antprimary.com Open in urlscan Pro
162.241.149.153 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://antprimary.com/linkedin/
Submission: On September 09 via manual (September 9th 2021, 8:00:45 pm UTC) from DE — Scanned from DE

Summary HTTP 20 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 3 countries across 6 domains to perform 20 HTTP transactions. The main IP is 162.241.149.153, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is antprimary.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on September 8th 2021. Valid for: 3 months.

This is the only time antprimary.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: LinkedIn (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
3	162.241.149.153 162.241.149.153	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
7	2606:2800:233... 2606:2800:233:6a53:4ac1:3bc8:ee4e:5990	15133 (EDGECAST) (EDGECAST)
5	2a02:26f0:f7:... 2a02:26f0:f7::5c7b:e024	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	52.17.185.148 52.17.185.148	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:810::200d	15169 (GOOGLE) (GOOGLE)
1	2620:1ec:21::16 2620:1ec:21::16	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
20	6

3 162.241.149.153 (United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 162-241-149-153.unifiedlayer.com

antprimary.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2606:2800:233:6a53:4ac1:3bc8:ee4e:5990 (United States)

ASN15133 (EDGECAST, US)

static-exp1.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a02:26f0:f7::5c7b:e024 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

platform.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
platform.linkedin-ei.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.17.185.148 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-17-185-148.eu-west-1.compute.amazonaws.com

lnkd.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::200d (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

accounts.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::16 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.linkedin-ei.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	licdn.com static-exp1.licdn.com	168 KB
4	linkedin.com platform.linkedin.com	51 KB
3	demdex.net lnkd.demdex.net dpm.demdex.net	6 KB
3	antprimary.com antprimary.com	43 KB
2	linkedin-ei.com www.linkedin-ei.com platform.linkedin-ei.com	44 KB
1	google.com accounts.google.com	1005 B
20	6

	Domain	Requested by
7	static-exp1.licdn.com	antprimary.com
4	platform.linkedin.com	antprimary.com
3	antprimary.com	static-exp1.licdn.com
2	lnkd.demdex.net	antprimary.com platform.linkedin.com
1	dpm.demdex.net	platform.linkedin-ei.com
1	platform.linkedin-ei.com	static-exp1.licdn.com
1	www.linkedin-ei.com	static-exp1.licdn.com
1	accounts.google.com
20	8

This site contains no links.

Subject Issuer	Validity	Valid
antprimary.com cPanel, Inc. Certification Authority	`2021-09-08` - `2021-12-07`	3 months	crt.sh
*.licdn.com DigiCert SHA2 Secure Server CA	`2019-10-10` - `2021-10-14`	2 years	crt.sh
platform.linkedin.com DigiCert SHA2 Secure Server CA	`2020-07-03` - `2022-07-08`	2 years	crt.sh
*.demdex.net DigiCert TLS RSA SHA256 2020 CA1	`2020-12-02` - `2022-01-02`	a year	crt.sh
accounts.google.com GTS CA 1C3	`2021-08-23` - `2021-11-15`	3 months	crt.sh
www.linkedin-ei.com DigiCert SHA2 Secure Server CA	`2021-04-30` - `2021-10-30`	6 months	crt.sh

This page contains 2 frames:

Primary Page: https://antprimary.com/linkedin/
Frame ID: 44B206C530022B00AA8F7E04E8F88412
Requests: 19 HTTP requests in this frame

Frame: https://lnkd.demdex.net/dest5.html?d_nsid=0
Frame ID: 3431A2345E98F258A7C1AC87F357B37F
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

LinkedIn Login, Sign in | LinkedIn

Page Statistics

20
Requests

100 %
HTTPS

67 %
IPv6

6
Domains

8
Subdomains

6
IPs

3
Countries

312 kB
Transfer

1108 kB
Size

11
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

20 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
antprimary.com/linkedin/ 41 KB
42 KB 923ms
128ms Document
text/html 162.241.149.153
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://antprimary.com/linkedin/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.241.149.153 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 162-241-149-153.unifiedlayer.com
Software: Apache /
Resource Hash: 46e942b88cc1d5cfed96a384d7fa8dff33961f24400536c265992f6d7d8c0684

Request headers

Host: antprimary.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

Date: Thu, 09 Sep 2021 20:00:39 GMT
Server: Apache
Last-Modified: Thu, 09 Sep 2021 20:00:39 GMT
Accept-Ranges: bytes
Content-Length: 42262
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html

GET
H2 200 b65e8ovcinye0pcd3qs7rus9u Show response
static-exp1.licdn.com/sc/h/ 155 KB
38 KB 66ms
34ms Script
text/javascript 2606:2800:233:6a53:4ac1:3bc8:ee4e:5990
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://static-exp1.licdn.com/sc/h/b65e8ovcinye0pcd3qs7rus9u
Requested by: Host: antprimary.com
URL: https://antprimary.com/linkedin/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:6a53:4ac1:3bc8:ee4e:5990 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8E8A) /
Resource Hash: d25766a048ff80ed49cf7e345dabe00879b6143868f4499fccdab441302acc3a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://antprimary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 09 Sep 2021 20:00:40 GMT
content-encoding: br
content-type: text/javascript
x-cdn-client-ip-version: IPV6
x-cdn: ECST
age: 658172
x-cache: HIT
x-cdn-proto: HTTP2
content-length: 39238
x-li-uuid: xidBfzLpoBagT04j6ioAAA==
server: ECAcc (frc/8E8A)
timing-allow-origin: *
last-modified: Mon, 05 Nov 2012 04:00:51 GMT
x-li-pop: prod-edc2
cache-control: max-age=31536000, immutable
vary: Accept-Encoding
x-li-fabric: prod-ltx1
access-control-allow-origin: *
access-control-expose-headers: X-CDN, X-CDN-CLIENT-IP-VERSION, X-CDN-Proto
x-li-proto: http/1.1
accept-ranges: bytes
x-li-static-content: 1
x-fs-uuid: c627417f32e9a016a04f4e23ea2a0000
expires: Fri, 02 Sep 2022 05:11:08 GMT

GET
H2 200 9t0ibl3u6kzmm3xkauxilt140 Show response
static-exp1.licdn.com/sc/h/ 62 KB
18 KB 53ms
22ms Script
text/javascript 2606:2800:233:6a53:4ac1:3bc8:ee4e:5990
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://static-exp1.licdn.com/sc/h/9t0ibl3u6kzmm3xkauxilt140
Requested by: Host: antprimary.com
URL: https://antprimary.com/linkedin/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:6a53:4ac1:3bc8:ee4e:5990 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8E92) /
Resource Hash: 7110daa4bb9b8cc37d21a49acecd4a4e7f62f41d45eb2b8be7f0fe9ea8507234

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://antprimary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 09 Sep 2021 20:00:40 GMT
content-encoding: br
content-type: text/javascript
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-cdn: ECST
age: 1166905
x-cache: HIT
x-cdn-proto: HTTP2
content-length: 18642
x-li-uuid: 1c34CoIanxaAdc5E7CoAAA==
server: ECAcc (frc/8E92)
timing-allow-origin: *
last-modified: Mon, 05 Nov 2012 04:00:51 GMT
x-li-pop: prod-eda6
cache-control: max-age=31536000, immutable
x-cdn-client-ip-version: IPV6
vary: Accept-Encoding
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-fabric: prod-ltx1
access-control-allow-origin: *
access-control-expose-headers: X-CDN, X-CDN-CLIENT-IP-VERSION, X-CDN-Proto
x-li-proto: http/1.1
accept-ranges: bytes
x-li-static-content: 1
x-fs-uuid: d5cdf80a821a9f168075ce44ec2a0000
expires: Sat, 27 Aug 2022 07:52:15 GMT

GET
H2 200 6jblk5oqhlo45xbkmcr7s4zix Show response
static-exp1.licdn.com/sc/h/ 64 KB
13 KB 58ms
27ms Script
text/javascript 2606:2800:233:6a53:4ac1:3bc8:ee4e:5990
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://static-exp1.licdn.com/sc/h/6jblk5oqhlo45xbkmcr7s4zix
Requested by: Host: antprimary.com
URL: https://antprimary.com/linkedin/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:6a53:4ac1:3bc8:ee4e:5990 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8F28) /
Resource Hash: 2072637eca86b31333f03dd2f363993776d87ec85be0f0970d80a08347cbe43f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://antprimary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 09 Sep 2021 20:00:40 GMT
content-encoding: br
content-type: text/javascript
x-cdn-client-ip-version: IPV6
x-cdn: ECST
age: 2059872
x-cache: HIT
x-cdn-proto: HTTP2
content-length: 13554
x-li-uuid: q5SK2VvumxbQJm1LFCsAAA==
server: ECAcc (frc/8F28)
timing-allow-origin: *
last-modified: Mon, 05 Nov 2012 04:00:51 GMT
x-li-pop: prod-edc2
cache-control: max-age=31536000, immutable
vary: Accept-Encoding
x-li-fabric: prod-lva1
access-control-allow-origin: *
access-control-expose-headers: X-CDN, X-CDN-CLIENT-IP-VERSION, X-CDN-Proto
x-li-proto: http/1.1
accept-ranges: bytes
x-li-static-content: 1
x-fs-uuid: 0134c1cbdc868c16404c5e57572b0000
expires: Mon, 27 Jun 2022 19:24:08 GMT

GET
H2 200 48p0pumuvwn6gf14efb9gdp4v Show response
static-exp1.licdn.com/sc/h/ 2 KB
797 B 58ms
28ms Script
text/javascript 2606:2800:233:6a53:4ac1:3bc8:ee4e:5990
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://static-exp1.licdn.com/sc/h/48p0pumuvwn6gf14efb9gdp4v
Requested by: Host: antprimary.com
URL: https://antprimary.com/linkedin/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:6a53:4ac1:3bc8:ee4e:5990 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8F10) /
Resource Hash: 5af2dfee0b7dd68e56ad1e1c5f6818f6812f484d39d4495d60a6666fd0c057fb

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://antprimary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 09 Sep 2021 20:00:40 GMT
content-encoding: br
content-type: text/javascript
x-cdn-client-ip-version: IPV6
x-cdn: ECST
age: 1166905
x-cache: HIT
x-cdn-proto: HTTP2
content-length: 683
x-li-uuid: CW5AC4IanxawX54iECsAAA==
server: ECAcc (frc/8F10)
timing-allow-origin: *
last-modified: Mon, 05 Nov 2012 04:00:51 GMT
x-li-pop: prod-eda6
cache-control: max-age=31536000, immutable
vary: Accept-Encoding
x-li-fabric: prod-ltx1
access-control-allow-origin: *
access-control-expose-headers: X-CDN, X-CDN-CLIENT-IP-VERSION, X-CDN-Proto
x-li-proto: http/1.1
accept-ranges: bytes
x-li-static-content: 1
x-fs-uuid: 096e400b821a9f16b05f9e22102b0000
expires: Sat, 27 Aug 2022 07:52:15 GMT

GET
H2 200 dux5pmry7fu9btbz2isdqym2q Show response
static-exp1.licdn.com/sc/h/ 67 KB
19 KB 59ms
28ms Script
text/javascript 2606:2800:233:6a53:4ac1:3bc8:ee4e:5990
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://static-exp1.licdn.com/sc/h/dux5pmry7fu9btbz2isdqym2q
Requested by: Host: antprimary.com
URL: https://antprimary.com/linkedin/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:6a53:4ac1:3bc8:ee4e:5990 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8F77) /
Resource Hash: d9a2efb86be0801c3d1a97d0b5a125053fdbc40c9540ebeac182e0f46dbf3261

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://antprimary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 09 Sep 2021 20:00:40 GMT
content-encoding: br
content-type: text/javascript
x-cdn-client-ip-version: IPV6
x-cdn: ECST
age: 1166911
x-cache: HIT
x-cdn-proto: HTTP2
content-length: 19811
x-li-uuid: ttTAjIAanxZApoXOIysAAA==
server: ECAcc (frc/8F77)
timing-allow-origin: *
last-modified: Mon, 05 Nov 2012 04:00:51 GMT
x-li-pop: prod-edc2
cache-control: max-age=31536000, immutable
vary: Accept-Encoding
x-li-fabric: prod-lva1
access-control-allow-origin: *
access-control-expose-headers: X-CDN, X-CDN-CLIENT-IP-VERSION, X-CDN-Proto
x-li-proto: http/1.1
accept-ranges: bytes
x-li-static-content: 1
x-fs-uuid: b6d4c08c801a9f1640a685ce232b0000
expires: Sat, 27 Aug 2022 07:52:09 GMT

GET
H2 200 304mgi5j23vqo26trnz6auzve
static-exp1.licdn.com/sc/h/ 210 KB
19 KB 44ms
15ms Stylesheet
text/css 2606:2800:233:6a53:4ac1:3bc8:ee4e:5990
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://static-exp1.licdn.com/sc/h/304mgi5j23vqo26trnz6auzve
Requested by: Host: antprimary.com
URL: https://antprimary.com/linkedin/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:6a53:4ac1:3bc8:ee4e:5990 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8F1B) /
Resource Hash: 2bcca5003dde9197922f96cf949f3bb2760bf26a86ab5ed6263fe816aaba8578

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://antprimary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 09 Sep 2021 20:00:40 GMT
content-encoding: br
content-type: text/css
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-cdn: ECST
age: 1166662
x-cache: HIT
x-cdn-proto: HTTP2
content-length: 19128
x-li-uuid: 7/iMhLoanxaw2i3alisAAA==
server: ECAcc (frc/8F1B)
timing-allow-origin: *
last-modified: Mon, 05 Nov 2012 04:00:51 GMT
x-li-pop: prod-edc2
cache-control: max-age=31536000, immutable
x-cdn-client-ip-version: IPV6
vary: Accept-Encoding
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-fabric: prod-lva1
access-control-allow-origin: *
access-control-expose-headers: X-CDN, X-CDN-CLIENT-IP-VERSION, X-CDN-Proto
x-li-proto: http/1.1
accept-ranges: bytes
x-li-static-content: 1
x-fs-uuid: eff88c84ba1a9f16b0da2dda962b0000
expires: Sat, 27 Aug 2022 07:56:18 GMT

GET
H2 200 8ddascte8uiyhhufy6qlnhw2b Show response
static-exp1.licdn.com/sc/h/ 218 KB
59 KB 59ms
30ms Script
text/javascript 2606:2800:233:6a53:4ac1:3bc8:ee4e:5990
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://static-exp1.licdn.com/sc/h/8ddascte8uiyhhufy6qlnhw2b
Requested by: Host: antprimary.com
URL: https://antprimary.com/linkedin/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:6a53:4ac1:3bc8:ee4e:5990 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8FCC) /
Resource Hash: 190472cc8b749d317cc6d4c27a5022d250df931fb04507c307ef640a452200da

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://antprimary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 09 Sep 2021 20:00:40 GMT
content-encoding: br
content-type: text/javascript
x-cdn-client-ip-version: IPV6
x-cdn: ECST
age: 591062
x-cache: HIT
x-cdn-proto: HTTP2
content-length: 59843
x-li-uuid: xdxU3zsmoRYAbY4ylysAAA==
server: ECAcc (frc/8FCC)
timing-allow-origin: *
last-modified: Mon, 05 Nov 2012 04:00:51 GMT
x-li-pop: prod-eda6
cache-control: max-age=31536000, immutable
vary: Accept-Encoding
x-li-fabric: prod-ltx1
access-control-allow-origin: *
access-control-expose-headers: X-CDN, X-CDN-CLIENT-IP-VERSION, X-CDN-Proto
x-li-proto: http/1.1
accept-ranges: bytes
x-li-static-content: 1
x-fs-uuid: c5dc54df3b26a116006d8e32972b0000
expires: Fri, 02 Sep 2022 23:49:38 GMT

GET
H/1.1 200
OK utag.js Show response
platform.linkedin.com/litms/utag/checkpoint-frontend/ 129 KB
41 KB 321ms
138ms Script
application/javascript 2a02:26f0:f7::5c7b:e024
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.linkedin.com/litms/utag/checkpoint-frontend/utag.js?cb=1631176800000
Requested by: Host: antprimary.com
URL: https://antprimary.com/linkedin/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:f7::5c7b:e024 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Play /
Resource Hash: 6632763e797e0e05588d82fcb2d74f83b482c155cd9a700e70826215c0e2a51a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://antprimary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Thu, 09 Sep 2021 20:00:40 GMT
Content-Encoding: gzip
Content-Type: application/javascript; charset=utf-8
X-CDN-CLIENT-IP-VERSION: IPV6
X-CDN: AKAM
Connection: keep-alive
Content-Length: 41710
X-LI-UUID: GUqZkp8XoxbAZnhX1ioAAA==
Server: Play
Last-Modified: Wed, 01 Sep 2021 22:17:10 GMT
X-Li-Pop: prod-eda6
ETag: "b64cbdffadcea70b1eb6285c754c215c171d322b"
Vary: Accept-Encoding
X-Li-Fabric: prod-lor1
Cache-Control: max-age=300
Accept-Ranges: bytes
X-LI-Proto: http/1.1

GET
H/1.1 200
OK utag.107.js Show response
platform.linkedin.com/litms/utag/checkpoint-frontend/ 9 KB
4 KB 206ms
26ms Script
application/javascript 2a02:26f0:f7::5c7b:e024
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.linkedin.com/litms/utag/checkpoint-frontend/utag.107.js?utv=ut4.46.202108061923
Requested by: Host: antprimary.com
URL: https://antprimary.com/linkedin/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:f7::5c7b:e024 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Play /
Resource Hash: 704c03388d696028b43d5a1c5d4b4b7d6de3305ab5da61f507e552595544b0c0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://antprimary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Thu, 09 Sep 2021 20:00:40 GMT
Content-Encoding: gzip
X-CDN-CLIENT-IP-VERSION: IPV6
X-CDN: AKAM
Connection: keep-alive
Content-Length: 3147
X-LI-UUID: EHw8QmnWoBYQU8q/mSsAAA==
Server: Play
Last-Modified: Wed, 01 Sep 2021 22:17:10 GMT
X-Li-Pop: prod-edc2
ETag: "7102c830da3af9fe101094c6b817ba8554a3a56c"
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Cache-Control: max-age=300
Accept-Ranges: bytes
X-LI-Proto: http/1.1
X-Li-Fabric: prod-ltx1

GET
H/1.1 200
OK utag.116.js Show response
platform.linkedin.com/litms/utag/checkpoint-frontend/ 3 KB
2 KB 180ms
20ms Script
application/javascript 2a02:26f0:f7::5c7b:e024
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.linkedin.com/litms/utag/checkpoint-frontend/utag.116.js?utv=ut4.46.202108061923
Requested by: Host: antprimary.com
URL: https://antprimary.com/linkedin/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:f7::5c7b:e024 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Play /
Resource Hash: cd776aa311400c90accd07b01cf79a23278d85d536ecccd66b895586be32c23d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://antprimary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Thu, 09 Sep 2021 20:00:40 GMT
Content-Encoding: gzip
X-CDN-CLIENT-IP-VERSION: IPV6
X-CDN: AKAM
Connection: keep-alive
Content-Length: 1485
X-LI-UUID: he11XhHXoBZAZwsZ7yoAAA==
Server: Play
Last-Modified: Wed, 01 Sep 2021 22:17:10 GMT
X-Li-Pop: prod-edc2
ETag: "93d98a401f81fcf276099d2d56add904e8115b0b"
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Cache-Control: max-age=300
Accept-Ranges: bytes
X-LI-Proto: http/1.1
X-Li-Fabric: prod-ltx1

GET
H/1.1 200
OK utag.117.js Show response
platform.linkedin.com/litms/utag/checkpoint-frontend/ 10 KB
4 KB 181ms
21ms Script
application/javascript 2a02:26f0:f7::5c7b:e024
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.linkedin.com/litms/utag/checkpoint-frontend/utag.117.js?utv=ut4.46.202108061923
Requested by: Host: antprimary.com
URL: https://antprimary.com/linkedin/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:f7::5c7b:e024 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Play /
Resource Hash: 962d24fdaffaabc712ef425e30b013455416f8d14ddb5166482d04c89421e25d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://antprimary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Thu, 09 Sep 2021 20:00:40 GMT
Content-Encoding: gzip
X-CDN-CLIENT-IP-VERSION: IPV6
X-CDN: AKAM
Connection: keep-alive
Content-Length: 3265
X-LI-UUID: 6kLzlW7WoBZwzwRqAisAAA==
Server: Play
Last-Modified: Wed, 01 Sep 2021 22:17:10 GMT
X-Li-Pop: prod-eda6
ETag: "193c63ca1ccfcac1761ca019c3ab61d09d23f706"
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Cache-Control: max-age=300
Accept-Ranges: bytes
X-LI-Proto: http/1.1
X-Li-Fabric: prod-ltx1

GET
H/1.1 200
OK dest5.html Show response
lnkd.demdex.net/ Frame 3431 7 KB
3 KB 153ms
32ms Document
text/html 52.17.185.148
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://lnkd.demdex.net/dest5.html?d_nsid=0

Requested by

Host: antprimary.com
URL: https://antprimary.com/linkedin/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.17.185.148 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-17-185-148.eu-west-1.compute.amazonaws.com

Software

Resource Hash

7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Host: lnkd.demdex.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://antprimary.com/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://antprimary.com/

Response headers

Accept-Ranges: bytes
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
Content-Type: text/html;charset=UTF-8
date: Thu, 9 Sep 2021 20:00:40 GMT
DCS: dcs-prod-irl1-2-v016-07d37c4ff.edge-irl1.demdex.com UNKNOWN
Expires: Thu, 01 Jan 1970 00:00:00 UTC
last-modified: Wed, 8 Sep 2021 15:27:47 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
vary: accept-encoding
X-TID: Tpi+l+LCRB4=
Content-Length: 2791
Connection: keep-alive

GET
H2 403 status Show response
accounts.google.com/gsi/ 37 B
1005 B 80ms
25ms XHR
application/json 2a00:1450:4001:810::200d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com/gsi/status?client_id=990339570472-k6nqn1tpmitg8pui82bfaun3jrpmiuhs.apps.googleusercontent.com&as=VgRUhK6RFUc6k3iM0TqzlQ

Requested by

Host:
URL: /_/gsi/_/js/k=gsi.gsi.en.2f0d9inoam4.O/am=cg/d=1/ct=zgms/rs=AF0KOtW8IEF-TGSiZ5fJdPlfbYNG4zpbRg/m=gis_client_library

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

21e4b0177346d92cc77269088401df39680e0b51cbc9d6a4bc9461a9117862f4

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-hEZb9ogAj91V/dX9MQIUfQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://antprimary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 09 Sep 2021 20:00:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
content-disposition: attachment; filename="json.txt"; filename*=UTF-8''json.txt
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
pragma: no-cache
server: ESF
x-frame-options: SAMEORIGIN
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://antprimary.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-security-policy: script-src 'report-sample' 'nonce-hEZb9ogAj91V/dX9MQIUfQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 user Show response
www.linkedin-ei.com/litms/api/metadata/ 324 B
2 KB 735ms
691ms XHR
application/json 2620:1ec:21::16
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.linkedin-ei.com/litms/api/metadata/user

Requested by

Host: static-exp1.licdn.com
URL: https://static-exp1.licdn.com/sc/h/9t0ibl3u6kzmm3xkauxilt140

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:21::16 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

413dcac687347fda31020577d90102126ed5bd03b783596da7648334a19f15d1

Security Headers

Name	Value
Content-Security-Policy	default-src ; connect-src 'self' ffi.st static.licdn-ei.com media.licdn-ei.com static-exp1.licdn-ei.com static-exp2.licdn-ei.com media-exp1.licdn-ei.com media-exp2.licdn-ei.com https://media-src.linkedin-ei.com/media/ www.linkedin.com www.linkedin-ei.com spdy.linkedin-ei.com dms.licdn-ei.com https://dpm.demdex.net/id lnkd.demdex.net blob: https://linkedin.sc.omtrdc.net/b/ss/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; img-src data: blob: ; font-src data: ; style-src 'unsafe-inline' 'self' static-src.linkedin.com .licdn.com static-src.linkedin-ei.com .licdn-ei.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' ffi.st spdy.linkedin.com static-src.linkedin.com .ads.linkedin.com .licdn.com platform.linkedin-ei.com spdy.linkedin-ei.com static-src.linkedin-ei.com .licdn-ei.com lix.corp.linkedin.com lva1-lixr01.linkedin.biz wus2-pd-lixr1.linkedin.biz static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com www.linkedin.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: ; child-src blob: lnkd-communities: voyager: ; frame-ancestors 'self' http://qa-mailbox.corp.linkedin.com; report-uri /security/csp?f=l
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://antprimary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
x-cache: CONFIG_NOCACHE
content-length: 219
x-li-uuid: AAXLlXQdMXfCv8j5cxY5Uw==
pragma: no-cache
x-li-pop: afd-ei4-x
x-msedge-ref: Ref A: 34607F4C87C14B2BBDEE8047DB0D3620 Ref B: FRAEDGE1213 Ref C: 2021-09-09T20:00:41Z
x-frame-options: sameorigin
date: Thu, 09 Sep 2021 20:00:41 GMT
expect-ct: max-age=86400, report-uri="https://www.linkedin-ei.com/platform-telemetry/ct"
vary: Origin,Accept-Encoding
content-type: application/json
access-control-allow-origin: https://antprimary.com
cache-control: no-cache, no-store
access-control-allow-credentials: true
content-security-policy: default-src *; connect-src 'self' ffi.st static.licdn-ei.com media.licdn-ei.com static-exp1.licdn-ei.com static-exp2.licdn-ei.com media-exp1.licdn-ei.com media-exp2.licdn-ei.com https://media-src.linkedin-ei.com/media/ www.linkedin.com www.linkedin-ei.com spdy.linkedin-ei.com dms.licdn-ei.com https://dpm.demdex.net/id lnkd.demdex.net blob: https://linkedin.sc.omtrdc.net/b/ss/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com static-src.linkedin-ei.com *.licdn-ei.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' ffi.st spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com platform.linkedin-ei.com spdy.linkedin-ei.com static-src.linkedin-ei.com *.licdn-ei.com lix.corp.linkedin.com lva1-lixr01.linkedin.biz wus2-pd-lixr1.linkedin.biz static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com www.linkedin.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self' http://qa-mailbox.corp.linkedin.com; report-uri /security/csp?f=l
x-li-proto: http/2
x-li-fabric: ei4
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 utag.js Show response
platform.linkedin-ei.com/litms/utag/checkpoint-frontend/ 129 KB
42 KB 1035ms
502ms Script
application/javascript 2a02:26f0:f7::5c7b:e024
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.linkedin-ei.com/litms/utag/checkpoint-frontend/utag.js?cb=1631217600000
Requested by: Host: static-exp1.licdn.com
URL: https://static-exp1.licdn.com/sc/h/9t0ibl3u6kzmm3xkauxilt140
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:f7::5c7b:e024 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Play /
Resource Hash: 76d35616ac46fdb775fa2179763e28f6e103849831977ed1f11a20be1c3a78b2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://antprimary.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 09 Sep 2021 20:00:42 GMT
content-encoding: gzip
content-type: application/javascript; charset=utf-8
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.0001,"failure_fraction":1,"include_subdomains":true}
x-cdn: AKAM
p3p: CP="CAO CUR ADM DEV PSA PSD OUR"
x-li-uuid: 3yMdn80/oxbA9238MSsAAA==
server: Play
last-modified: Tue, 07 Sep 2021 22:58:32 GMT
x-li-pop: ei-ltx1
etag: "0373955fcb937a35be4d0492dc43bcf3660c056c"
vary: Accept-Encoding
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin-ei.com/li/rep"}],"include_subdomains":true}
x-li-fabric: ei-ltx1
cache-control: max-age=300
accept-ranges: bytes
x-li-proto: http/1.1

POST
H/1.1 404
Not Found track Show response
antprimary.com/li/ 315 B
515 B 128ms
127ms XHR
text/html 162.241.149.153
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://antprimary.com/li/track
Requested by: Host: static-exp1.licdn.com
URL: https://static-exp1.licdn.com/sc/h/b65e8ovcinye0pcd3qs7rus9u
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.241.149.153 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 162-241-149-153.unifiedlayer.com
Software: Apache /
Resource Hash: d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

Sec-Fetch-Mode: cors
Origin: https://antprimary.com
Accept-Encoding: gzip, deflate, br
Accept-Language: de-DE,de;q=0.9
Sec-Fetch-Dest: empty
Connection: keep-alive
Content-Length: 583
Cache-Control: no-cache
Pragma: no-cache
Host: antprimary.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-type: application/json
Accept: */*
Csrf-Token
Referer: https://antprimary.com/linkedin/
Sec-Fetch-Site: same-origin
Csrf-Token
Referer: https://antprimary.com/linkedin/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-type: application/json

Response headers

Date: Thu, 09 Sep 2021 20:00:40 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=99
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 611 B
1 KB 136ms
37ms XHR
application/json 52.17.185.148
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=5.1.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=14215E3D5995C57C0A495C55%40AdobeOrg&d_nsid=0&ts=1631217642751

Requested by

Host: platform.linkedin-ei.com
URL: https://platform.linkedin-ei.com/litms/utag/checkpoint-frontend/utag.js?cb=1631217600000

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.17.185.148 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-17-185-148.eu-west-1.compute.amazonaws.com

Software

Resource Hash

82281fa03e2e5c926b8fdd73f637769deda95908c58c16c7b02f531fcf851d02

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://antprimary.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-2-v016-058edfd96.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: aM+wXqk/T54=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://antprimary.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 455
Expires: Thu, 01 Jan 1970 00:00:00 UTC

POST
H/1.1 404
Not Found track Show response
antprimary.com/li/ 315 B
515 B 128ms
128ms XHR
text/html 162.241.149.153
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://antprimary.com/li/track
Requested by: Host: static-exp1.licdn.com
URL: https://static-exp1.licdn.com/sc/h/9t0ibl3u6kzmm3xkauxilt140
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.241.149.153 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 162-241-149-153.unifiedlayer.com
Software: Apache /
Resource Hash: d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

Sec-Fetch-Mode: cors
Origin: https://antprimary.com
Accept-Encoding: gzip, deflate, br
Accept-Language: de-DE,de;q=0.9
Sec-Fetch-Dest: empty
Cookie: AMCV_14215E3D5995C57C0A495C55%40AdobeOrg=-637568504%7CMCIDTS%7C18880%7CvVersion%7C5.1.1
Connection: keep-alive
Content-Length: 1565
Cache-Control: no-cache
Pragma: no-cache
Host: antprimary.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-type: application/json
Accept: */*
Csrf-Token
Referer: https://antprimary.com/linkedin/
Sec-Fetch-Site: same-origin
Csrf-Token
Referer: https://antprimary.com/linkedin/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-type: application/json

Response headers

Date: Thu, 09 Sep 2021 20:00:42 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=98
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

POST
H/1.1 200
OK event Show response
lnkd.demdex.net/ 689 B
1 KB 39ms
39ms XHR
application/json 52.17.185.148
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://lnkd.demdex.net/event?d_dil_ver=9.4&_ts=1631217642758

Requested by

Host: platform.linkedin.com
URL: https://platform.linkedin.com/litms/utag/checkpoint-frontend/utag.js?cb=1631176800000

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.17.185.148 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-17-185-148.eu-west-1.compute.amazonaws.com

Software

Resource Hash

aebaf5d700cd407d12b6df6291ae257bf4733ad63e72139e4239a6b9faa0650d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://antprimary.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-1-v016-0f7d269ca.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: WL6qwprxTr8=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://antprimary.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 472
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: LinkedIn (Social Network)

30 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

11 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.linkedin.com/	1970-01-19 21:08:24	Name: lidc Value: "b=VGST07:s=V:r=V:a=V:p=V:g=2164:u=1:x=1:i=1631217640:t=1631304040:v=2:sig=AQGrpPcCqJ7RX_nPSpY77hrnirNwbj_F"
.google.com/	1970-01-20 01:30:28	Name: NID Value: 223=GKYnBdAJNbvdiIKy6LfCbiib6dn3EtZbNe1kHL3eeMltp1cMfDdKHK13B2jihteMxrek5irr6H9DHotOkPLaODRuH5RkDcZLPsCprtZ0YXIjgmBEJabrB9nfU--AAoq7NkqEcKwB4Pa7n5RoUlNc_dO9K-ic2H7tTWnTWQD-epI
.www.linkedin-ei.com/	1969-12-31 23:59:59	Name: JSESSIONID Value: ajax:0529978178504278527
.linkedin-ei.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=de-de
.linkedin-ei.com/	1970-01-20 14:38:51	Name: bcookie Value: "v=2&7bcbc8c6-3c82-4a95-8ed7-1800b1a9f737"
.www.linkedin-ei.com/	1970-01-20 14:38:51	Name: bscookie Value: "v=1&20210909200042ae1fdccd-9b87-4d9a-8803-0518b1ec8f07AQGapHBqeN8i14WwVJBLgIGhoMui35ak"
.linkedin-ei.com/	1970-01-19 21:08:24	Name: lidc Value: "b=ETGST07:s=ET:r=ET:a=ET:p=ET:g=49:u=1:x=1:i=1631217642:t=1631304042:v=2:sig=AQExx_UnVpLDl4Im_mdk3h3SMhMIY6ln"
.demdex.net/	1970-01-20 01:26:09	Name: demdex Value: 43098026909681112282507944225374546852
.antprimary.com/	1969-12-31 23:59:59	Name: AMCVS_14215E3D5995C57C0A495C55%40AdobeOrg Value: 1
.antprimary.com/	1970-01-20 01:26:09	Name: AMCV_14215E3D5995C57C0A495C55%40AdobeOrg Value: -637568504%7CMCIDTS%7C18880%7CMCMID%7C42514877022553855272450291076599371887%7CMCAAMLH-1631822442%7C6%7CMCAAMB-1631822442%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1631224842s%7CNONE%7CvVersion%7C5.1.1
.antprimary.com/	1970-01-19 21:50:09	Name: aam_uuid Value: 43098026909681112282507944225374546852

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://lnkd.demdex.net/dest5.html?d_nsid=0(Line 12) Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.linkedin.com') does not match the recipient window's origin ('https://antprimary.com').
deprecation	warning	URL: https://static-exp1.licdn.com/sc/h/6jblk5oqhlo45xbkmcr7s4zix Message: RTP data channels are no longer supported. The "RtpDataChannels" constraint is currently ignored, and may cause an error at a later date.
network	error	URL: https://accounts.google.com/gsi/status?client_id=990339570472-k6nqn1tpmitg8pui82bfaun3jrpmiuhs.apps.googleusercontent.com&as=VgRUhK6RFUc6k3iM0TqzlQ Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://antprimary.com/li/track Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://antprimary.com/li/track Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

accounts.google.com
antprimary.com
dpm.demdex.net
lnkd.demdex.net
platform.linkedin-ei.com
platform.linkedin.com
static-exp1.licdn.com
www.linkedin-ei.com
162.241.149.153
2606:2800:233:6a53:4ac1:3bc8:ee4e:5990
2620:1ec:21::16
2a00:1450:4001:810::200d
2a02:26f0:f7::5c7b:e024
52.17.185.148
190472cc8b749d317cc6d4c27a5022d250df931fb04507c307ef640a452200da
2072637eca86b31333f03dd2f363993776d87ec85be0f0970d80a08347cbe43f
21e4b0177346d92cc77269088401df39680e0b51cbc9d6a4bc9461a9117862f4
2bcca5003dde9197922f96cf949f3bb2760bf26a86ab5ed6263fe816aaba8578
413dcac687347fda31020577d90102126ed5bd03b783596da7648334a19f15d1
46e942b88cc1d5cfed96a384d7fa8dff33961f24400536c265992f6d7d8c0684
5af2dfee0b7dd68e56ad1e1c5f6818f6812f484d39d4495d60a6666fd0c057fb
6632763e797e0e05588d82fcb2d74f83b482c155cd9a700e70826215c0e2a51a
704c03388d696028b43d5a1c5d4b4b7d6de3305ab5da61f507e552595544b0c0
7110daa4bb9b8cc37d21a49acecd4a4e7f62f41d45eb2b8be7f0fe9ea8507234
76d35616ac46fdb775fa2179763e28f6e103849831977ed1f11a20be1c3a78b2
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
82281fa03e2e5c926b8fdd73f637769deda95908c58c16c7b02f531fcf851d02
962d24fdaffaabc712ef425e30b013455416f8d14ddb5166482d04c89421e25d
aebaf5d700cd407d12b6df6291ae257bf4733ad63e72139e4239a6b9faa0650d
cd776aa311400c90accd07b01cf79a23278d85d536ecccd66b895586be32c23d
d25766a048ff80ed49cf7e345dabe00879b6143868f4499fccdab441302acc3a
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
d9a2efb86be0801c3d1a97d0b5a125053fdbc40c9540ebeac182e0f46dbf3261

antprimary.com Open in urlscan Pro 162.241.149.153 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

20 Requests

100 %HTTPS

67 %IPv6

6 Domains

8 Subdomains

6 IPs

3 Countries

312 kBTransfer

1108 kBSize

11 Cookies

0 Outgoing links

Redirected requests

20 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

30 JavaScript Global Variables

11 Cookies

5 Console Messages

Indicators

antprimary.com Open in urlscan Pro
162.241.149.153 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

20
Requests

100 %
HTTPS

67 %
IPv6

6
Domains

8
Subdomains

6
IPs

3
Countries

312 kB
Transfer

1108 kB
Size

11
Cookies

20 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!