lionsdentv.com Open in urlscan Pro
2606:4700:3033::ac43:94b4  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. http://lionsdentv.com/wp-content/themes/twentynineteen/of/linkedin_/index.php?bfcos=%7B%7Bemail%7D%7D Page URL
2. http://lionsdentv.com/wp-content/themes/twentynineteen/of/linkedin_/login.php?s=mail&redirect=http%3A%2F%2Fmail3.nate.com%2F&email= Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Cookie set index.php Show response lionsdentv.com/wp-content/themes/twentynineteen/of/linkedin_/	270 B 895 B	65ms 43ms	Document text/html	2606:4700:3033::ac43:94b4 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://lionsdentv.com/wp-content/themes/twentynineteen/of/linkedin_/index.php?bfcos=%7B%7Bemail%7D%7D Protocol HTTP/1.1 Server 2606:4700:3033::ac43:94b4 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 42070217ab4c96ab09ade6dc69dd2a8860963a602067df89a357ed39e4dfd564 Request headers Host lionsdentv.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 14 Oct 2020 13:51:29 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive Set-Cookie __cfduid=d7fe35e4693a04a56b1196ad5d6265e431602683489; expires=Fri, 13-Nov-20 13:51:29 GMT; path=/; domain=.lionsdentv.com; HttpOnly; SameSite=Lax Vary Accept-Encoding CF-Cache-Status DYNAMIC cf-request-id 05c8fa65ba00002c2243210000000001 Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602683490"}],"group":"cf-nel","max_age":604800} NEL {"report_to":"cf-nel","max_age":604800} Server cloudflare CF-RAY 5e21c682ca0e2c22-FRA Content-Encoding gzip
GET H/1.1	200 OK	Primary Request login.php Show response lionsdentv.com/wp-content/themes/twentynineteen/of/linkedin_/	5 KB 2 KB	30ms 30ms	Document text/html	2606:4700:3033::ac43:94b4 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://lionsdentv.com/wp-content/themes/twentynineteen/of/linkedin_/login.php?s=mail&redirect=http%3A%2F%2Fmail3.nate.com%2F&email= Protocol HTTP/1.1 Server 2606:4700:3033::ac43:94b4 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7217dac0ce61365a33aac325f3fe41a52be2ebdae7a0dbc91bb8eb0159148e08 Request headers Host lionsdentv.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Referer http://lionsdentv.com/wp-content/themes/twentynineteen/of/linkedin_/index.php?bfcos=%7B%7Bemail%7D%7D Accept-Encoding gzip, deflate Accept-Language en-US Cookie __cfduid=d7fe35e4693a04a56b1196ad5d6265e431602683489 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer http://lionsdentv.com/wp-content/themes/twentynineteen/of/linkedin_/index.php?bfcos=%7B%7Bemail%7D%7D Response headers Date Wed, 14 Oct 2020 13:51:29 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive Vary Accept-Encoding CF-Cache-Status DYNAMIC cf-request-id 05c8fa65ee00002c226481e000000001 Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602683490"}],"group":"cf-nel","max_age":604800} NEL {"report_to":"cf-nel","max_age":604800} Server cloudflare CF-RAY 5e21c6831b2e2c22-FRA Content-Encoding gzip
GET H2	200	css fonts.googleapis.com/	19 KB 1 KB	18ms 17ms	Stylesheet text/css	2a00:1450:4001:820::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,600,700,300italic,400italic,600italic Requested by Host: lionsdentv.com URL: http://lionsdentv.com/wp-content/themes/twentynineteen/of/linkedin_/login.php?s=mail&redirect=http%3A%2F%2Fmail3.nate.com%2F&email= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:820::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash f301e96c5316037d2e81930f9f3d46f7b9c9685b9ea7914951c43263c1418f5a Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer http://lionsdentv.com/wp-content/themes/twentynineteen/of/linkedin_/login.php?s=mail&redirect=http%3A%2F%2Fmail3.nate.com%2F&email= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff status 200 alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Wed, 14 Oct 2020 13:00:27 GMT server ESF date Wed, 14 Oct 2020 13:51:29 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Wed, 14 Oct 2020 13:51:29 GMT
GET H/1.1	200 OK	0.png lionsdentv.com/wp-content/themes/twentynineteen/of/linkedin_/img/	23 KB 23 KB	38ms 37ms	Image image/png	2606:4700:3033::ac43:94b4 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL http://lionsdentv.com/wp-content/themes/twentynineteen/of/linkedin_/img/0.png Requested by Host: lionsdentv.com URL: http://lionsdentv.com/wp-content/themes/twentynineteen/of/linkedin_/login.php?s=mail&redirect=http%3A%2F%2Fmail3.nate.com%2F&email= Protocol HTTP/1.1 Server 2606:4700:3033::ac43:94b4 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 952348bc5cd806ee97090f95358709ce5125a0291deb77c787aa27f3770fd6b5 Request headers Referer http://lionsdentv.com/wp-content/themes/twentynineteen/of/linkedin_/login.php?s=mail&redirect=http%3A%2F%2Fmail3.nate.com%2F&email= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 14 Oct 2020 13:51:29 GMT CF-Cache-Status MISS Last-Modified Tue, 13 Oct 2020 10:03:33 GMT Server cloudflare Vary Accept-Encoding Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602683490"}],"group":"cf-nel","max_age":604800} Content-Type image/png Cache-Control max-age=14400 NEL {"report_to":"cf-nel","max_age":604800} Connection keep-alive Accept-Ranges bytes CF-RAY 5e21c6835be52c22-FRA Content-Length 23464 cf-request-id 05c8fa661400002c2224983000000001
GET H2	200	jquery.min.js Show response cdnjs.cloudflare.com/ajax/libs/jquery/3.1.0/	84 KB 27 KB	17ms 16ms	Script application/javascript	2606:4700::6811:4e6b CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/jquery/3.1.0/jquery.min.js Requested by Host: lionsdentv.com URL: http://lionsdentv.com/wp-content/themes/twentynineteen/of/linkedin_/login.php?s=mail&redirect=http%3A%2F%2Fmail3.nate.com%2F&email= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:4e6b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 702b9e051e82b32038ffdb33a4f7eb5f7b38f4cf6f514e4182d8898f4eb0b7fb Security Headers Name Value Strict-Transport-Security max-age=15780000; includeSubDomains Request headers Referer http://lionsdentv.com/wp-content/themes/twentynineteen/of/linkedin_/login.php?s=mail&redirect=http%3A%2F%2Fmail3.nate.com%2F&email= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 14 Oct 2020 13:51:29 GMT content-encoding br vary Accept-Encoding cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 1182786 x-via cfworker/kv status 200 alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 27198 cf-request-id 05c8fa66140000d6b5d10d8000000001 timing-allow-origin * last-modified Mon, 04 May 2020 16:11:48 GMT server cloudflare etag "5eb03ec4-1514f" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000; includeSubDomains report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602683490"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes cf-ray 5e21c6835da4d6b5-FRA expires Mon, 04 Oct 2021 13:51:29 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: LinkedIn (Social Network)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes function| $ function| jQuery function| process

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.lionsdentv.com/	1970-01-19 13:54:35	Name: __cfduid Value: d7fe35e4693a04a56b1196ad5d6265e431602683489

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
fonts.googleapis.com
lionsdentv.com
2606:4700:3033::ac43:94b4
2606:4700::6811:4e6b
2a00:1450:4001:820::200a
42070217ab4c96ab09ade6dc69dd2a8860963a602067df89a357ed39e4dfd564
702b9e051e82b32038ffdb33a4f7eb5f7b38f4cf6f514e4182d8898f4eb0b7fb
7217dac0ce61365a33aac325f3fe41a52be2ebdae7a0dbc91bb8eb0159148e08
952348bc5cd806ee97090f95358709ce5125a0291deb77c787aa27f3770fd6b5
f301e96c5316037d2e81930f9f3d46f7b9c9685b9ea7914951c43263c1418f5a