urlscan.io logo urlscan.io
SecurityTrails logo

lnks.gd Open in urlscan Pro
209.134.144.229  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://online.ecri.org/e2t/c/*W1WCzvL9j2LgHW2n0lpv2flq9X0/*W8yKbPh1CRK-BW7rGPyy17TbY00/5/f18dQhb0S65P7Bf-yPW12P0xN1RK73...
Effective URL: https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDAsInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkI...
Submission Tags: phishing malicious Search All
Submission: On May 11 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 3 HTTP transactions. The main IP is 209.134.144.229, located in South Saint Paul, United States and belongs to VISI-AS, US. The main domain is lnks.gd.
TLS certificate: Issued by GoGetSSL RSA DV CA on July 1st 2019. Valid for: a year.
This is the only time lnks.gd was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 2 2606:4700::68... 13335 (CLOUDFLAR...)
1 209.134.144.229 8015 (VISI-AS)
1 1 2606:4700:300... 13335 (CLOUDFLAR...)
1 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
3 3
Apex Domain
Subdomains		 Transfer
2 ecri.org
online.ecri.org
4 KB
1 ahrq.gov
www.ahrq.gov
1 fireeye.com
protect2.fireeye.com
435 B
1 lnks.gd
lnks.gd
968 B
3 4
Domain Requested by
2 online.ecri.org 1 redirects
1 www.ahrq.gov lnks.gd
1 protect2.fireeye.com 1 redirects
1 lnks.gd online.ecri.org
3 4

This site contains links to these domains. Also see Links.

Domain
protect2.fireeye.com
Subject Issuer Validity Valid
online.ecri.org
CloudFlare Inc ECC CA-2		 2019-12-18 -
2020-10-09		 10 months crt.sh
lnks.gd
GoGetSSL RSA DV CA		 2019-07-01 -
2020-07-22		 a year crt.sh
www.ahrq.gov
GeoTrust RSA CA 2018		 2020-02-27 -
2021-05-28		 a year crt.sh

This page contains 1 frames:

Frame: https://www.ahrq.gov/sites/default/files/wysiwyg/easy-to-understand-telehealth-consent-form.docx
Frame ID: 36E603E3BBD7470A417C300802500582
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://online.ecri.org/e2t/c/*W1WCzvL9j2LgHW2n0lpv2flq9X0/*W8yKbPh1CRK-BW7rGPyy17TbY00/5/f18dQhb0S6... Page URL
  2. https://online.ecri.org/events/public/v1/track/c/*W1WCzvL9j2LgHW2n0lpv2flq9X0/*W8yKbPh1CRK-BW7rGPyy1... HTTP 307
    https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDAsInVyaSI6ImJwMjpjbGlja... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i

Page Statistics

3
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

4 kB
Transfer

12 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://online.ecri.org/e2t/c/*W1WCzvL9j2LgHW2n0lpv2flq9X0/*W8yKbPh1CRK-BW7rGPyy17TbY00/5/f18dQhb0S65P7Bf-yPW12P0xN1RK73CW76DYpn1tbj5BN88pCKLS3HF9W5FbG5f6474F0W30XGv98TNr4gW8np0BF8rpbfYW7zwsHB3s01QQW79TjtN87-DTzW4vB0Rq1g0Y6YW17FNm94yprHGW4s8_zQ999H9hW85ryGS3qHXvyW4k07F-4LY_MsW1XJkYV7wN7LjW5mCsn_8YDZg9W6LcX0n1PT6JVW8lztnB2QcB60W7SWclN5sgjtXVH8FSx1xMkFdW6JPpnw9gcbq1W7502j52gsKVLW54L7L_2fMbnGW1zh9WF8JjW0hW9h3Gkb8-t_jLW5l9S8W8SxQJYW2Z8zhT8hnWdPW2pd2f66CbKMqW7qkPW47ZGmlpN3tMfDcVy6-lW35t2xx2P0zgzW5lW2l91PzTcPN3fSGy8NcYsjW5L8w5m12FGdbW7CzQ5M7SgxpHW37qhd-6bh8vGW1-4mkT2-kT14W3yK5b266sfGSN5Q50_FhZrnWW7nC3Wz14BH3gW5HmdQ46N3bRcN5Wc3mp8T5ZlN2Klybm6VYNWW8_Td_v7_QZv_W8Cg9Y45p0RkdW7PQt0q6Fz3DsN3YN0zRp0tm7W3MPlrt1N232RW35pqHY2MCWKLW1BTL_c5bQNwFVnz6wm1CRpqHW2Ft42C9k-vRPW4bG1yD71nd5kVTrxdN2pB6F5W1n9qPf3jJl97VmpQLm6_HnjSW6Q4bXl2JtqTyN4jR9p4ddH0qW5k8n1f874sPsMW5zGPgTH2RW2vvkTK4hjpM_W5p-XQC6xPk6dN8Z72628bpLDN6xJsk3Sh_9XW6BftD52PWTTgW4Gyfj15S84VNW5YmFCP8NVwLSN8ZHKNdD9RWTW3LGz4L67y7JmW1lt3h5447hfMVJRpb08p_5hHW40qvpZ1G3BsTW6yl45n16jjWkW1BvSB55Bd351W1ybptN8x26mmVbfdCZ1N8JMwW6G6qGm7Lk_WwW7JCYfM3_MgVLW3zMCGt5NWsmKN8L5Q9Xsx5X5W5DjCGs23q0c1W6SV3z38rt2KZW1McrdX4HyXTRW3G6Cpw9bSGX5W2hjhXp2kg6-hW8WS1PV90D5-8W2wzBMt2k3YzH131 Page URL
  2. https://online.ecri.org/events/public/v1/track/c/*W1WCzvL9j2LgHW2n0lpv2flq9X0/*W8yKbPh1CRK-BW7rGPyy17TbY00/5/f18dQhb0S65P7Bf-yPW12P0xN1RK73CW76DYpn1tbj5BN88pCKLS3HF9W5FbG5f6474F0W30XGv98TNr4gW8np0BF8rpbfYW7zwsHB3s01QQW79TjtN87-DTzW4vB0Rq1g0Y6YW17FNm94yprHGW4s8_zQ999H9hW85ryGS3qHXvyW4k07F-4LY_MsW1XJkYV7wN7LjW5mCsn_8YDZg9W6LcX0n1PT6JVW8lztnB2QcB60W7SWclN5sgjtXVH8FSx1xMkFdW6JPpnw9gcbq1W7502j52gsKVLW54L7L_2fMbnGW1zh9WF8JjW0hW9h3Gkb8-t_jLW5l9S8W8SxQJYW2Z8zhT8hnWdPW2pd2f66CbKMqW7qkPW47ZGmlpN3tMfDcVy6-lW35t2xx2P0zgzW5lW2l91PzTcPN3fSGy8NcYsjW5L8w5m12FGdbW7CzQ5M7SgxpHW37qhd-6bh8vGW1-4mkT2-kT14W3yK5b266sfGSN5Q50_FhZrnWW7nC3Wz14BH3gW5HmdQ46N3bRcN5Wc3mp8T5ZlN2Klybm6VYNWW8_Td_v7_QZv_W8Cg9Y45p0RkdW7PQt0q6Fz3DsN3YN0zRp0tm7W3MPlrt1N232RW35pqHY2MCWKLW1BTL_c5bQNwFVnz6wm1CRpqHW2Ft42C9k-vRPW4bG1yD71nd5kVTrxdN2pB6F5W1n9qPf3jJl97VmpQLm6_HnjSW6Q4bXl2JtqTyN4jR9p4ddH0qW5k8n1f874sPsMW5zGPgTH2RW2vvkTK4hjpM_W5p-XQC6xPk6dN8Z72628bpLDN6xJsk3Sh_9XW6BftD52PWTTgW4Gyfj15S84VNW5YmFCP8NVwLSN8ZHKNdD9RWTW3LGz4L67y7JmW1lt3h5447hfMVJRpb08p_5hHW40qvpZ1G3BsTW6yl45n16jjWkW1BvSB55Bd351W1ybptN8x26mmVbfdCZ1N8JMwW6G6qGm7Lk_WwW7JCYfM3_MgVLW3zMCGt5NWsmKN8L5Q9Xsx5X5W5DjCGs23q0c1W6SV3z38rt2KZW1McrdX4HyXTRW3G6Cpw9bSGX5W2hjhXp2kg6-hW8WS1PV90D5-8W2wzBMt2k3YzH131?_ud=39c011b6-0339-484a-8ab8-06aa90fc71bb&_ch=p&_pr2=p&_pl=0&_lg=en-US&_dr=b&_ts=p HTTP 307
    https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDAsInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDA1MDUuMjEwNDUyMDEiLCJ1cmwiOiJodHRwczovL3Byb3RlY3QyLmZpcmVleWUuY29tL3VybD9rPTUxOTA5NGQ2LTBkYzQ4ZGFhLTUxOTBhNWU5LTBjYzQ3YWRjNWZhMi0zNGMwNzMyMjVjNGNjYWViJnU9aHR0cHM6Ly93d3cuYWhycS5nb3Yvc2l0ZXMvZGVmYXVsdC9maWxlcy93eXNpd3lnL2Vhc3ktdG8tdW5kZXJzdGFuZC10ZWxlaGVhbHRoLWNvbnNlbnQtZm9ybS5kb2N4In0.65AqXc-Rw4Yy2Bp7AYJ0_gZ0vF2bRz8fxJMOZT58R2A/br/78222737457-l?utm_campaign=Physician%20Practice%20eNews&utm_source=hs_email&utm_medium=email&utm_content=87726482&_hsenc=p2ANqtz--KcvE0pER9_7chK5piHJcMhfqjkuBV9rUZmBwbBVL4j-TvkMN2ua6rizfrSIShJxlcG90pEwUV3MCNXQwBhUc9J4EQgw&_hsmi=87726482 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1
  • https://protect2.fireeye.com/url?k=519094d6-0dc48daa-5190a5e9-0cc47adc5fa2-34c073225c4ccaeb&u=https://www.ahrq.gov/sites/default/files/wysiwyg/easy-to-understand-telehealth-consent-form.docx HTTP 302
  • https://www.ahrq.gov/sites/default/files/wysiwyg/easy-to-understand-telehealth-consent-form.docx

3 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
f18dQhb0S65P7Bf-yPW12P0xN1RK73CW76DYpn1tbj5BN88pCKLS3HF9W5FbG5f6474F0W30XGv98TNr4gW8np0BF8rpbfYW7zwsHB3s01QQW79TjtN87-DTzW4vB0Rq1g0Y6YW17FNm94yprHGW4s8_zQ999H9hW85ryGS3qHXvyW4k07F-4LY_MsW1XJkYV7wN7...
online.ecri.org/e2t/c/*W1WCzvL9j2LgHW2n0lpv2flq9X0/*W8yKbPh1CRK-BW7rGPyy17TbY00/5/ 		12 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://online.ecri.org/e2t/c/*W1WCzvL9j2LgHW2n0lpv2flq9X0/*W8yKbPh1CRK-BW7rGPyy17TbY00/5/f18dQhb0S65P7Bf-yPW12P0xN1RK73CW76DYpn1tbj5BN88pCKLS3HF9W5FbG5f6474F0W30XGv98TNr4gW8np0BF8rpbfYW7zwsHB3s01QQW79TjtN87-DTzW4vB0Rq1g0Y6YW17FNm94yprHGW4s8_zQ999H9hW85ryGS3qHXvyW4k07F-4LY_MsW1XJkYV7wN7LjW5mCsn_8YDZg9W6LcX0n1PT6JVW8lztnB2QcB60W7SWclN5sgjtXVH8FSx1xMkFdW6JPpnw9gcbq1W7502j52gsKVLW54L7L_2fMbnGW1zh9WF8JjW0hW9h3Gkb8-t_jLW5l9S8W8SxQJYW2Z8zhT8hnWdPW2pd2f66CbKMqW7qkPW47ZGmlpN3tMfDcVy6-lW35t2xx2P0zgzW5lW2l91PzTcPN3fSGy8NcYsjW5L8w5m12FGdbW7CzQ5M7SgxpHW37qhd-6bh8vGW1-4mkT2-kT14W3yK5b266sfGSN5Q50_FhZrnWW7nC3Wz14BH3gW5HmdQ46N3bRcN5Wc3mp8T5ZlN2Klybm6VYNWW8_Td_v7_QZv_W8Cg9Y45p0RkdW7PQt0q6Fz3DsN3YN0zRp0tm7W3MPlrt1N232RW35pqHY2MCWKLW1BTL_c5bQNwFVnz6wm1CRpqHW2Ft42C9k-vRPW4bG1yD71nd5kVTrxdN2pB6F5W1n9qPf3jJl97VmpQLm6_HnjSW6Q4bXl2JtqTyN4jR9p4ddH0qW5k8n1f874sPsMW5zGPgTH2RW2vvkTK4hjpM_W5p-XQC6xPk6dN8Z72628bpLDN6xJsk3Sh_9XW6BftD52PWTTgW4Gyfj15S84VNW5YmFCP8NVwLSN8ZHKNdD9RWTW3LGz4L67y7JmW1lt3h5447hfMVJRpb08p_5hHW40qvpZ1G3BsTW6yl45n16jjWkW1BvSB55Bd351W1ybptN8x26mmVbfdCZ1N8JMwW6G6qGm7Lk_WwW7JCYfM3_MgVLW3zMCGt5NWsmKN8L5Q9Xsx5X5W5DjCGs23q0c1W6SV3z38rt2KZW1McrdX4HyXTRW3G6Cpw9bSGX5W2hjhXp2kg6-hW8WS1PV90D5-8W2wzBMt2k3YzH131
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:70b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
58aa24084224b1191786cf1b986ab4829facb15937ba63109ba45169a5510bdc

Request headers

:method
GET
:authority
online.ecri.org
:scheme
https
:path
/e2t/c/*W1WCzvL9j2LgHW2n0lpv2flq9X0/*W8yKbPh1CRK-BW7rGPyy17TbY00/5/f18dQhb0S65P7Bf-yPW12P0xN1RK73CW76DYpn1tbj5BN88pCKLS3HF9W5FbG5f6474F0W30XGv98TNr4gW8np0BF8rpbfYW7zwsHB3s01QQW79TjtN87-DTzW4vB0Rq1g0Y6YW17FNm94yprHGW4s8_zQ999H9hW85ryGS3qHXvyW4k07F-4LY_MsW1XJkYV7wN7LjW5mCsn_8YDZg9W6LcX0n1PT6JVW8lztnB2QcB60W7SWclN5sgjtXVH8FSx1xMkFdW6JPpnw9gcbq1W7502j52gsKVLW54L7L_2fMbnGW1zh9WF8JjW0hW9h3Gkb8-t_jLW5l9S8W8SxQJYW2Z8zhT8hnWdPW2pd2f66CbKMqW7qkPW47ZGmlpN3tMfDcVy6-lW35t2xx2P0zgzW5lW2l91PzTcPN3fSGy8NcYsjW5L8w5m12FGdbW7CzQ5M7SgxpHW37qhd-6bh8vGW1-4mkT2-kT14W3yK5b266sfGSN5Q50_FhZrnWW7nC3Wz14BH3gW5HmdQ46N3bRcN5Wc3mp8T5ZlN2Klybm6VYNWW8_Td_v7_QZv_W8Cg9Y45p0RkdW7PQt0q6Fz3DsN3YN0zRp0tm7W3MPlrt1N232RW35pqHY2MCWKLW1BTL_c5bQNwFVnz6wm1CRpqHW2Ft42C9k-vRPW4bG1yD71nd5kVTrxdN2pB6F5W1n9qPf3jJl97VmpQLm6_HnjSW6Q4bXl2JtqTyN4jR9p4ddH0qW5k8n1f874sPsMW5zGPgTH2RW2vvkTK4hjpM_W5p-XQC6xPk6dN8Z72628bpLDN6xJsk3Sh_9XW6BftD52PWTTgW4Gyfj15S84VNW5YmFCP8NVwLSN8ZHKNdD9RWTW3LGz4L67y7JmW1lt3h5447hfMVJRpb08p_5hHW40qvpZ1G3BsTW6yl45n16jjWkW1BvSB55Bd351W1ybptN8x26mmVbfdCZ1N8JMwW6G6qGm7Lk_WwW7JCYfM3_MgVLW3zMCGt5NWsmKN8L5Q9Xsx5X5W5DjCGs23q0c1W6SV3z38rt2KZW1McrdX4HyXTRW3G6Cpw9bSGX5W2hjhXp2kg6-hW8WS1PV90D5-8W2wzBMt2k3YzH131
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
date
Mon, 11 May 2020 17:49:52 GMT
content-type
text/html;charset=utf-8
set-cookie
__cfduid=da13d5c3fc56720ffe63750354b8a21a41589219392; expires=Wed, 10-Jun-20 17:49:52 GMT; path=/; domain=.online.ecri.org; HttpOnly; SameSite=Lax __cfruid=984a477bd742c127a7f332224a90b249396cbfaf-1589219392; path=/; domain=.online.ecri.org; HttpOnly; Secure; SameSite=None
cf-ray
591dbd3399d9062d-FRA
vary
Accept-Encoding
cf-cache-status
MISS
access-control-allow-credentials
false
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
referrer-policy
no-referrer
server
cloudflare
content-encoding
br
cf-request-id
02a674943f0000062d59a43200000001
Primary Request 78222737457-l
lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDAsInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDA1MDUuMjEwNDUyMDEiLCJ1cmwiOiJodHRwczovL3Byb3RlY3QyLmZpcmVleWUuY29tL3VybD9rPTUxOTA5NG...
Redirect Chain
  • https://online.ecri.org/events/public/v1/track/c/*W1WCzvL9j2LgHW2n0lpv2flq9X0/*W8yKbPh1CRK-BW7rGPyy17TbY00/5/f18dQhb0S65P7Bf-yPW12P0xN1RK73CW76DYpn1tbj5BN88pCKLS3HF9W5FbG5f6474F0W30XGv98TNr4gW8np0B...
  • https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDAsInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDA1MDUuMjEwNDUyMDEiLCJ1cmwiOiJodHRwczovL3Byb3RlY3QyLmZpcmVleWUuY29tL3VybD9rPT...
488 B
968 B 		Document
General
Check archive.org
Download Go to
Full URL
https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDAsInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDA1MDUuMjEwNDUyMDEiLCJ1cmwiOiJodHRwczovL3Byb3RlY3QyLmZpcmVleWUuY29tL3VybD9rPTUxOTA5NGQ2LTBkYzQ4ZGFhLTUxOTBhNWU5LTBjYzQ3YWRjNWZhMi0zNGMwNzMyMjVjNGNjYWViJnU9aHR0cHM6Ly93d3cuYWhycS5nb3Yvc2l0ZXMvZGVmYXVsdC9maWxlcy93eXNpd3lnL2Vhc3ktdG8tdW5kZXJzdGFuZC10ZWxlaGVhbHRoLWNvbnNlbnQtZm9ybS5kb2N4In0.65AqXc-Rw4Yy2Bp7AYJ0_gZ0vF2bRz8fxJMOZT58R2A/br/78222737457-l?utm_campaign=Physician%20Practice%20eNews&utm_source=hs_email&utm_medium=email&utm_content=87726482&_hsenc=p2ANqtz--KcvE0pER9_7chK5piHJcMhfqjkuBV9rUZmBwbBVL4j-TvkMN2ua6rizfrSIShJxlcG90pEwUV3MCNXQwBhUc9J4EQgw&_hsmi=87726482
Requested by
Host: online.ecri.org
URL: https://online.ecri.org/e2t/c/*W1WCzvL9j2LgHW2n0lpv2flq9X0/*W8yKbPh1CRK-BW7rGPyy17TbY00/5/f18dQhb0S65P7Bf-yPW12P0xN1RK73CW76DYpn1tbj5BN88pCKLS3HF9W5FbG5f6474F0W30XGv98TNr4gW8np0BF8rpbfYW7zwsHB3s01QQW79TjtN87-DTzW4vB0Rq1g0Y6YW17FNm94yprHGW4s8_zQ999H9hW85ryGS3qHXvyW4k07F-4LY_MsW1XJkYV7wN7LjW5mCsn_8YDZg9W6LcX0n1PT6JVW8lztnB2QcB60W7SWclN5sgjtXVH8FSx1xMkFdW6JPpnw9gcbq1W7502j52gsKVLW54L7L_2fMbnGW1zh9WF8JjW0hW9h3Gkb8-t_jLW5l9S8W8SxQJYW2Z8zhT8hnWdPW2pd2f66CbKMqW7qkPW47ZGmlpN3tMfDcVy6-lW35t2xx2P0zgzW5lW2l91PzTcPN3fSGy8NcYsjW5L8w5m12FGdbW7CzQ5M7SgxpHW37qhd-6bh8vGW1-4mkT2-kT14W3yK5b266sfGSN5Q50_FhZrnWW7nC3Wz14BH3gW5HmdQ46N3bRcN5Wc3mp8T5ZlN2Klybm6VYNWW8_Td_v7_QZv_W8Cg9Y45p0RkdW7PQt0q6Fz3DsN3YN0zRp0tm7W3MPlrt1N232RW35pqHY2MCWKLW1BTL_c5bQNwFVnz6wm1CRpqHW2Ft42C9k-vRPW4bG1yD71nd5kVTrxdN2pB6F5W1n9qPf3jJl97VmpQLm6_HnjSW6Q4bXl2JtqTyN4jR9p4ddH0qW5k8n1f874sPsMW5zGPgTH2RW2vvkTK4hjpM_W5p-XQC6xPk6dN8Z72628bpLDN6xJsk3Sh_9XW6BftD52PWTTgW4Gyfj15S84VNW5YmFCP8NVwLSN8ZHKNdD9RWTW3LGz4L67y7JmW1lt3h5447hfMVJRpb08p_5hHW40qvpZ1G3BsTW6yl45n16jjWkW1BvSB55Bd351W1ybptN8x26mmVbfdCZ1N8JMwW6G6qGm7Lk_WwW7JCYfM3_MgVLW3zMCGt5NWsmKN8L5Q9Xsx5X5W5DjCGs23q0c1W6SV3z38rt2KZW1McrdX4HyXTRW3G6Cpw9bSGX5W2hjhXp2kg6-hW8WS1PV90D5-8W2wzBMt2k3YzH131
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.134.144.229 South Saint Paul, United States, ASN8015 (VISI-AS, US),
Reverse DNS
hyrule.govdelivery.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
1b70aa39cbd56a1dc98881e35a5af53ecff4904b7ed5b1fb9f942df340da350b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Host
lnks.gd
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://online.ecri.org/e2t/c/*W1WCzvL9j2LgHW2n0lpv2flq9X0/*W8yKbPh1CRK-BW7rGPyy17TbY00/5/f18dQhb0S65P7Bf-yPW12P0xN1RK73CW76DYpn1tbj5BN88pCKLS3HF9W5FbG5f6474F0W30XGv98TNr4gW8np0BF8rpbfYW7zwsHB3s01QQW79TjtN87-DTzW4vB0Rq1g0Y6YW17FNm94yprHGW4s8_zQ999H9hW85ryGS3qHXvyW4k07F-4LY_MsW1XJkYV7wN7LjW5mCsn_8YDZg9W6LcX0n1PT6JVW8lztnB2QcB60W7SWclN5sgjtXVH8FSx1xMkFdW6JPpnw9gcbq1W7502j52gsKVLW54L7L_2fMbnGW1zh9WF8JjW0hW9h3Gkb8-t_jLW5l9S8W8SxQJYW2Z8zhT8hnWdPW2pd2f66CbKMqW7qkPW47ZGmlpN3tMfDcVy6-lW35t2xx2P0zgzW5lW2l91PzTcPN3fSGy8NcYsjW5L8w5m12FGdbW7CzQ5M7SgxpHW37qhd-6bh8vGW1-4mkT2-kT14W3yK5b266sfGSN5Q50_FhZrnWW7nC3Wz14BH3gW5HmdQ46N3bRcN5Wc3mp8T5ZlN2Klybm6VYNWW8_Td_v7_QZv_W8Cg9Y45p0RkdW7PQt0q6Fz3DsN3YN0zRp0tm7W3MPlrt1N232RW35pqHY2MCWKLW1BTL_c5bQNwFVnz6wm1CRpqHW2Ft42C9k-vRPW4bG1yD71nd5kVTrxdN2pB6F5W1n9qPf3jJl97VmpQLm6_HnjSW6Q4bXl2JtqTyN4jR9p4ddH0qW5k8n1f874sPsMW5zGPgTH2RW2vvkTK4hjpM_W5p-XQC6xPk6dN8Z72628bpLDN6xJsk3Sh_9XW6BftD52PWTTgW4Gyfj15S84VNW5YmFCP8NVwLSN8ZHKNdD9RWTW3LGz4L67y7JmW1lt3h5447hfMVJRpb08p_5hHW40qvpZ1G3BsTW6yl45n16jjWkW1BvSB55Bd351W1ybptN8x26mmVbfdCZ1N8JMwW6G6qGm7Lk_WwW7JCYfM3_MgVLW3zMCGt5NWsmKN8L5Q9Xsx5X5W5DjCGs23q0c1W6SV3z38rt2KZW1McrdX4HyXTRW3G6Cpw9bSGX5W2hjhXp2kg6-hW8WS1PV90D5-8W2wzBMt2k3YzH131

Response headers

Date
Mon, 11 May 2020 17:49:53 GMT
Server
Apache/2.2.15 (CentOS)
Referer
lnks.gd
Referrer-Policy
origin
ETag
W/"1b70aa39cbd56a1dc98881e35a5af53e"
Cache-Control
max-age=0, private, must-revalidate
X-Request-Id
883987b7-2377-4675-93ff-96524cfaf5f6
X-Runtime
0.004346
X-Served-By
prod-hyruleweb5.ep.gdi
Connection
close
Transfer-Encoding
chunked
Content-Type
text/html;charset=utf-8
Strict-Transport-Security
max-age=31536000

Redirect headers

status
307
date
Mon, 11 May 2020 17:49:52 GMT
location
https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDAsInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDA1MDUuMjEwNDUyMDEiLCJ1cmwiOiJodHRwczovL3Byb3RlY3QyLmZpcmVleWUuY29tL3VybD9rPTUxOTA5NGQ2LTBkYzQ4ZGFhLTUxOTBhNWU5LTBjYzQ3YWRjNWZhMi0zNGMwNzMyMjVjNGNjYWViJnU9aHR0cHM6Ly93d3cuYWhycS5nb3Yvc2l0ZXMvZGVmYXVsdC9maWxlcy93eXNpd3lnL2Vhc3ktdG8tdW5kZXJzdGFuZC10ZWxlaGVhbHRoLWNvbnNlbnQtZm9ybS5kb2N4In0.65AqXc-Rw4Yy2Bp7AYJ0_gZ0vF2bRz8fxJMOZT58R2A/br/78222737457-l?utm_campaign=Physician%20Practice%20eNews&utm_source=hs_email&utm_medium=email&utm_content=87726482&_hsenc=p2ANqtz--KcvE0pER9_7chK5piHJcMhfqjkuBV9rUZmBwbBVL4j-TvkMN2ua6rizfrSIShJxlcG90pEwUV3MCNXQwBhUc9J4EQgw&_hsmi=87726482
cf-ray
591dbd340ba8062d-FRA
link
<https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDAsInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDA1MDUuMjEwNDUyMDEiLCJ1cmwiOiJodHRwczovL3Byb3RlY3QyLmZpcmVleWUuY29tL3VybD9rPTUxOTA5NGQ2LTBkYzQ4ZGFhLTUxOTBhNWU5LTBjYzQ3YWRjNWZhMi0zNGMwNzMyMjVjNGNjYWViJnU9aHR0cHM6Ly93d3cuYWhycS5nb3Yvc2l0ZXMvZGVmYXVsdC9maWxlcy93eXNpd3lnL2Vhc3ktdG8tdW5kZXJzdGFuZC10ZWxlaGVhbHRoLWNvbnNlbnQtZm9ybS5kb2N4In0.65AqXc-Rw4Yy2Bp7AYJ0_gZ0vF2bRz8fxJMOZT58R2A/br/78222737457-l?utm_campaign=Physician%20Practice%20eNews&utm_source=hs_email&utm_medium=email&utm_content=87726482&_hsenc=p2ANqtz--KcvE0pER9_7chK5piHJcMhfqjkuBV9rUZmBwbBVL4j-TvkMN2ua6rizfrSIShJxlcG90pEwUV3MCNXQwBhUc9J4EQgw&_hsmi=87726482>; rel="canonical"
vary
Accept-Encoding
cf-cache-status
MISS
access-control-allow-credentials
false
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
referrer-policy
no-referrer
x-robots-tag
none
server
cloudflare
cf-request-id
02a67494840000062d59a4a200000001
easy-to-understand-telehealth-consent-form.docx
www.ahrq.gov/sites/default/files/wysiwyg/
Redirect Chain
  • https://protect2.fireeye.com/url?k=519094d6-0dc48daa-5190a5e9-0cc47adc5fa2-34c073225c4ccaeb&u=https://www.ahrq.gov/sites/default/files/wysiwyg/easy-to-understand-telehealth-consent-form.docx
  • https://www.ahrq.gov/sites/default/files/wysiwyg/easy-to-understand-telehealth-consent-form.docx
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.ahrq.gov/sites/default/files/wysiwyg/easy-to-understand-telehealth-consent-form.docx
Requested by
Host: lnks.gd
URL: https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDAsInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDA1MDUuMjEwNDUyMDEiLCJ1cmwiOiJodHRwczovL3Byb3RlY3QyLmZpcmVleWUuY29tL3VybD9rPTUxOTA5NGQ2LTBkYzQ4ZGFhLTUxOTBhNWU5LTBjYzQ3YWRjNWZhMi0zNGMwNzMyMjVjNGNjYWViJnU9aHR0cHM6Ly93d3cuYWhycS5nb3Yvc2l0ZXMvZGVmYXVsdC9maWxlcy93eXNpd3lnL2Vhc3ktdG8tdW5kZXJzdGFuZC10ZWxlaGVhbHRoLWNvbnNlbnQtZm9ybS5kb2N4In0.65AqXc-Rw4Yy2Bp7AYJ0_gZ0vF2bRz8fxJMOZT58R2A/br/78222737457-l?utm_campaign=Physician%20Practice%20eNews&utm_source=hs_email&utm_medium=email&utm_content=87726482&_hsenc=p2ANqtz--KcvE0pER9_7chK5piHJcMhfqjkuBV9rUZmBwbBVL4j-TvkMN2ua6rizfrSIShJxlcG90pEwUV3MCNXQwBhUc9J4EQgw&_hsmi=87726482
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:183::2bdc , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software
Apache /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

:method
GET
:authority
www.ahrq.gov
:scheme
https
:path
/sites/default/files/wysiwyg/easy-to-understand-telehealth-consent-form.docx
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://lnks.gd/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDAsInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDA1MDUuMjEwNDUyMDEiLCJ1cmwiOiJodHRwczovL3Byb3RlY3QyLmZpcmVleWUuY29tL3VybD9rPTUxOTA5NGQ2LTBkYzQ4ZGFhLTUxOTBhNWU5LTBjYzQ3YWRjNWZhMi0zNGMwNzMyMjVjNGNjYWViJnU9aHR0cHM6Ly93d3cuYWhycS5nb3Yvc2l0ZXMvZGVmYXVsdC9maWxlcy93eXNpd3lnL2Vhc3ktdG8tdW5kZXJzdGFuZC10ZWxlaGVhbHRoLWNvbnNlbnQtZm9ybS5kb2N4In0.65AqXc-Rw4Yy2Bp7AYJ0_gZ0vF2bRz8fxJMOZT58R2A/br/78222737457-l?utm_campaign=Physician%20Practice%20eNews&utm_source=hs_email&utm_medium=email&utm_content=87726482&_hsenc=p2ANqtz--KcvE0pER9_7chK5piHJcMhfqjkuBV9rUZmBwbBVL4j-TvkMN2ua6rizfrSIShJxlcG90pEwUV3MCNXQwBhUc9J4EQgw&_hsmi=87726482

Response headers

status
200
content-type
application/vnd.openxmlformats-officedocument.wordprocessingml.document
content-length
27241
server
Apache
x-frame-options
SAMEORIGIN
x-content-type-options
nosniff
last-modified
Wed, 15 Apr 2020 14:00:07 GMT
etag
"6a69-5a354bbce67c0"
accept-ranges
bytes
cache-control
max-age=2470909
expires
Tue, 09 Jun 2020 08:11:43 GMT
date
Mon, 11 May 2020 17:49:54 GMT
strict-transport-security
max-age=31536000

Redirect headers

status
302
date
Mon, 11 May 2020 17:49:54 GMT
content-type
text/html; charset=UTF-8
set-cookie
__cfduid=d96a812fb850ce9fc258f9d9da750d6161589219393; expires=Wed, 10-Jun-20 17:49:53 GMT; path=/; domain=.fireeye.com; HttpOnly; SameSite=Lax; Secure
x-fireeye-faude
Benign
location
https://www.ahrq.gov/sites/default/files/wysiwyg/easy-to-understand-telehealth-consent-form.docx
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
server
cloudflare
cf-ray
591dbd385d4897e4-FRA
cf-request-id
02a6749737000097e414322200000001

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

0 Cookies

1 Console Messages

Source Level URL
Text
console-api debug URL: https://online.ecri.org/e2t/c/*W1WCzvL9j2LgHW2n0lpv2flq9X0/*W8yKbPh1CRK-BW7rGPyy17TbY00/5/f18dQhb0S65P7Bf-yPW12P0xN1RK73CW76DYpn1tbj5BN88pCKLS3HF9W5FbG5f6474F0W30XGv98TNr4gW8np0BF8rpbfYW7zwsHB3s01QQW79TjtN87-DTzW4vB0Rq1g0Y6YW17FNm94yprHGW4s8_zQ999H9hW85ryGS3qHXvyW4k07F-4LY_MsW1XJkYV7wN7LjW5mCsn_8YDZg9W6LcX0n1PT6JVW8lztnB2QcB60W7SWclN5sgjtXVH8FSx1xMkFdW6JPpnw9gcbq1W7502j52gsKVLW54L7L_2fMbnGW1zh9WF8JjW0hW9h3Gkb8-t_jLW5l9S8W8SxQJYW2Z8zhT8hnWdPW2pd2f66CbKMqW7qkPW47ZGmlpN3tMfDcVy6-lW35t2xx2P0zgzW5lW2l91PzTcPN3fSGy8NcYsjW5L8w5m12FGdbW7CzQ5M7SgxpHW37qhd-6bh8vGW1-4mkT2-kT14W3yK5b266sfGSN5Q50_FhZrnWW7nC3Wz14BH3gW5HmdQ46N3bRcN5Wc3mp8T5ZlN2Klybm6VYNWW8_Td_v7_QZv_W8Cg9Y45p0RkdW7PQt0q6Fz3DsN3YN0zRp0tm7W3MPlrt1N232RW35pqHY2MCWKLW1BTL_c5bQNwFVnz6wm1CRpqHW2Ft42C9k-vRPW4bG1yD71nd5kVTrxdN2pB6F5W1n9qPf3jJl97VmpQLm6_HnjSW6Q4bXl2JtqTyN4jR9p4ddH0qW5k8n1f874sPsMW5zGPgTH2RW2vvkTK4hjpM_W5p-XQC6xPk6dN8Z72628bpLDN6xJsk3Sh_9XW6BftD52PWTTgW4Gyfj15S84VNW5YmFCP8NVwLSN8ZHKNdD9RWTW3LGz4L67y7JmW1lt3h5447hfMVJRpb08p_5hHW40qvpZ1G3BsTW6yl45n16jjWkW1BvSB55Bd351W1ybptN8x26mmVbfdCZ1N8JMwW6G6qGm7Lk_WwW7JCYfM3_MgVLW3zMCGt5NWsmKN8L5Q9Xsx5X5W5DjCGs23q0c1W6SV3z38rt2KZW1McrdX4HyXTRW3G6Cpw9bSGX5W2hjhXp2kg6-hW8WS1PV90D5-8W2wzBMt2k3YzH131(Line 13)
Message:
toS

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

lnks.gd
online.ecri.org
protect2.fireeye.com
www.ahrq.gov
209.134.144.229
2606:4700:300b::a29f:f77d
2606:4700::6811:70b4
2a02:26f0:6c00:183::2bdc
1b70aa39cbd56a1dc98881e35a5af53ecff4904b7ed5b1fb9f942df340da350b
58aa24084224b1191786cf1b986ab4829facb15937ba63109ba45169a5510bdc