flher.com Open in urlscan Pro
192.185.187.72 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://flher.com/phpupgrader/normal/
Submission: On September 24 via automatic, source phishtank (September 24th 2021, 5:06:37 am UTC) — Scanned from DE

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 11 HTTP transactions. The main IP is 192.185.187.72, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is flher.com.
TLS certificate: Issued by R3 on September 14th 2021. Valid for: 3 months.

This is the only time flher.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: LinkedIn (Social Network) Generic (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 4	192.185.187.72 192.185.187.72	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
7	40.90.64.5 40.90.64.5	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	216.58.212.141 216.58.212.141	15169 (GOOGLE) (GOOGLE)
11	3

4 192.185.187.72 (United States) 1 redirects

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 192-185-187-72.unifiedlayer.com

flher.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 40.90.64.5 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

static-exp1.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.212.141 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: ams15s21-in-f13.1e100.net

accounts.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	licdn.com static-exp1.licdn.com	158 KB
4	flher.com 1 redirects flher.com	47 KB
1	google.com accounts.google.com	1 KB
11	3

	Domain	Requested by
7	static-exp1.licdn.com	flher.com static-exp1.licdn.com
4	flher.com	1 redirects flher.com static-exp1.licdn.com
1	accounts.google.com	static-exp1.licdn.com
11	3

This site contains no links.

Subject Issuer	Validity	Valid
flher.com R3	`2021-09-14` - `2021-12-13`	3 months	crt.sh
static.licdn.com DigiCert SHA2 Secure Server CA	`2021-09-06` - `2022-03-06`	6 months	crt.sh
accounts.google.com GTS CA 1C3	`2021-08-30` - `2021-11-22`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://flher.com/phpupgrader/normal/
Frame ID: 3E723C39ABBAAED21CDE23B1C63BA7C1
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

LinkedIn Login, Sign in | LinkedIn

Page URL History Show full URLs

https://flher.com/phpupgrader/normal HTTP 301
https://flher.com/phpupgrader/normal/ Page URL

Page Statistics

11
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

206 kB
Transfer

803 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://flher.com/phpupgrader/normal HTTP 301
https://flher.com/phpupgrader/normal/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
flher.com/phpupgrader/normal/
Redirect Chain

https://flher.com/phpupgrader/normal
https://flher.com/phpupgrader/normal/

42 KB
32 KB

442ms
441ms

Document
text/html

192.185.187.72
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://flher.com/phpupgrader/normal/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.185.187.72 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 192-185-187-72.unifiedlayer.com
Software: Apache /
Resource Hash: 12ddd170dad183588929866cd86eef28bf2d9b31351f185dcaa33e236f35534d

Request headers

:method: GET
:authority: flher.com
:scheme: https
:path: /phpupgrader/normal/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

date: Fri, 24 Sep 2021 05:06:32 GMT
server: Apache
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html; charset=UTF-8

Redirect headers

date: Fri, 24 Sep 2021 05:06:31 GMT
server: Apache
location: https://flher.com/phpupgrader/normal/
content-length: 245
content-type: text/html; charset=iso-8859-1

GET
H2 200 login.js Show response
flher.com/phpupgrader/normal/js/ 20 KB
8 KB 234ms
234ms Script
application/javascript 192.185.187.72
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://flher.com/phpupgrader/normal/js/login.js
Requested by: Host: flher.com
URL: https://flher.com/phpupgrader/normal/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.185.187.72 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 192-185-187-72.unifiedlayer.com
Software: Apache /
Resource Hash: 847c86ae982abe9180233276125b930b4a1b6f1bd12649b0c07535c1e984def8

Request headers

:path: /phpupgrader/normal/js/login.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: flher.com
referer: https://flher.com/phpupgrader/normal/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://flher.com/phpupgrader/normal/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 24 Sep 2021 05:06:32 GMT
content-encoding: gzip
last-modified: Thu, 21 Jun 2018 02:29:08 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 7931

GET
H2 200 6u4abakrebm97iir18d17rmu0
static-exp1.licdn.com/sc/h/ 206 KB
19 KB 437ms
209ms Stylesheet
text/css 40.90.64.5
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://static-exp1.licdn.com/sc/h/6u4abakrebm97iir18d17rmu0
Requested by: Host: flher.com
URL: https://flher.com/phpupgrader/normal/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 40.90.64.5 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Play /
Resource Hash: 9edf0e1fc3ef5062d6aef1b537226c289970b6bb7bb5cd0f1855ad8fadecdd42

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://flher.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-li-proto: http/1.1
date: Fri, 24 Sep 2021 05:06:32 GMT
content-encoding: br
content-type: text/css
x-cdn-client-ip-version: IPV4
x-azure-ref-originshield: 02VxNYQAAAADux+MnQhAHRpEzVEGR9SDNTE9OMjFFREdFMDIwOQBhZjBmYjI1NS1jMDAxLTQ3OWMtOWE3ZC00OThkMDg0NmVmNzQ=
x-cache: TCP_MISS
x-cdn-proto: HTTP2
content-length: 18941
x-li-uuid: K9SN9bappxageldPIisAAA==
server: Play
timing-allow-origin: *
x-cdn: AZUR
last-modified: Mon, 05 Nov 2012 04:00:51 GMT
x-li-pop: afd-prod-edc2
x-azure-ref: 02VxNYQAAAACIYlY/ZhFnRIzehpPBpbU0RlJBMzFFREdFMDQyMABhZjBmYjI1NS1jMDAxLTQ3OWMtOWE3ZC00OThkMDg0NmVmNzQ=
x-li-fabric: prod-lva1
access-control-allow-origin: *
access-control-expose-headers: X-CDN, X-CDN-CLIENT-IP-VERSION, X-CDN-Proto
cache-control: max-age=31536000, immutable
x-li-static-content: 1
x-fs-uuid: d413e536c2888f16b0ae870d8f2b0000
expires: Thu, 07 Jul 2022 14:32:38 GMT

GET
H2 200 9z2qszoigwown5438iofxsbd3 Show response
static-exp1.licdn.com/sc/h/ 134 KB
33 KB 467ms
240ms Script
text/javascript 40.90.64.5
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://static-exp1.licdn.com/sc/h/9z2qszoigwown5438iofxsbd3
Requested by: Host: flher.com
URL: https://flher.com/phpupgrader/normal/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 40.90.64.5 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Play /
Resource Hash: 348df093a36c0b1c994a7d028a8db84e2f15715c3ede86d6338a20fe3eb7be32

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://flher.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-li-proto: http/1.1
date: Fri, 24 Sep 2021 05:06:32 GMT
content-encoding: br
content-type: text/javascript
x-cdn-client-ip-version: IPV4
x-cdn: AZUR
x-cache: TCP_MISS
x-cdn-proto: HTTP2
x-azure-ref-originshield: 02VxNYQAAAAAdkC1ozWVSQ7aYWn1kcu6vTE9OMjFFREdFMTUwOQBhZjBmYjI1NS1jMDAxLTQ3OWMtOWE3ZC00OThkMDg0NmVmNzQ=
x-li-uuid: M+C99bappxbwrw8VESsAAA==
server: Play
timing-allow-origin: *
last-modified: Mon, 05 Nov 2012 04:00:51 GMT
x-li-pop: afd-prod-edc2
x-azure-ref: 02VxNYQAAAADP1Rr7eDCHTIuFNw3t116GRlJBMzFFREdFMDQyMABhZjBmYjI1NS1jMDAxLTQ3OWMtOWE3ZC00OThkMDg0NmVmNzQ=
x-li-fabric: prod-lva1
access-control-allow-origin: *
access-control-expose-headers: X-CDN, X-CDN-CLIENT-IP-VERSION, X-CDN-Proto
cache-control: max-age=31536000, immutable
x-li-static-content: 1
x-fs-uuid: 33e0bdf5b6a9a716f0af0f15112b0000
expires: Sat, 24 Sep 2022 05:06:33 GMT

GET
H2 200 2qwdjwm18c9qqjkkqgthouslg Show response
static-exp1.licdn.com/sc/h/ 62 KB
19 KB 440ms
213ms Script
text/javascript 40.90.64.5
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://static-exp1.licdn.com/sc/h/2qwdjwm18c9qqjkkqgthouslg
Requested by: Host: flher.com
URL: https://flher.com/phpupgrader/normal/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 40.90.64.5 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Play /
Resource Hash: ffbf8b87d477b1f917e6358124494745533f7820946c87bab5e9817202356b8a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://flher.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-li-proto: http/1.1
date: Fri, 24 Sep 2021 05:06:32 GMT
content-encoding: br
content-type: text/javascript
x-cdn-client-ip-version: IPV4
x-cdn: AZUR
x-cache: TCP_MISS
x-cdn-proto: HTTP2
x-azure-ref-originshield: 02VxNYQAAAACE5x3As5wZRqyVdCbZARyMTE9OMjFFREdFMDIxMgBhZjBmYjI1NS1jMDAxLTQ3OWMtOWE3ZC00OThkMDg0NmVmNzQ=
x-li-uuid: cf5f9LappxZQU6jpMSsAAA==
server: Play
timing-allow-origin: *
last-modified: Mon, 05 Nov 2012 04:00:51 GMT
x-li-pop: afd-prod-eda6
x-azure-ref: 02VxNYQAAAABaaNk5egKqTaRUAtfQVeLcRlJBMzFFREdFMDQyMABhZjBmYjI1NS1jMDAxLTQ3OWMtOWE3ZC00OThkMDg0NmVmNzQ=
x-li-fabric: prod-ltx1
access-control-allow-origin: *
access-control-expose-headers: X-CDN, X-CDN-CLIENT-IP-VERSION, X-CDN-Proto
cache-control: max-age=31536000, immutable
x-li-static-content: 1
x-fs-uuid: 71fe5ff4b6a9a7165053a8e9312b0000
expires: Sat, 24 Sep 2022 05:06:33 GMT

GET
H2 200 6jblk5oqhlo45xbkmcr7s4zix Show response
static-exp1.licdn.com/sc/h/ 64 KB
14 KB 237ms
10ms Script
text/javascript 40.90.64.5
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://static-exp1.licdn.com/sc/h/6jblk5oqhlo45xbkmcr7s4zix
Requested by: Host: flher.com
URL: https://flher.com/phpupgrader/normal/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 40.90.64.5 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Play /
Resource Hash: 2072637eca86b31333f03dd2f363993776d87ec85be0f0970d80a08347cbe43f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://flher.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-li-proto: http/1.1
date: Fri, 24 Sep 2021 05:06:32 GMT
content-encoding: br
content-type: text/javascript
x-cdn-client-ip-version: IPV4
x-azure-ref-originshield: 0fAFNYQAAAABWlddYw9uhSIpbkNm+O6/PTE9OMjFFREdFMDIxOABhZjBmYjI1NS1jMDAxLTQ3OWMtOWE3ZC00OThkMDg0NmVmNzQ=
x-cache: TCP_HIT
x-cdn-proto: HTTP2
content-length: 13554
x-li-uuid: TjtlPENypxZwb4VODysAAA==
server: Play
timing-allow-origin: *
x-cdn: AZUR
last-modified: Mon, 05 Nov 2012 04:00:51 GMT
x-li-pop: afd-prod-edc2
x-azure-ref: 02VxNYQAAAABD3fvuk8fmTJhYGAIKXGdhRlJBMzFFREdFMDQyMABhZjBmYjI1NS1jMDAxLTQ3OWMtOWE3ZC00OThkMDg0NmVmNzQ=
x-li-fabric: prod-lva1
access-control-allow-origin: *
access-control-expose-headers: X-CDN, X-CDN-CLIENT-IP-VERSION, X-CDN-Proto
cache-control: max-age=31536000, immutable
x-li-static-content: 1
x-fs-uuid: aef71f463ed5a616e0b3ecf8d82a0000
expires: Wed, 21 Sep 2022 12:12:58 GMT

GET
H2 200 eifp0ukycgmm5y0uay3omxuap Show response
static-exp1.licdn.com/sc/h/ 1 KB
728 B 443ms
217ms Script
text/javascript 40.90.64.5
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://static-exp1.licdn.com/sc/h/eifp0ukycgmm5y0uay3omxuap
Requested by: Host: flher.com
URL: https://flher.com/phpupgrader/normal/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 40.90.64.5 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Play /
Resource Hash: 99c52046d1df362721eb275cabcd169c7e105d0bbaf374a7c9f96ddf6c1216f2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://flher.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-li-proto: http/1.1
date: Fri, 24 Sep 2021 05:06:32 GMT
content-encoding: br
content-type: text/javascript
x-cdn-client-ip-version: IPV4
x-cdn: AZUR
x-cache: TCP_MISS
x-cdn-proto: HTTP2
x-azure-ref-originshield: 02VxNYQAAAADRjwnuIuBbS5h7HRtID0K4TE9OMjFFREdFMTUxNwBhZjBmYjI1NS1jMDAxLTQ3OWMtOWE3ZC00OThkMDg0NmVmNzQ=
x-li-uuid: d7OF9LappxbAtSuICCsAAA==
server: Play
timing-allow-origin: *
last-modified: Mon, 05 Nov 2012 04:00:51 GMT
x-li-pop: afd-prod-eda6
x-azure-ref: 02VxNYQAAAABSMwEuvKUHQJxDvH/YS2CPRlJBMzFFREdFMDQyMABhZjBmYjI1NS1jMDAxLTQ3OWMtOWE3ZC00OThkMDg0NmVmNzQ=
x-li-fabric: prod-ltx1
access-control-allow-origin: *
access-control-expose-headers: X-CDN, X-CDN-CLIENT-IP-VERSION, X-CDN-Proto
cache-control: max-age=31536000, immutable
x-li-static-content: 1
x-fs-uuid: 77b385f4b6a9a716c0b52b88082b0000
expires: Sat, 24 Sep 2022 05:06:33 GMT

GET
H2 200 z5z0fyn9degkqxthacxz44e4 Show response
static-exp1.licdn.com/sc/h/ 73 KB
22 KB 442ms
215ms Script
text/javascript 40.90.64.5
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://static-exp1.licdn.com/sc/h/z5z0fyn9degkqxthacxz44e4
Requested by: Host: flher.com
URL: https://flher.com/phpupgrader/normal/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 40.90.64.5 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Play /
Resource Hash: c07f4c4caa7bf62915a154289d26250b2ae256215175e2f413cd5e664c94bde2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://flher.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-li-proto: http/1.1
date: Fri, 24 Sep 2021 05:06:32 GMT
content-encoding: br
content-type: text/javascript
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-azure-ref-originshield: 02VxNYQAAAACkSrOb7073QKV30rskN0ECTE9OMjFFREdFMDEyMQBhZjBmYjI1NS1jMDAxLTQ3OWMtOWE3ZC00OThkMDg0NmVmNzQ=
x-cache: TCP_MISS
x-cdn-proto: HTTP2
x-li-uuid: F64m9LappxbwiudWQCsAAA==
server: Play
timing-allow-origin: *
x-cdn: AZUR
last-modified: Mon, 05 Nov 2012 04:00:51 GMT
x-li-pop: afd-prod-eda6
x-cdn-client-ip-version: IPV4
x-azure-ref: 02VxNYQAAAACZXrfRmdjjRK5ysWBIAxcKRlJBMzFFREdFMDQyMABhZjBmYjI1NS1jMDAxLTQ3OWMtOWE3ZC00OThkMDg0NmVmNzQ=
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-fabric: prod-ltx1
access-control-allow-origin: *
access-control-expose-headers: X-CDN, X-CDN-CLIENT-IP-VERSION, X-CDN-Proto
cache-control: max-age=31536000, immutable
x-li-static-content: 1
x-fs-uuid: 17ae26f4b6a9a716f08ae756402b0000
expires: Sat, 24 Sep 2022 05:06:33 GMT

GET
H2 200 50seqnxcfadh00enh9ffvk85k Show response
static-exp1.licdn.com/sc/h/ 181 KB
51 KB 218ms
218ms Script
text/javascript 40.90.64.5
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://static-exp1.licdn.com/sc/h/50seqnxcfadh00enh9ffvk85k
Requested by: Host: static-exp1.licdn.com
URL: https://static-exp1.licdn.com/sc/h/9z2qszoigwown5438iofxsbd3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 40.90.64.5 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Play /
Resource Hash: 597c946522dec4cf136d651c70944887b7e30adfb8aa5196815b0225283e1253

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://flher.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-li-proto: http/1.1
date: Fri, 24 Sep 2021 05:06:32 GMT
content-encoding: br
content-type: text/javascript
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-azure-ref-originshield: 02VxNYQAAAAC1dIVobvMORLMCUPj+bSBPTE9OMjFFREdFMTUwNgBhZjBmYjI1NS1jMDAxLTQ3OWMtOWE3ZC00OThkMDg0NmVmNzQ=
x-cache: TCP_MISS
x-cdn-proto: HTTP2
content-length: 51508
x-li-uuid: QIqlBbeppxYQMsWPeSsAAA==
server: Play
timing-allow-origin: *
x-cdn: AZUR
last-modified: Mon, 05 Nov 2012 04:00:51 GMT
x-li-pop: afd-prod-edc2
x-cdn-client-ip-version: IPV4
x-azure-ref: 02VxNYQAAAACZcIhoq4CuTLT+gdjOT5PkRlJBMzFFREdFMDQyMABhZjBmYjI1NS1jMDAxLTQ3OWMtOWE3ZC00OThkMDg0NmVmNzQ=
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-fabric: prod-lva1
access-control-allow-origin: *
access-control-expose-headers: X-CDN, X-CDN-CLIENT-IP-VERSION, X-CDN-Proto
cache-control: max-age=31536000, immutable
x-li-static-content: 1
x-fs-uuid: b866e0ba7c429c16e05347f65b2b0000
expires: Thu, 18 Aug 2022 01:31:08 GMT

GET
H2 403 status Show response
accounts.google.com/gsi/ 37 B
1 KB 103ms
68ms XHR
application/json 216.58.212.141
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com/gsi/status?client_id=990339570472-k6nqn1tpmitg8pui82bfaun3jrpmiuhs.apps.googleusercontent.com&as=dUipIHELxe%2BDZrcPGvoyRw

Requested by

Host: static-exp1.licdn.com
URL: https://static-exp1.licdn.com/sc/h/50seqnxcfadh00enh9ffvk85k

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.141 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s21-in-f13.1e100.net

Software

ESF /

Resource Hash

e560c57bebcf62a2881bef18e3fd1d40eeba1617d30f6eb06692fffbe6fc2dc1

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-oJNjK8iFzhCV8SQaHtyWXw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://flher.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 24 Sep 2021 05:06:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
content-disposition: attachment; filename="json.txt"; filename*=UTF-8''json.txt
access-control-allow-methods: GET
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
pragma: no-cache
server: ESF
x-frame-options: SAMEORIGIN
report-to: {"group":"AZM8irbR9Gle1C1FGJ23R1ZcwHxvBRvSqdZnWlscJT4XdPD5yXy2ffqdkh-Cm5Y5sA","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8irbR9Gle1C1FGJ23R1ZcwHxvBRvSqdZnWlscJT4XdPD5yXy2ffqdkh-Cm5Y5sA"}]}
content-type: application/json; charset=utf-8
access-control-allow-origin: https://flher.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-security-policy: script-src 'report-sample' 'nonce-oJNjK8iFzhCV8SQaHtyWXw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
cross-origin-opener-policy-report-only: same-origin; report-to="AZM8irbR9Gle1C1FGJ23R1ZcwHxvBRvSqdZnWlscJT4XdPD5yXy2ffqdkh-Cm5Y5sA"
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H2 404 track Show response
flher.com/li/ 21 KB
7 KB 429ms
429ms XHR
text/html 192.185.187.72
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://flher.com/li/track
Requested by: Host: static-exp1.licdn.com
URL: https://static-exp1.licdn.com/sc/h/9z2qszoigwown5438iofxsbd3
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.185.187.72 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 192-185-187-72.unifiedlayer.com
Software: Apache /
Resource Hash: b8d18860f69aee7463305d7cb39edd9b4c32cdc988a7b3d4054ae9c6c04edc46

Request headers

sec-fetch-mode: cors
origin: https://flher.com
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
sec-fetch-dest: empty
content-length: 588
:path: /li/track
pragma: no-cache
cache-control: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
content-type: application/json
accept: */*
csrf-token
:authority: flher.com
referer: https://flher.com/phpupgrader/normal/
:scheme: https
sec-fetch-site: same-origin
:method: POST
Csrf-Token
Referer: https://flher.com/phpupgrader/normal/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-type: application/json

Response headers

date: Fri, 24 Sep 2021 05:06:33 GMT
content-encoding: gzip
server: Apache
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate, max-age=0
link: <https://flher.com/wp-json/>; rel="https://api.w.org/"
content-length: 6840
expires: Wed, 11 Jan 1984 05:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: LinkedIn (Social Network) Generic (Online)

27 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.google.com/	1970-01-20 01:51:11	Name: NID Value: 224=y1tepYrcxyxT-63nDPHorBsE0mUdRv2YtkVivJh11XJ5wyQ8auNVjeaiRIPMCAwnyi3fYo7YznVfk5FCAyzykviwv4LdZjvBhZtGIcbczIFzAKBvMBpaPi0c6vubsWRs43CW0_YJKweZxhSpsgL6kAPfX2Oi8REiVBLg_oF8qco

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
deprecation	warning	URL: https://static-exp1.licdn.com/sc/h/6jblk5oqhlo45xbkmcr7s4zix Message: RTP data channels are no longer supported. The "RtpDataChannels" constraint is currently ignored, and may cause an error at a later date.
network	error	URL: https://accounts.google.com/gsi/status?client_id=990339570472-k6nqn1tpmitg8pui82bfaun3jrpmiuhs.apps.googleusercontent.com&as=dUipIHELxe%2BDZrcPGvoyRw Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://flher.com/li/track Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

accounts.google.com
flher.com
static-exp1.licdn.com
192.185.187.72
216.58.212.141
40.90.64.5
12ddd170dad183588929866cd86eef28bf2d9b31351f185dcaa33e236f35534d
2072637eca86b31333f03dd2f363993776d87ec85be0f0970d80a08347cbe43f
348df093a36c0b1c994a7d028a8db84e2f15715c3ede86d6338a20fe3eb7be32
597c946522dec4cf136d651c70944887b7e30adfb8aa5196815b0225283e1253
847c86ae982abe9180233276125b930b4a1b6f1bd12649b0c07535c1e984def8
99c52046d1df362721eb275cabcd169c7e105d0bbaf374a7c9f96ddf6c1216f2
9edf0e1fc3ef5062d6aef1b537226c289970b6bb7bb5cd0f1855ad8fadecdd42
b8d18860f69aee7463305d7cb39edd9b4c32cdc988a7b3d4054ae9c6c04edc46
c07f4c4caa7bf62915a154289d26250b2ae256215175e2f413cd5e664c94bde2
e560c57bebcf62a2881bef18e3fd1d40eeba1617d30f6eb06692fffbe6fc2dc1
ffbf8b87d477b1f917e6358124494745533f7820946c87bab5e9817202356b8a

flher.com Open in urlscan Pro 192.185.187.72 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

11 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

1 Countries

206 kBTransfer

803 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

27 JavaScript Global Variables

1 Cookies

3 Console Messages

Indicators

flher.com Open in urlscan Pro
192.185.187.72 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

206 kB
Transfer

803 kB
Size

1
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!