acc.inkneldi.co Open in urlscan Pro
193.169.255.250 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://acc.inkneldi.co/?b=%7B%7Bemail%7D%7D
Effective URL:
http://acc.inkneldi.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&xSlQf2KAtaudC7a...
Submission: On June 11 via automatic, source openphish (June 11th 2019, 11:03:13 am UTC)

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 9 HTTP transactions. The main IP is 193.169.255.250, located in Poland and belongs to WHF-LTD-AS, PL. The main domain is acc.inkneldi.co.

This is the only time acc.inkneldi.co was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: LinkedIn (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
4	193.169.255.250 193.169.255.250	210273 (WHF-LTD-AS) (WHF-LTD-AS)
4	2a02:26f0:6c0... 2a02:26f0:6c00:295::25ea	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	198.11.132.198 198.11.132.198	45102 (CNNIC-ALI...) (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co.)
9	3

4 193.169.255.250 (Poland)

ASN210273 (WHF-LTD-AS, PL)

acc.inkneldi.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a02:26f0:6c00:295::25ea (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

static.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 198.11.132.198 (San Mateo, United States)

ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN)

passport.alibaba.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	licdn.com static.licdn.com	58 KB
4	inkneldi.co acc.inkneldi.co	23 KB
1	alibaba.com passport.alibaba.com
9	3

	Domain	Requested by
4	static.licdn.com	acc.inkneldi.co
4	acc.inkneldi.co	static.licdn.com
1	passport.alibaba.com	acc.inkneldi.co
9	3

This site contains no links.

Subject Issuer	Validity	Valid
*.licdn.com DigiCert SHA2 Secure Server CA	`2019-04-01` - `2021-05-07`	2 years	crt.sh
*.alibaba.com GlobalSign Organization Validation CA - SHA256 - G2	`2019-03-03` - `2019-09-26`	7 months	crt.sh
	`1970-01-01` - `1970-01-01`	a few seconds	crt.sh

This page contains 2 frames:

Primary Page: http://acc.inkneldi.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&xSlQf2KAtaudC7an6MebVbve8mhzKfdys2ddPxAXr2OuqAP05wKsIFZYPY4f93K6Cq2h9NIZtM6bRHtrQ4GL2qBCdNyy7mSRIwu7GyYUuxu2gsFJqU4TGn3eRPU38XnjJraMrXNTfhOA&id=
Frame ID: 11518AFF0396344B2316C435E1FE6682
Requests: 8 HTTP requests in this frame

Frame: https://passport.alibaba.com/icbu_login.htm?return_url=https%3A%2F%2Fwww.alibaba.com%2F
Frame ID: 0E08976A659038E945F5B424E0D37053
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://acc.inkneldi.co/?b=%7B%7Bemail%7D%7D Page URL
http://acc.inkneldi.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-si... Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

9
Requests

56 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

82 kB
Transfer

349 kB
Size

11
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://acc.inkneldi.co/?b=%7B%7Bemail%7D%7D Page URL
http://acc.inkneldi.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&xSlQf2KAtaudC7an6MebVbve8mhzKfdys2ddPxAXr2OuqAP05wKsIFZYPY4f93K6Cq2h9NIZtM6bRHtrQ4GL2qBCdNyy7mSRIwu7GyYUuxu2gsFJqU4TGn3eRPU38XnjJraMrXNTfhOA&id= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK /
acc.inkneldi.co/ 270 B
478 B 73ms
37ms Document
text/html 193.169.255.250
WHF-LTD-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://acc.inkneldi.co/?b=%7B%7Bemail%7D%7D
Protocol: HTTP/1.1
Server: 193.169.255.250 , Poland, ASN210273 (WHF-LTD-AS, PL),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Host: acc.inkneldi.co
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 11 Jun 2019 11:02:57 GMT
Server: Apache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK Primary Request / Show response
acc.inkneldi.co/l.php/ 21 KB
22 KB 45ms
44ms Document
text/html 193.169.255.250
WHF-LTD-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://acc.inkneldi.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&xSlQf2KAtaudC7an6MebVbve8mhzKfdys2ddPxAXr2OuqAP05wKsIFZYPY4f93K6Cq2h9NIZtM6bRHtrQ4GL2qBCdNyy7mSRIwu7GyYUuxu2gsFJqU4TGn3eRPU38XnjJraMrXNTfhOA&id=
Protocol: HTTP/1.1
Server: 193.169.255.250 , Poland, ASN210273 (WHF-LTD-AS, PL),
Reverse DNS
Software: Apache /
Resource Hash: 332ea63009f19c8c0a91a815251bd784ac375cad0244e552504d11f79ec712c1

Request headers

Host: acc.inkneldi.co
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer: http://acc.inkneldi.co/?b=%7B%7Bemail%7D%7D
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://acc.inkneldi.co/?b=%7B%7Bemail%7D%7D

Response headers

Date: Tue, 11 Jun 2019 11:02:57 GMT
Server: Apache
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK %2Fcheckpoint-frontend%2Fstylesheets%2Flogin%2Ffastrack%2Fdesktop_en_US.css
static.licdn.com/sc/p/com.linkedin.checkpoint%3Acheckpoint-static-content%2B2.0.262/f/ 190 KB
20 KB 14ms
12ms Stylesheet
text/css 2a02:26f0:6c00:295::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://static.licdn.com/sc/p/com.linkedin.checkpoint%3Acheckpoint-static-content%2B2.0.262/f/%2Fcheckpoint-frontend%2Fstylesheets%2Flogin%2Ffastrack%2Fdesktop_en_US.css
Requested by: Host: acc.inkneldi.co
URL: http://acc.inkneldi.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&xSlQf2KAtaudC7an6MebVbve8mhzKfdys2ddPxAXr2OuqAP05wKsIFZYPY4f93K6Cq2h9NIZtM6bRHtrQ4GL2qBCdNyy7mSRIwu7GyYUuxu2gsFJqU4TGn3eRPU38XnjJraMrXNTfhOA&id=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:295::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: Play /
Resource Hash: f165af10f04c3852fccb6500761ca16126a86acf7f6138e7c75a98caa33c0fa1

Request headers

Referer: http://acc.inkneldi.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&xSlQf2KAtaudC7an6MebVbve8mhzKfdys2ddPxAXr2OuqAP05wKsIFZYPY4f93K6Cq2h9NIZtM6bRHtrQ4GL2qBCdNyy7mSRIwu7GyYUuxu2gsFJqU4TGn3eRPU38XnjJraMrXNTfhOA&id=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 11 Jun 2019 11:02:57 GMT
Content-Encoding: gzip
X-CDN-CLIENT-IP-VERSION: IPV6
X-CDN: AKAM
X-Li-Pop: prod-tln1
X-CDN-Proto: HTTP1
Connection: keep-alive
Content-Length: 19961
X-LI-UUID: VX9Bz30BpxXA4xkqbCsAAA==
Timing-Allow-Origin: *
Last-Modified: Mon, 05 Nov 2012 04:00:51 GMT
Server: Play
Cache-Control: max-age=31536000, immutable
Vary: Accept-Encoding
Content-Type: text/css
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-CDN, X-CDN-CLIENT-IP-VERSION, X-CDN-Proto
X-LI-Proto: http/1.1
X-LI-Static-Content: 1
X-Li-Fabric: prod-lor1
Expires: Wed, 10 Jun 2020 00:13:11 GMT

GET
H2 200 icbu_login.htm
passport.alibaba.com/ Frame 0E08 0
0 164ms
163ms Document
text/html 198.11.132.198
CNNIC-ALIBABA-US-...

General

Check archive.org

Show headers Download Go to

Full URL

https://passport.alibaba.com/icbu_login.htm?return_url=https%3A%2F%2Fwww.alibaba.com%2F

Requested by

Host: acc.inkneldi.co
URL: http://acc.inkneldi.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&xSlQf2KAtaudC7an6MebVbve8mhzKfdys2ddPxAXr2OuqAP05wKsIFZYPY4f93K6Cq2h9NIZtM6bRHtrQ4GL2qBCdNyy7mSRIwu7GyYUuxu2gsFJqU4TGn3eRPU38XnjJraMrXNTfhOA&id=

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

198.11.132.198 San Mateo, United States, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN),

Reverse DNS

Software

Tengine /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:method: GET
:authority: passport.alibaba.com
:scheme: https
:path: /icbu_login.htm?return_url=https%3A%2F%2Fwww.alibaba.com%2F
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
referer: http://acc.inkneldi.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&xSlQf2KAtaudC7an6MebVbve8mhzKfdys2ddPxAXr2OuqAP05wKsIFZYPY4f93K6Cq2h9NIZtM6bRHtrQ4GL2qBCdNyy7mSRIwu7GyYUuxu2gsFJqU4TGn3eRPU38XnjJraMrXNTfhOA&id=
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://acc.inkneldi.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&xSlQf2KAtaudC7an6MebVbve8mhzKfdys2ddPxAXr2OuqAP05wKsIFZYPY4f93K6Cq2h9NIZtM6bRHtrQ4GL2qBCdNyy7mSRIwu7GyYUuxu2gsFJqU4TGn3eRPU38XnjJraMrXNTfhOA&id=

Response headers

status: 200
date: Tue, 11 Jun 2019 11:02:57 GMT
content-type: text/html;charset=UTF-8
server: Tengine
vary: Accept-Encoding
htrace-id: 0ab6d59715602509777767213ea00e
p3p: CP='CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
set-cookie: cookie2=u6a8e4e9996c46d862ad7281b83b3b05; Domain=.alibaba.com; Path=/; HttpOnly t=62bbfa51b5e22e6b805688652a7da6ef; Domain=.alibaba.com; Expires=Sat, 10-Mar-2029 11:42:57 GMT; Path=/ xman_t=NJ/+OMmVey1V6E+Qc27L4uPhznniqZ1Uyz2tZZhEO5dSpBwpnhkZVZqkCtbEpJHt0QY13P/sFCc=; Domain=.alibaba.com; Expires=Sat, 07-Sep-2019 10:09:37 GMT; Path=/; HttpOnly _tb_token_=55180eee75bbe; Domain=.alibaba.com; Path=/
havana_s_v: 4.0.1.2-SNAPSHOT
havana_s_ip: 4547554335655a4468687636643536537046633d
havana_s_host: 56447249394562762b4f6b4941734349734b6272612f61644e6876425233634c6a62583671304273557259535a773d3d
havana_s_tag: 285873024335988|134217728^|^^
havana_s_ucode: US:US
havana_s_tid: 0ab6d59715602509777767213ea00e
havana_s_group: havana-session
havana_s_status: STATUS_NOT_EXISTED
content-language: zh-CN
expires: Thu, 01 Jan 1970 00:00:01 GMT
cache-control: no-cache no-store
pragma: no-cache
content-encoding: gzip
strict-transport-security: max-age=31536000
timing-allow-origin: *
eagleid: 0ab6d59715602509777767213ea00e

GET
H/1.1 200
OK 7iptgtauoer8as7pb8k008o4c Show response
static.licdn.com/sc/h/br/ 55 KB
14 KB 7ms
6ms Script
text/javascript 2a02:26f0:6c00:295::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://static.licdn.com/sc/h/br/7iptgtauoer8as7pb8k008o4c
Requested by: Host: acc.inkneldi.co
URL: http://acc.inkneldi.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&xSlQf2KAtaudC7an6MebVbve8mhzKfdys2ddPxAXr2OuqAP05wKsIFZYPY4f93K6Cq2h9NIZtM6bRHtrQ4GL2qBCdNyy7mSRIwu7GyYUuxu2gsFJqU4TGn3eRPU38XnjJraMrXNTfhOA&id=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:295::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: Play /
Resource Hash: f22081906f87637d3fc7f822eedf67e37b3d9e2bb780bc533404e95f753b7433

Request headers

Referer: http://acc.inkneldi.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&xSlQf2KAtaudC7an6MebVbve8mhzKfdys2ddPxAXr2OuqAP05wKsIFZYPY4f93K6Cq2h9NIZtM6bRHtrQ4GL2qBCdNyy7mSRIwu7GyYUuxu2gsFJqU4TGn3eRPU38XnjJraMrXNTfhOA&id=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 11 Jun 2019 11:02:57 GMT
Content-Encoding: br
X-CDN-CLIENT-IP-VERSION: IPV6
X-CDN: AKAM
X-Li-Pop: prod-tln1
X-CDN-Proto: HTTP1
Connection: keep-alive
Content-Length: 13659
X-LI-UUID: 98OmyXwBpxVgNoHFaysAAA==
Timing-Allow-Origin: *
Last-Modified: Mon, 05 Nov 2012 04:00:51 GMT
Server: Play
Cache-Control: max-age=31536000, immutable
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-CDN, X-CDN-CLIENT-IP-VERSION, X-CDN-Proto
X-LI-Proto: http/1.1
X-LI-Static-Content: 1
X-Li-Fabric: prod-lor1
Expires: Wed, 10 Jun 2020 01:00:15 GMT

GET
H/1.1 200
OK ce5359m270sii9ud195l3tlfz Show response
static.licdn.com/sc/h/br/ 72 KB
20 KB 8ms
7ms Script
text/javascript 2a02:26f0:6c00:295::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://static.licdn.com/sc/h/br/ce5359m270sii9ud195l3tlfz
Requested by: Host: acc.inkneldi.co
URL: http://acc.inkneldi.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&xSlQf2KAtaudC7an6MebVbve8mhzKfdys2ddPxAXr2OuqAP05wKsIFZYPY4f93K6Cq2h9NIZtM6bRHtrQ4GL2qBCdNyy7mSRIwu7GyYUuxu2gsFJqU4TGn3eRPU38XnjJraMrXNTfhOA&id=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:295::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: Play /
Resource Hash: fcaea8f8347e9e5ba2b3e7351379fc74fc4ddae29878307cad7ae85fdbfe132a

Request headers

Referer: http://acc.inkneldi.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&xSlQf2KAtaudC7an6MebVbve8mhzKfdys2ddPxAXr2OuqAP05wKsIFZYPY4f93K6Cq2h9NIZtM6bRHtrQ4GL2qBCdNyy7mSRIwu7GyYUuxu2gsFJqU4TGn3eRPU38XnjJraMrXNTfhOA&id=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 11 Jun 2019 11:02:57 GMT
Content-Encoding: br
X-CDN-CLIENT-IP-VERSION: IPV6
X-CDN: AKAM
X-Li-Pop: prod-tln1
X-CDN-Proto: HTTP1
Connection: keep-alive
Content-Length: 20188
X-LI-UUID: pIzcGn0BpxXAMC6CaysAAA==
Timing-Allow-Origin: *
Last-Modified: Mon, 05 Nov 2012 04:00:51 GMT
Server: Play
Cache-Control: max-age=31536000, immutable
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-CDN, X-CDN-CLIENT-IP-VERSION, X-CDN-Proto
X-LI-Proto: http/1.1
X-LI-Static-Content: 1
X-Li-Fabric: prod-lor1
Expires: Wed, 10 Jun 2020 00:27:46 GMT

GET
H/1.1 200
OK djzv59yelk5urv2ujlazfyvrk
static.licdn.com/sc/h/ 9 KB
4 KB 6ms
6ms Image
image/svg+xml 2a02:26f0:6c00:295::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.licdn.com/sc/h/djzv59yelk5urv2ujlazfyvrk
Requested by: Host: acc.inkneldi.co
URL: http://acc.inkneldi.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&xSlQf2KAtaudC7an6MebVbve8mhzKfdys2ddPxAXr2OuqAP05wKsIFZYPY4f93K6Cq2h9NIZtM6bRHtrQ4GL2qBCdNyy7mSRIwu7GyYUuxu2gsFJqU4TGn3eRPU38XnjJraMrXNTfhOA&id=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:295::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: Play /
Resource Hash: fadf34ab3a5d0c22f46af87308c62bf8deb79e6c684f15963aeb656943eb51e4

Request headers

Referer: https://static.licdn.com/sc/p/com.linkedin.checkpoint%3Acheckpoint-static-content%2B2.0.262/f/%2Fcheckpoint-frontend%2Fstylesheets%2Flogin%2Ffastrack%2Fdesktop_en_US.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

X-LI-Proto: http/1.1
Date: Tue, 11 Jun 2019 11:02:57 GMT
Content-Encoding: gzip
X-CDN-CLIENT-IP-VERSION: IPV6
X-CDN: AKAM
X-CDN-Proto: HTTP1
Connection: keep-alive
Content-Length: 3501
X-LI-UUID: lpOsvpzyjBUg1p92AisAAA==
Server: Play
Timing-Allow-Origin: *
Last-Modified: Mon, 05 Nov 2012 04:00:51 GMT
X-Li-Pop: PROD-IDB2
X-EdgeConnect-Cache-Status: 1
Vary: Accept-Encoding
Content-Type: image/svg+xml
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-CDN, X-CDN-CLIENT-IP-VERSION, X-CDN-Proto
Cache-Control: max-age=31536000, immutable
X-LI-Static-Content: 1
X-Li-Fabric: prod-ltx1
Expires: Mon, 16 Mar 2020 12:39:33 GMT

POST
H/1.1 404
Not Found track Show response
acc.inkneldi.co/li/ 325 B
526 B 70ms
35ms XHR
text/html 193.169.255.250
WHF-LTD-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://acc.inkneldi.co/li/track
Requested by: Host: static.licdn.com
URL: https://static.licdn.com/sc/h/br/7iptgtauoer8as7pb8k008o4c
Protocol: HTTP/1.1
Security: , ,
Server: 193.169.255.250 , Poland, ASN210273 (WHF-LTD-AS, PL),
Reverse DNS
Software: Apache /
Resource Hash: 22efb437807cb4b863943eb83a66fdcd793de9c635235465b08ad825251e4b4e

Request headers

Csrf-Token
Origin: http://acc.inkneldi.co
Referer: http://acc.inkneldi.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&xSlQf2KAtaudC7an6MebVbve8mhzKfdys2ddPxAXr2OuqAP05wKsIFZYPY4f93K6Cq2h9NIZtM6bRHtrQ4GL2qBCdNyy7mSRIwu7GyYUuxu2gsFJqU4TGn3eRPU38XnjJraMrXNTfhOA&id=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type: application/json

Response headers

Date: Tue, 11 Jun 2019 11:02:58 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Content-Length: 325
Content-Type: text/html; charset=iso-8859-1

POST
H/1.1 404
Not Found track Show response
acc.inkneldi.co/li/ 325 B
526 B 70ms
35ms XHR
text/html 193.169.255.250
WHF-LTD-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://acc.inkneldi.co/li/track
Requested by: Host: static.licdn.com
URL: https://static.licdn.com/sc/h/br/7iptgtauoer8as7pb8k008o4c
Protocol: HTTP/1.1
Security: , ,
Server: 193.169.255.250 , Poland, ASN210273 (WHF-LTD-AS, PL),
Reverse DNS
Software: Apache /
Resource Hash: 22efb437807cb4b863943eb83a66fdcd793de9c635235465b08ad825251e4b4e

Request headers

Referer: http://acc.inkneldi.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&xSlQf2KAtaudC7an6MebVbve8mhzKfdys2ddPxAXr2OuqAP05wKsIFZYPY4f93K6Cq2h9NIZtM6bRHtrQ4GL2qBCdNyy7mSRIwu7GyYUuxu2gsFJqU4TGn3eRPU38XnjJraMrXNTfhOA&id=
Origin: http://acc.inkneldi.co
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
content-type: application/json

Response headers

Date: Tue, 11 Jun 2019 11:02:59 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Content-Length: 325
Content-Type: text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: LinkedIn (Social Network)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

11 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
g.alicdn.com/	1970-01-22 17:00:10	Name: _uab_collina Value: 156025097891637393023773
g.alicdn.com/alilog/oneplus	1970-01-19 10:09:46	Name: _lastvisited Value: YniGFYjkrCECAbmCuHMqQZA7%2C%2CYniGFYjkrCECAbmCuHMqQZA7frqsi9qp%2Cjwrp5c8t%2Cjw7ozewt%2C1%2C988c059f%2CYniGFYjkrCECAbmCuHMqQZA7%2Cjwrp5c8u
.alibaba.com/	1970-01-19 05:43:22	Name: isg Value: BCQkk4PdJGgws1AkZFdeHY5W_isWvUgn2r1H_D5FsO-y6cSzZs0Yt1pLqVpxKoB_
.alibaba.com/	1970-01-26 08:36:10	Name: cna Value: YniGFYjkrCECAbmCuHMqQZA7
.alibaba.com/	1970-02-12 21:55:34	Name: xman_f Value: qw4Tu6jbRjEcY+pmCB3H8388Px08eyyt4szJdQIkxGpQ66JbxPX3lpK7xpDCcTZechVi0il3NV10F1DkMUwup+gk10LocyQO8W0lX7ZNMqplXIVa6sJEtg==
.alibaba.com/	1969-12-31 23:59:59	Name: acs_usuc_t Value: acs_rt=d614414714d64f078b44e9462dcb5bbc
.alibaba.com/	1969-12-31 23:59:59	Name: xman_t Value: a7vdU8LataTM6O90C4HnD5mi4OAHqpUeifgCTw88TXoUQ4mGc9pbAxVYiWuL2A2A
.alibaba.com/	1970-02-12 21:55:34	Name: xman_us_f Value: x_l=0
.alibaba.com/	1970-02-11 23:19:44	Name: ali_apache_id Value: 10.182.213.151.1560250978355.349197.1
.alibaba.com/	1970-01-19 05:43:22	Name: l Value: bBMWTaN7vQCRLQ8kBOCahurza77OSCOYYuPzaNbMi_5Ij6T6RU7Ole4WxF96VA1R6JTBqMTfJNp9-eteZ
passport.alibaba.com/	1970-01-22 17:00:10	Name: _uab_collina Value: 156025097819536541865063

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	error	URL: https://static.licdn.com/sc/h/br/7iptgtauoer8as7pb8k008o4c(Line 10) Message: [object XMLHttpRequest]

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

acc.inkneldi.co
passport.alibaba.com
static.licdn.com
193.169.255.250
198.11.132.198
2a02:26f0:6c00:295::25ea
22efb437807cb4b863943eb83a66fdcd793de9c635235465b08ad825251e4b4e
332ea63009f19c8c0a91a815251bd784ac375cad0244e552504d11f79ec712c1
f165af10f04c3852fccb6500761ca16126a86acf7f6138e7c75a98caa33c0fa1
f22081906f87637d3fc7f822eedf67e37b3d9e2bb780bc533404e95f753b7433
fadf34ab3a5d0c22f46af87308c62bf8deb79e6c684f15963aeb656943eb51e4
fcaea8f8347e9e5ba2b3e7351379fc74fc4ddae29878307cad7ae85fdbfe132a

acc.inkneldi.co Open in urlscan Pro 193.169.255.250 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

9 Requests

56 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

82 kBTransfer

349 kBSize

11 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

9 JavaScript Global Variables

11 Cookies

1 Console Messages

Indicators

acc.inkneldi.co Open in urlscan Pro
193.169.255.250 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

56 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

82 kB
Transfer

349 kB
Size

11
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!