linnworks.vpz.co.uk Open in urlscan Pro
31.193.7.114 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://ow.ly/I3cS30qBuGw
Effective URL:
https://linnworks.vpz.co.uk/vendor/americanexpress/Amex-kisho/home/?platform=hootsuite&_branch_match_id=783766667171547767
Submission: On April 28 via manual (April 28th 2020, 7:39:41 pm UTC) from US

Summary HTTP 7 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 7 HTTP transactions. The main IP is 31.193.7.114, located in United Kingdom and belongs to SECARMA, GB. The main domain is linnworks.vpz.co.uk.
TLS certificate: Issued by cPanel, Inc. Certification Authority on February 28th 2020. Valid for: 3 months.

This is the only time linnworks.vpz.co.uk was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: American Express (Financial)

Domain & IP information

	IP Address		AS Autonomous System
1 1	54.183.131.91 54.183.131.91		16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:21f... 2600:9000:21f3:c000:19:9934:6a80:93a1		16509 (AMAZON-02) (AMAZON-02)
6	31.193.7.114 31.193.7.114		61323 (SECARMA) (SECARMA)
7	2

1 54.183.131.91 (San Jose, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ow.ly

ow.ly	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:21f3:c000:19:9934:6a80:93a1 (United States)

ASN16509 (AMAZON-02, US)

4fz6z.app.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 31.193.7.114 (United Kingdom)

ASN61323 (SECARMA, GB)
PTR: mail.vpddirect.co.uk

linnworks.vpz.co.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	vpz.co.uk linnworks.vpz.co.uk	321 KB
1	app.link 4fz6z.app.link	1 KB
1	ow.ly 1 redirects ow.ly	126 B
7	3

	Domain	Requested by
6	linnworks.vpz.co.uk	4fz6z.app.link linnworks.vpz.co.uk
1	4fz6z.app.link
1	ow.ly	1 redirects
7	3

This site contains no links.

Subject Issuer	Validity	Valid
appipv4.link Amazon	`2019-08-19` - `2020-09-19`	a year	crt.sh
linnworks.vpz.co.uk cPanel, Inc. Certification Authority	`2020-02-28` - `2020-05-28`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://linnworks.vpz.co.uk/vendor/americanexpress/Amex-kisho/home/?platform=hootsuite&_branch_match_id=783766667171547767
Frame ID: B3B7FDDB207E6F4F615C8F9A532E517E
Requests: 6 HTTP requests in this frame

Frame: https://linnworks.vpz.co.uk/vendor/americanexpress/Amex-kisho/home/://open?link_click_id=783766667171547767
Frame ID: 8BB88E3CF598A29B04746B86174EEE11
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://ow.ly/I3cS30qBuGw HTTP 301
https://4fz6z.app.link/?platform=hootsuite Page URL
https://linnworks.vpz.co.uk/vendor/americanexpress/Amex-kisho/home/?platform=hootsuite&_branch_match_id=... Page URL

Detected technologies

Lua (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

OpenResty (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

Amazon Web Services (PaaS) Expand

Overall confidence: 100%
Detected patterns

headers via /\(CloudFront\)$/i

Amazon Cloudfront (CDN) Expand

Overall confidence: 100%
Detected patterns

headers via /\(CloudFront\)$/i

Page Statistics

7
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

322 kB
Transfer

321 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://ow.ly/I3cS30qBuGw HTTP 301
https://4fz6z.app.link/?platform=hootsuite Page URL
https://linnworks.vpz.co.uk/vendor/americanexpress/Amex-kisho/home/?platform=hootsuite&_branch_match_id=783766667171547767 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://ow.ly/I3cS30qBuGw HTTP 301
https://4fz6z.app.link/?platform=hootsuite

7 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Cookie set / 4fz6z.app.link/ Redirect Chain http://ow.ly/I3cS30qBuGw https://4fz6z.app.link/?platform=hootsuite	2 KB 1 KB	137ms 136ms	Document text/html	2600:9000:21f3:c000:19:9934:6a80:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://4fz6z.app.link/?platform=hootsuite Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:9000:21f3:c000:19:9934:6a80:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software openresty/1.13.6.2 / Express Resource Hash Request headers Host 4fz6z.app.link Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type text/html; charset=utf-8 Transfer-Encoding chunked Connection keep-alive Vary Accept-Encoding Server openresty/1.13.6.2 Date Tue, 28 Apr 2020 19:39:21 GMT X-Powered-By Express Set-Cookie _s=6u957Fzl3YJkj0vWIyuf%2F5JpWgGJchW62nkjBi8HAcXzFlt%2FHP5P0EmTk80IDeal; Max-Age=31536000; Domain=.app.link; Path=/; Expires=Wed, 28 Apr 2021 19:39:21 GMT Last-Modified Tue, 28 Apr 2020 19:39:21 GMT Content-Encoding gzip X-Cache Miss from cloudfront Via 1.1 ff2bcb2d3b4a3d9e0615ddd1033c38c4.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA2-C2 X-Amz-Cf-Id DCziCp_QOFRow0dfGDHQWRBMdHT_T6Oyf6cjEeuQRd1vfhAJrUfHpA== Redirect headers Location https://4fz6z.app.link/?platform=hootsuite Connection close Content-Length 0
GET H/1.1	404 Not Found	open linnworks.vpz.co.uk/vendor/americanexpress/Amex-kisho/home/:// Frame 8BB8	0 0	310ms 158ms	Document text/html	31.193.7.114 SECARMA
General Check archive.org Show headers Download Go to Full URL https://linnworks.vpz.co.uk/vendor/americanexpress/Amex-kisho/home/://open?link_click_id=783766667171547767 Requested by Host: 4fz6z.app.link URL: https://4fz6z.app.link/?platform=hootsuite Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 31.193.7.114 , United Kingdom, ASN61323 (SECARMA, GB), Reverse DNS mail.vpddirect.co.uk Software Apache/2.4.43 (cPanel) OpenSSL/1.1.1g mod_bwlimited/1.4 / Resource Hash Request headers Host linnworks.vpz.co.uk Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Sec-Fetch-Dest iframe Referer https://4fz6z.app.link/?platform=hootsuite Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer https://4fz6z.app.link/?platform=hootsuite Response headers Date Tue, 28 Apr 2020 19:39:22 GMT Server Apache/2.4.43 (cPanel) OpenSSL/1.1.1g mod_bwlimited/1.4 Cache-Control no-cache, private Keep-Alive timeout=5, max=100 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	Primary Request Cookie set / Show response linnworks.vpz.co.uk/vendor/americanexpress/Amex-kisho/home/	2 KB 2 KB	162ms 147ms	Document text/html	31.193.7.114 SECARMA
General Check archive.org Show headers Download Go to Full URL https://linnworks.vpz.co.uk/vendor/americanexpress/Amex-kisho/home/?platform=hootsuite&_branch_match_id=783766667171547767 Requested by Host: 4fz6z.app.link URL: https://4fz6z.app.link/?platform=hootsuite Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 31.193.7.114 , United Kingdom, ASN61323 (SECARMA, GB), Reverse DNS mail.vpddirect.co.uk Software Apache/2.4.43 (cPanel) OpenSSL/1.1.1g mod_bwlimited/1.4 / Resource Hash `b88805ce9930037b5f9bdcc57663ac8056ae50c7cf9542875759aa263495889c` Request headers Host linnworks.vpz.co.uk Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Sec-Fetch-Dest document Referer https://4fz6z.app.link/?platform=hootsuite Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer https://4fz6z.app.link/?platform=hootsuite Response headers Date Tue, 28 Apr 2020 19:39:22 GMT Server Apache/2.4.43 (cPanel) OpenSSL/1.1.1g mod_bwlimited/1.4 Set-Cookie mycounter=Checked; expires=Wed, 29-Apr-2020 19:39:22 GMT; Max-Age=86400 Keep-Alive timeout=5, max=99 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	head.PNG linnworks.vpz.co.uk/vendor/americanexpress/Amex-kisho/home/images/	8 KB 8 KB	80ms 74ms	Image image/png	31.193.7.114 SECARMA
General Check archive.org Show headers Download Go to Show image Full URL https://linnworks.vpz.co.uk/vendor/americanexpress/Amex-kisho/home/images/head.PNG Requested by Host: linnworks.vpz.co.uk URL: https://linnworks.vpz.co.uk/vendor/americanexpress/Amex-kisho/home/?platform=hootsuite&_branch_match_id=783766667171547767 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 31.193.7.114 , United Kingdom, ASN61323 (SECARMA, GB), Reverse DNS mail.vpddirect.co.uk Software Apache/2.4.43 (cPanel) OpenSSL/1.1.1g mod_bwlimited/1.4 / Resource Hash `38d24ecdfeb3ccc75c799de1e034772a46e258c658a911e1fe029329eebe672e` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host linnworks.vpz.co.uk Accept-Language en-US User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Mode no-cors Accept image/webp,image/apng,image/,/;q=0.8 Cache-Control* no-cache Sec-Fetch-Dest image Referer https://linnworks.vpz.co.uk/vendor/americanexpress/Amex-kisho/home/?platform=hootsuite&_branch_match_id=783766667171547767 Cookie mycounter=Checked Connection keep-alive Referer https://linnworks.vpz.co.uk/vendor/americanexpress/Amex-kisho/home/?platform=hootsuite&_branch_match_id=783766667171547767 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Tue, 28 Apr 2020 19:39:22 GMT Last-Modified Mon, 27 Apr 2020 13:58:39 GMT Server Apache/2.4.43 (cPanel) OpenSSL/1.1.1g mod_bwlimited/1.4 ETag "12ac0e-1ff6-5a4461cb12261" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 8182
GET H/1.1	200 OK	main.PNG linnworks.vpz.co.uk/vendor/americanexpress/Amex-kisho/home/images/	241 KB 242 KB	80ms 76ms	Image image/png	31.193.7.114 SECARMA
General Check archive.org Show headers Download Go to Show image Full URL https://linnworks.vpz.co.uk/vendor/americanexpress/Amex-kisho/home/images/main.PNG Requested by Host: linnworks.vpz.co.uk URL: https://linnworks.vpz.co.uk/vendor/americanexpress/Amex-kisho/home/?platform=hootsuite&_branch_match_id=783766667171547767 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 31.193.7.114 , United Kingdom, ASN61323 (SECARMA, GB), Reverse DNS mail.vpddirect.co.uk Software Apache/2.4.43 (cPanel) OpenSSL/1.1.1g mod_bwlimited/1.4 / Resource Hash `f3381d0d3c26b613f3bef7c554127a6c7043b81650b5bfb34203ad225356add9` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host linnworks.vpz.co.uk Accept-Language en-US User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Mode no-cors Accept image/webp,image/apng,image/,/;q=0.8 Cache-Control* no-cache Sec-Fetch-Dest image Referer https://linnworks.vpz.co.uk/vendor/americanexpress/Amex-kisho/home/?platform=hootsuite&_branch_match_id=783766667171547767 Cookie mycounter=Checked Connection keep-alive Referer https://linnworks.vpz.co.uk/vendor/americanexpress/Amex-kisho/home/?platform=hootsuite&_branch_match_id=783766667171547767 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Tue, 28 Apr 2020 19:39:22 GMT Last-Modified Mon, 27 Apr 2020 13:58:39 GMT Server Apache/2.4.43 (cPanel) OpenSSL/1.1.1g mod_bwlimited/1.4 ETag "12abf6-3c5f7-5a4461cafb719" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 247287
GET H/1.1	200 OK	sign.PNG linnworks.vpz.co.uk/vendor/americanexpress/Amex-kisho/home/images/	1 KB 2 KB	154ms 75ms	Image image/png	31.193.7.114 SECARMA
General Check archive.org Show headers Download Go to Show image Full URL https://linnworks.vpz.co.uk/vendor/americanexpress/Amex-kisho/home/images/sign.PNG Requested by Host: linnworks.vpz.co.uk URL: https://linnworks.vpz.co.uk/vendor/americanexpress/Amex-kisho/home/?platform=hootsuite&_branch_match_id=783766667171547767 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 31.193.7.114 , United Kingdom, ASN61323 (SECARMA, GB), Reverse DNS mail.vpddirect.co.uk Software Apache/2.4.43 (cPanel) OpenSSL/1.1.1g mod_bwlimited/1.4 / Resource Hash `5feada6664eee041d84e1ee25ff66df39b1e9322730ac2e573e76aa8bad5269e` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host linnworks.vpz.co.uk Accept-Language en-US User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Mode no-cors Accept image/webp,image/apng,image/,/;q=0.8 Cache-Control* no-cache Sec-Fetch-Dest image Referer https://linnworks.vpz.co.uk/vendor/americanexpress/Amex-kisho/home/?platform=hootsuite&_branch_match_id=783766667171547767 Cookie mycounter=Checked Connection keep-alive Referer https://linnworks.vpz.co.uk/vendor/americanexpress/Amex-kisho/home/?platform=hootsuite&_branch_match_id=783766667171547767 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Tue, 28 Apr 2020 19:39:22 GMT Last-Modified Mon, 27 Apr 2020 13:58:39 GMT Server Apache/2.4.43 (cPanel) OpenSSL/1.1.1g mod_bwlimited/1.4 ETag "12ac06-553-5a4461cb0ad31" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 1363
GET H/1.1	200 OK	footer.PNG linnworks.vpz.co.uk/vendor/americanexpress/Amex-kisho/home/images/	66 KB 67 KB	225ms 75ms	Image image/png	31.193.7.114 SECARMA
General Check archive.org Show headers Download Go to Show image Full URL https://linnworks.vpz.co.uk/vendor/americanexpress/Amex-kisho/home/images/footer.PNG Requested by Host: linnworks.vpz.co.uk URL: https://linnworks.vpz.co.uk/vendor/americanexpress/Amex-kisho/home/?platform=hootsuite&_branch_match_id=783766667171547767 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 31.193.7.114 , United Kingdom, ASN61323 (SECARMA, GB), Reverse DNS mail.vpddirect.co.uk Software Apache/2.4.43 (cPanel) OpenSSL/1.1.1g mod_bwlimited/1.4 / Resource Hash `bd09c68a0c48de06d4bd56444551f4c536966eecc6d3219bb141da367960215e` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host linnworks.vpz.co.uk Accept-Language en-US User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Mode no-cors Accept image/webp,image/apng,image/,/;q=0.8 Cache-Control* no-cache Sec-Fetch-Dest image Referer https://linnworks.vpz.co.uk/vendor/americanexpress/Amex-kisho/home/?platform=hootsuite&_branch_match_id=783766667171547767 Cookie mycounter=Checked Connection keep-alive Referer https://linnworks.vpz.co.uk/vendor/americanexpress/Amex-kisho/home/?platform=hootsuite&_branch_match_id=783766667171547767 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Tue, 28 Apr 2020 19:39:22 GMT Last-Modified Mon, 27 Apr 2020 13:58:39 GMT Server Apache/2.4.43 (cPanel) OpenSSL/1.1.1g mod_bwlimited/1.4 ETag "12ac10-109aa-5a4461cb141a1" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 68010

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: American Express (Financial)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| unhideBody

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			linnworks.vpz.co.uk/vendor/americanexpress/Amex-kisho/home	1970-01-19 09:09:49	Name: mycounter Value: Checked

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

4fz6z.app.link
linnworks.vpz.co.uk
ow.ly
2600:9000:21f3:c000:19:9934:6a80:93a1
31.193.7.114
54.183.131.91
38d24ecdfeb3ccc75c799de1e034772a46e258c658a911e1fe029329eebe672e
5feada6664eee041d84e1ee25ff66df39b1e9322730ac2e573e76aa8bad5269e
b88805ce9930037b5f9bdcc57663ac8056ae50c7cf9542875759aa263495889c
bd09c68a0c48de06d4bd56444551f4c536966eecc6d3219bb141da367960215e
f3381d0d3c26b613f3bef7c554127a6c7043b81650b5bfb34203ad225356add9