb1f68d61

Request headers

Host: acc.inkneldi.co
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 11 Jun 2019 17:52:28 GMT
Server: Apache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK Primary Request / Show response
acc.inkneldi.co/l.php/ 21 KB
22 KB 41ms
40ms Document
text/html 193.169.255.250
WHF-LTD-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://acc.inkneldi.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&jtUxckWz1o0HkB6IPqumVEjUdkoY0VhtrCIcM5CEHP3wPW5J1Bc8exVltYYKiNumJ63QpnBYI7PW1cj3s3gTuMoxHJ3aWH91ylDQidgSCbszWZPr3oIYp1lQ1anqB5zuf1Bhrk6ALCJt&id=
Protocol: HTTP/1.1
Server: 193.169.255.250 , Poland, ASN210273 (WHF-LTD-AS, PL),
Reverse DNS
Software: Apache /
Resource Hash: 48feb9b87add528faf37961c577d1aae240c9b339bc637ab2858cd86dc3bf99b

Request headers

Host: acc.inkneldi.co
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer: http://acc.inkneldi.co/
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://acc.inkneldi.co/

Response headers

Date: Tue, 11 Jun 2019 17:52:28 GMT
Server: Apache
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK %2Fcheckpoint-frontend%2Fstylesheets%2Flogin%2Ffastrack%2Fdesktop_en_US.css
static.licdn.com/sc/p/com.linkedin.checkpoint%3Acheckpoint-static-content%2B2.0.262/f/ 190 KB
20 KB 55ms
7ms Stylesheet
text/css 2a02:26f0:6c00:296::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://static.licdn.com/sc/p/com.linkedin.checkpoint%3Acheckpoint-static-content%2B2.0.262/f/%2Fcheckpoint-frontend%2Fstylesheets%2Flogin%2Ffastrack%2Fdesktop_en_US.css
Requested by: Host: acc.inkneldi.co
URL: http://acc.inkneldi.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&jtUxckWz1o0HkB6IPqumVEjUdkoY0VhtrCIcM5CEHP3wPW5J1Bc8exVltYYKiNumJ63QpnBYI7PW1cj3s3gTuMoxHJ3aWH91ylDQidgSCbszWZPr3oIYp1lQ1anqB5zuf1Bhrk6ALCJt&id=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:296::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: Play /
Resource Hash: f165af10f04c3852fccb6500761ca16126a86acf7f6138e7c75a98caa33c0fa1

Request headers

Referer: http://acc.inkneldi.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&jtUxckWz1o0HkB6IPqumVEjUdkoY0VhtrCIcM5CEHP3wPW5J1Bc8exVltYYKiNumJ63QpnBYI7PW1cj3s3gTuMoxHJ3aWH91ylDQidgSCbszWZPr3oIYp1lQ1anqB5zuf1Bhrk6ALCJt&id=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 11 Jun 2019 17:52:28 GMT
Content-Encoding: gzip
X-CDN-CLIENT-IP-VERSION: IPV6
X-CDN: AKAM
X-Li-Pop: prod-tln1
X-CDN-Proto: HTTP1
Connection: keep-alive
Content-Length: 19961
X-LI-UUID: VX9Bz30BpxXA4xkqbCsAAA==
Timing-Allow-Origin: *
Last-Modified: Mon, 05 Nov 2012 04:00:51 GMT
Server: Play
Cache-Control: max-age=31536000, immutable
Vary: Accept-Encoding
Content-Type: text/css
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-CDN, X-CDN-CLIENT-IP-VERSION, X-CDN-Proto
X-LI-Proto: http/1.1
X-LI-Static-Content: 1
X-Li-Fabric: prod-lor1
Expires: Wed, 10 Jun 2020 00:13:11 GMT

GET
H/1.1 200
OK 7iptgtauoer8as7pb8k008o4c Show response
static.licdn.com/sc/h/br/ 55 KB
14 KB 53ms
6ms Script
text/javascript 2a02:26f0:6c00:296::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://static.licdn.com/sc/h/br/7iptgtauoer8as7pb8k008o4c
Requested by: Host: acc.inkneldi.co
URL: http://acc.inkneldi.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&jtUxckWz1o0HkB6IPqumVEjUdkoY0VhtrCIcM5CEHP3wPW5J1Bc8exVltYYKiNumJ63QpnBYI7PW1cj3s3gTuMoxHJ3aWH91ylDQidgSCbszWZPr3oIYp1lQ1anqB5zuf1Bhrk6ALCJt&id=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:296::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: Play /
Resource Hash: f22081906f87637d3fc7f822eedf67e37b3d9e2bb780bc533404e95f753b7433

Request headers

Referer: http://acc.inkneldi.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&jtUxckWz1o0HkB6IPqumVEjUdkoY0VhtrCIcM5CEHP3wPW5J1Bc8exVltYYKiNumJ63QpnBYI7PW1cj3s3gTuMoxHJ3aWH91ylDQidgSCbszWZPr3oIYp1lQ1anqB5zuf1Bhrk6ALCJt&id=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 11 Jun 2019 17:52:28 GMT
Content-Encoding: br
X-CDN-CLIENT-IP-VERSION: IPV6
X-CDN: AKAM
X-Li-Pop: prod-tln1
X-CDN-Proto: HTTP1
Connection: keep-alive
Content-Length: 13659
X-LI-UUID: 98OmyXwBpxVgNoHFaysAAA==
Timing-Allow-Origin: *
Last-Modified: Mon, 05 Nov 2012 04:00:51 GMT
Server: Play
Cache-Control: max-age=31536000, immutable
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-CDN, X-CDN-CLIENT-IP-VERSION, X-CDN-Proto
X-LI-Proto: http/1.1
X-LI-Static-Content: 1
X-Li-Fabric: prod-lor1
Expires: Wed, 10 Jun 2020 01:00:15 GMT

GET
H/1.1 200
OK ce5359m270sii9ud195l3tlfz Show response
static.licdn.com/sc/h/br/ 72 KB
20 KB 54ms
8ms Script
text/javascript 2a02:26f0:6c00:296::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://static.licdn.com/sc/h/br/ce5359m270sii9ud195l3tlfz
Requested by: Host: acc.inkneldi.co
URL: http://acc.inkneldi.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&jtUxckWz1o0HkB6IPqumVEjUdkoY0VhtrCIcM5CEHP3wPW5J1Bc8exVltYYKiNumJ63QpnBYI7PW1cj3s3gTuMoxHJ3aWH91ylDQidgSCbszWZPr3oIYp1lQ1anqB5zuf1Bhrk6ALCJt&id=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:296::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: Play /
Resource Hash: fcaea8f8347e9e5ba2b3e7351379fc74fc4ddae29878307cad7ae85fdbfe132a

Request headers

Referer: http://acc.inkneldi.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&jtUxckWz1o0HkB6IPqumVEjUdkoY0VhtrCIcM5CEHP3wPW5J1Bc8exVltYYKiNumJ63QpnBYI7PW1cj3s3gTuMoxHJ3aWH91ylDQidgSCbszWZPr3oIYp1lQ1anqB5zuf1Bhrk6ALCJt&id=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 11 Jun 2019 17:52:28 GMT
Content-Encoding: br
X-CDN-CLIENT-IP-VERSION: IPV6
X-CDN: AKAM
X-Li-Pop: prod-tln1
X-CDN-Proto: HTTP1
Connection: keep-alive
Content-Length: 20188
X-LI-UUID: pIzcGn0BpxXAMC6CaysAAA==
Timing-Allow-Origin: *
Last-Modified: Mon, 05 Nov 2012 04:00:51 GMT
Server: Play
Cache-Control: max-age=31536000, immutable
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-CDN, X-CDN-CLIENT-IP-VERSION, X-CDN-Proto
X-LI-Proto: http/1.1
X-LI-Static-Content: 1
X-Li-Fabric: prod-lor1
Expires: Wed, 10 Jun 2020 00:27:46 GMT

GET
H2 200 icbu_login.htm
passport.alibaba.com/ Frame 5DED 0
0 1135ms
172ms Document
text/html 205.204.101.142
CNNIC-ALIBABA-US-...

General

Check archive.org

Show headers Download Go to

Full URL

https://passport.alibaba.com/icbu_login.htm?return_url=https%3A%2F%2Fwww.alibaba.com%2F

Requested by

Host: acc.inkneldi.co
URL: http://acc.inkneldi.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&jtUxckWz1o0HkB6IPqumVEjUdkoY0VhtrCIcM5CEHP3wPW5J1Bc8exVltYYKiNumJ63QpnBYI7PW1cj3s3gTuMoxHJ3aWH91ylDQidgSCbszWZPr3oIYp1lQ1anqB5zuf1Bhrk6ALCJt&id=

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

205.204.101.142 San Mateo, United States, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN),

Reverse DNS

Software

Tengine /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:method: GET
:authority: passport.alibaba.com
:scheme: https
:path: /icbu_login.htm?return_url=https%3A%2F%2Fwww.alibaba.com%2F
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
referer: http://acc.inkneldi.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&jtUxckWz1o0HkB6IPqumVEjUdkoY0VhtrCIcM5CEHP3wPW5J1Bc8exVltYYKiNumJ63QpnBYI7PW1cj3s3gTuMoxHJ3aWH91ylDQidgSCbszWZPr3oIYp1lQ1anqB5zuf1Bhrk6ALCJt&id=
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://acc.inkneldi.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&jtUxckWz1o0HkB6IPqumVEjUdkoY0VhtrCIcM5CEHP3wPW5J1Bc8exVltYYKiNumJ63QpnBYI7PW1cj3s3gTuMoxHJ3aWH91ylDQidgSCbszWZPr3oIYp1lQ1anqB5zuf1Bhrk6ALCJt&id=

Response headers

status: 200
date: Tue, 11 Jun 2019 17:52:29 GMT
content-type: text/html;charset=UTF-8
server: Tengine
vary: Accept-Encoding
htrace-id: 0bb40d5215602755495615415ef588
p3p: CP='CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
set-cookie: cookie2=u0966428cd732e9e75e6394bad92361a; Domain=.alibaba.com; Path=/; HttpOnly t=0354cd348ad47ed12b5c0cd62df73e20; Domain=.alibaba.com; Expires=Sat, 10-Mar-2029 18:32:29 GMT; Path=/ xman_t=LN8LmuMo46BetE1bIAR/uCvO850kaMTSCzkCPCcXoEdtZKGFte58E8u9bndEYVcQtZhUdeH7V/w=; Domain=.alibaba.com; Expires=Sat, 07-Sep-2019 16:59:09 GMT; Path=/; HttpOnly _tb_token_=74e06b6370e4; Domain=.alibaba.com; Path=/
havana_s_v: 4.0.1.2-SNAPSHOT
havana_s_ip: 4547514b654970663076725a4a4d6868
havana_s_host: 56447249394562762b4f6b4941734349734b6272612f656954462b38635763673848597a723256397242534b34513d3d
havana_s_tag: 285873024335988|134217728^|^^
havana_s_ucode: US:US
havana_s_tid: 0bb40d5215602755495615415ef588
havana_s_group: havana-session
havana_s_status: STATUS_NOT_EXISTED
content-language: zh-CN
expires: Thu, 01 Jan 1970 00:00:01 GMT
cache-control: no-cache no-store
pragma: no-cache
content-encoding: gzip
strict-transport-security: max-age=31536000
timing-allow-origin: *
eagleid: 0bb40d5215602755495615415ef588

GET
H/1.1 200
OK djzv59yelk5urv2ujlazfyvrk
static.licdn.com/sc/h/ 9 KB
4 KB 8ms
8ms Image
image/svg+xml 2a02:26f0:6c00:296::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.licdn.com/sc/h/djzv59yelk5urv2ujlazfyvrk
Requested by: Host: acc.inkneldi.co
URL: http://acc.inkneldi.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&jtUxckWz1o0HkB6IPqumVEjUdkoY0VhtrCIcM5CEHP3wPW5J1Bc8exVltYYKiNumJ63QpnBYI7PW1cj3s3gTuMoxHJ3aWH91ylDQidgSCbszWZPr3oIYp1lQ1anqB5zuf1Bhrk6ALCJt&id=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:296::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: Play /
Resource Hash: fadf34ab3a5d0c22f46af87308c62bf8deb79e6c684f15963aeb656943eb51e4

Request headers

Referer: https://static.licdn.com/sc/p/com.linkedin.checkpoint%3Acheckpoint-static-content%2B2.0.262/f/%2Fcheckpoint-frontend%2Fstylesheets%2Flogin%2Ffastrack%2Fdesktop_en_US.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 11 Jun 2019 17:52:28 GMT
Content-Encoding: gzip
X-CDN-CLIENT-IP-VERSION: IPV6
X-CDN: AKAM
X-Li-Pop: prod-ela1
X-CDN-Proto: HTTP1
Connection: keep-alive
Content-Length: 3501
X-LI-UUID: WjVM2nUgKBWAC41itioAAA==
Timing-Allow-Origin: *
Last-Modified: Mon, 05 Nov 2012 04:00:51 GMT
Server: Play
Cache-Control: max-age=31536000, immutable
X-EdgeConnect-Cache-Status: 1
Vary: Accept-Encoding
Content-Type: image/svg+xml
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-CDN, X-CDN-CLIENT-IP-VERSION, X-CDN-Proto
X-LI-Proto: http/1.1
X-LI-Static-Content: 1
X-Li-Fabric: prod-lor1
Expires: Mon, 16 Mar 2020 12:39:33 GMT

POST
H/1.1 404
Not Found track Show response
acc.inkneldi.co/li/ 325 B
526 B 85ms
44ms XHR
text/html 193.169.255.250
WHF-LTD-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://acc.inkneldi.co/li/track
Requested by: Host: static.licdn.com
URL: https://static.licdn.com/sc/h/br/7iptgtauoer8as7pb8k008o4c
Protocol: HTTP/1.1
Security: , ,
Server: 193.169.255.250 , Poland, ASN210273 (WHF-LTD-AS, PL),
Reverse DNS
Software: Apache /
Resource Hash: 22efb437807cb4b863943eb83a66fdcd793de9c635235465b08ad825251e4b4e

Request headers

Csrf-Token
Origin: http://acc.inkneldi.co
Referer: http://acc.inkneldi.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&jtUxckWz1o0HkB6IPqumVEjUdkoY0VhtrCIcM5CEHP3wPW5J1Bc8exVltYYKiNumJ63QpnBYI7PW1cj3s3gTuMoxHJ3aWH91ylDQidgSCbszWZPr3oIYp1lQ1anqB5zuf1Bhrk6ALCJt&id=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type: application/json

Response headers

Date: Tue, 11 Jun 2019 17:52:33 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Content-Length: 325
Content-Type: text/html; charset=iso-8859-1

POST
H/1.1 404
Not Found track Show response
acc.inkneldi.co/li/ 325 B
525 B 42ms
42ms XHR
text/html 193.169.255.250
WHF-LTD-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://acc.inkneldi.co/li/track
Requested by: Host: static.licdn.com
URL: https://static.licdn.com/sc/h/br/7iptgtauoer8as7pb8k008o4c
Protocol: HTTP/1.1
Security: , ,
Server: 193.169.255.250 , Poland, ASN210273 (WHF-LTD-AS, PL),
Reverse DNS
Software: Apache /
Resource Hash: 22efb437807cb4b863943eb83a66fdcd793de9c635235465b08ad825251e4b4e

Request headers

Referer: http://acc.inkneldi.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&jtUxckWz1o0HkB6IPqumVEjUdkoY0VhtrCIcM5CEHP3wPW5J1Bc8exVltYYKiNumJ63QpnBYI7PW1cj3s3gTuMoxHJ3aWH91ylDQidgSCbszWZPr3oIYp1lQ1anqB5zuf1Bhrk6ALCJt&id=
Origin: http://acc.inkneldi.co
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
content-type: application/json

Response headers

Date: Tue, 11 Jun 2019 17:52:34 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=99
Content-Length: 325
Content-Type: text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: LinkedIn (Social Network)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	error	URL: https://static.licdn.com/sc/h/br/7iptgtauoer8as7pb8k008o4c(Line 10) Message: [object XMLHttpRequest]

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

acc.inkneldi.co
passport.alibaba.com
static.licdn.com
193.169.255.250
205.204.101.142
2a02:26f0:6c00:296::25ea
22efb437807cb4b863943eb83a66fdcd793de9c635235465b08ad825251e4b4e
4139df8117252f67227b567b992ac4966e29970a3083f9e742942e9fb1f68d61
48feb9b87add528faf37961c577d1aae240c9b339bc637ab2858cd86dc3bf99b
f165af10f04c3852fccb6500761ca16126a86acf7f6138e7c75a98caa33c0fa1
f22081906f87637d3fc7f822eedf67e37b3d9e2bb780bc533404e95f753b7433
fadf34ab3a5d0c22f46af87308c62bf8deb79e6c684f15963aeb656943eb51e4
fcaea8f8347e9e5ba2b3e7351379fc74fc4ddae29878307cad7ae85fdbfe132a

acc.inkneldi.co Open in urlscan Pro 193.169.255.250 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

9 Requests

56 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

82 kBTransfer

349 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

9 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

acc.inkneldi.co Open in urlscan Pro
193.169.255.250 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

56 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

82 kB
Transfer

349 kB
Size

0
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!