universalpanelssystems.com
Open in
urlscan Pro
217.199.161.127
Malicious Activity!
Public Scan
Effective URL: http://universalpanelssystems.com/wp-includes/file/linkedin%20secure/317f2586d8993b99453da28275513327/u3whcst24tz5junvgdnvk6wi.php...
Submission: On June 01 via automatic, source openphish
Summary
This is the only time universalpanelssystems.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: LinkedIn (Social Network)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 3 | 217.199.161.127 217.199.161.127 | 20738 (GD-EMEA-D...) (GD-EMEA-DC-LD5) | |
15 | 2606:2800:233... 2606:2800:233:6a53:4ac1:3bc8:ee4e:5990 | 15133 (EDGECAST) (EDGECAST) | |
1 2 | 35.241.57.45 35.241.57.45 | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a01:4a0:1338... 2a01:4a0:1338:28::c38a:ff12 | 201011 (NETZBETRI...) (NETZBETRIEB-GMBH) | |
19 | 4 |
ASN20738 (GD-EMEA-DC-LD5, GB)
PTR: 063615.vps-10.com
universalpanelssystems.com |
ASN15169 (GOOGLE, US)
PTR: 45.57.241.35.bc.googleusercontent.com
radar.cedexis.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
15 |
licdn.com
static.licdn.com |
218 KB |
3 |
universalpanelssystems.com
2 redirects
universalpanelssystems.com |
9 KB |
2 |
linkedin.com
platform.linkedin.com |
2 KB |
2 |
cedexis.com
1 redirects
radar.cedexis.com |
291 B |
19 | 4 |
Domain | Requested by | |
---|---|---|
15 | static.licdn.com |
universalpanelssystems.com
|
3 | universalpanelssystems.com | 2 redirects |
2 | platform.linkedin.com |
static.licdn.com
|
2 | radar.cedexis.com |
1 redirects
universalpanelssystems.com
|
19 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.linkedin.com |
linkedin.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.licdn.com DigiCert SHA2 Secure Server CA |
2019-10-10 - 2021-10-14 |
2 years | crt.sh |
This page contains 2 frames:
Primary Page:
http://universalpanelssystems.com/wp-includes/file/linkedin%20secure/317f2586d8993b99453da28275513327/u3whcst24tz5junvgdnvk6wi.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&emailID=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Frame ID: 4F773A6AC3B63F735ACEBB36B1BCAB53
Requests: 18 HTTP requests in this frame
Frame:
http://radar.cedexis.com/1571758301/radar.html?customer-id=11326
Frame ID: 7AB602A91E7B8EFBC61B0EBEF0661BCD
Requests: 1 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://universalpanelssystems.com/wp-includes/file/linkedin%20secure/317f2586d8993b99453da28275513327
HTTP 301
http://universalpanelssystems.com/wp-includes/file/linkedin%20secure/317f2586d8993b99453da28275513327/ HTTP 302
http://universalpanelssystems.com/wp-includes/file/linkedin%20secure/317f2586d8993b99453da28275513327/u3whcst2... Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
8 Outgoing links
These are links going to different origins than the main page.
Title: LinkedIn Home
Search URL Search Domain Scan URL
Title: What is LinkedIn?
Search URL Search Domain Scan URL
Title: Sign In
Search URL Search Domain Scan URL
Title: User Agreement
Search URL Search Domain Scan URL
Title: Privacy Policy
Search URL Search Domain Scan URL
Title: Community Guidelines
Search URL Search Domain Scan URL
Title: Cookie Policy
Search URL Search Domain Scan URL
Title: Copyright Policy
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://universalpanelssystems.com/wp-includes/file/linkedin%20secure/317f2586d8993b99453da28275513327
HTTP 301
http://universalpanelssystems.com/wp-includes/file/linkedin%20secure/317f2586d8993b99453da28275513327/ HTTP 302
http://universalpanelssystems.com/wp-includes/file/linkedin%20secure/317f2586d8993b99453da28275513327/u3whcst24tz5junvgdnvk6wi.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&emailID=&.rand=13InboxLight.aspx?n=1774256418&fid=4 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 14- http://radar.cedexis.com/1/11326/radar/radar.html HTTP 302
- http://radar.cedexis.com/1571758301/radar.html?customer-id=11326
19 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
u3whcst24tz5junvgdnvk6wi.php
universalpanelssystems.com/wp-includes/file/linkedin%20secure/317f2586d8993b99453da28275513327/ Redirect Chain
|
19 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
static.licdn.com/scds/concat/common/ |
75 KB 13 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
static.licdn.com/scds/concat/common/ |
218 KB 21 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
static.licdn.com/scds/concat/common/ |
21 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
static.licdn.com/scds/concat/common/ |
90 KB 11 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
static.licdn.com/scds/concat/common/ |
1007 B 697 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
static.licdn.com/scds/concat/common/ |
9 KB 4 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
static.licdn.com/scds/concat/common/ |
5 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
static.licdn.com/scds/concat/common/ |
604 B 544 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
static.licdn.com/scds/concat/common/ |
1020 B 682 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
static.licdn.com/scds/concat/common/ |
33 KB 10 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
photo_splash_signin_1141x759_v4.jpg
static.licdn.com/scds/common/u/images/apps/uas/ |
140 KB 140 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo_linkedin_flat_white_93x21.png
static.licdn.com/scds/common/u/images/logos/linkedin/ |
544 B 710 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo_linkedin_242x59_v1.png
static.licdn.com/scds/common/u/images/logos/linkedin/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo_linkedin_white_trans_64x16_v1.png
static.licdn.com/scds/common/u/images/logos/ |
761 B 934 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
radar.html
radar.cedexis.com/1571758301/ Frame 7AB6 Redirect Chain
|
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
static.licdn.com/scds/concat/common/ |
25 KB 8 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
px.js
platform.linkedin.com/js/ |
1 KB 980 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
px.js
platform.linkedin.com/js/ |
1 KB 981 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: LinkedIn (Social Network)21 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate object| __li__lix_registry__ object| __li__i18n_registry__ object| __li__config_registry__ object| CONFIGS object| data object| debug object| events object| helpers object| sandbox object| deploy object| public_API function| sandboxControlInit object| remote_nav object| sandboxedLI undefined| langSwitch object| LI object| jsRandomCalculator object| BOOMR object| abp1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
universalpanelssystems.com/ | Name: PHPSESSID Value: qkaq6rehln7u1gq729ks4vfv20 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
platform.linkedin.com
radar.cedexis.com
static.licdn.com
universalpanelssystems.com
217.199.161.127
2606:2800:233:6a53:4ac1:3bc8:ee4e:5990
2a01:4a0:1338:28::c38a:ff12
35.241.57.45
00fb9a9faf4c43a4f19dd3dfca527a8cd0ddfe34087acf32227a04e3e5c688aa
04da6d9c4870fbc59c3f41000ea2880f75d660323e7c7c51c36828db8cbc75cd
087f66d4b502adaf30a906752157b80a189480781817d779822e6f2e5c7f69d1
0bfd16854d42432a4bd50604ca66e87ccfdc33bb254d72030076b2bf04e8a208
19af270d94d1cb809509481787660210b39dfa982a696c4813b5dc85ae733b5f
261c3bbe831b0c571b08b92a2194e1aeabe459ff2d22520760d000276fc25c50
30052f65174a9e2d75f3ac731c71c6dc14f48a4585a29b176401df4051d64ece
31ff31d97358106a986533704c936cc969ce6a640539889329adad7448099460
3b212ee3e0509a0088d1cd6d364a613c36ca079ccaf73a26c54ebbf5fe2f3239
686075d3a5423d100f07ed05e48ac2d7f2d693707d6ed0cab2bf729f35bd6ec1
6c66517000417fab138f43b9926bcad36afdc0422c9331b7b8935d89714105d1
87bad51a312532ff0c0b27c1b34dce7d859eb1af503bddfd8d9cde7358f1d5d3
a752cd8b5059dda8f8c25786a2565f824c6a14db9f60204755ca4c49243f5bc9
a92cfa72731e1c920be6ba06868d9218deb40c9f656bf54452bf5daa09766849
c84edeaf26149e34f4b78343edbdf2b90dc3a001bcf829a4348b39566c4c6822
cfc12bb83b343fbc10ca4fd9b271fd8053b8bbb4774101a9d2c7ab20ca3b863c
edc5a08999d9f87e505d1f363a3f01ec5f63a95fc8b89089f79423b25c6a0113
fd827c17f516f6a466dae05029a5cae177ee6965494dc742ab29a13dafc6f33f