www.grizvolt.ru
Open in
urlscan Pro
2a01:5f20::28
Malicious Activity!
Public Scan
Effective URL: http://www.grizvolt.ru/misc/ali/reply/LinkedinAUT/dr6avn1rzjowh40nmb73q7xc.php?client_id=B42FB0D80E094E9A6AEEE2E29E7A1A...
Submission: On April 01 via automatic, source openphish
Summary
This is the only time www.grizvolt.ru was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: LinkedIn (Social Network)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 5 | 2a01:5f20::28 2a01:5f20::28 | 56784 (MULTIHOST-AS) (MULTIHOST-AS) | |
1 | 2606:2800:233... 2606:2800:233:6a53:4ac1:3bc8:ee4e:5990 | 15133 (EDGECAST) (EDGECAST) | |
5 | 2 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
grizvolt.ru
1 redirects
www.grizvolt.ru |
265 KB |
1 |
licdn.com
static.licdn.com |
4 KB |
5 | 2 |
Domain | Requested by | |
---|---|---|
5 | www.grizvolt.ru |
1 redirects
www.grizvolt.ru
|
1 | static.licdn.com |
www.grizvolt.ru
|
5 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.linkedin.com |
linkedin.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.licdn.com DigiCert SHA2 Secure Server CA |
2019-10-10 - 2021-10-14 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
http://www.grizvolt.ru/misc/ali/reply/LinkedinAUT/dr6avn1rzjowh40nmb73q7xc.php?client_id=B42FB0D80E094E9A6AEEE2E29E7A1AA3&response_mode=form_post&response_type=code+id_token&scope=openid+profile&email=&Connect_Authentication_Properties&&nonce=769759700b42fb0d80e094e9a6aeee2e29e7a1aa3&redirect_uri=&ui_locales=en-US&mkt=en-US
Frame ID: DAAD6A84E852328437F9D68A586A59DF
Requests: 5 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://www.grizvolt.ru/misc/ali/reply/LinkedinAUT/
HTTP 302
http://www.grizvolt.ru/misc/ali/reply/LinkedinAUT/dr6avn1rzjowh40nmb73q7xc.php?client_id=B42FB0D80E... Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
8 Outgoing links
These are links going to different origins than the main page.
Title: Forgot password?
Search URL Search Domain Scan URL
Title: Join now
Search URL Search Domain Scan URL
Title: User Agreement
Search URL Search Domain Scan URL
Title: Privacy Policy
Search URL Search Domain Scan URL
Title: Community Guidelines
Search URL Search Domain Scan URL
Title: Cookie Policy
Search URL Search Domain Scan URL
Title: Copyright Policy
Search URL Search Domain Scan URL
Title: Send Feedback
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://www.grizvolt.ru/misc/ali/reply/LinkedinAUT/
HTTP 302
http://www.grizvolt.ru/misc/ali/reply/LinkedinAUT/dr6avn1rzjowh40nmb73q7xc.php?client_id=B42FB0D80E094E9A6AEEE2E29E7A1AA3&response_mode=form_post&response_type=code+id_token&scope=openid+profile&email=&Connect_Authentication_Properties&&nonce=769759700b42fb0d80e094e9a6aeee2e29e7a1aa3&redirect_uri=&ui_locales=en-US&mkt=en-US Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
5 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
dr6avn1rzjowh40nmb73q7xc.php
www.grizvolt.ru/misc/ali/reply/LinkedinAUT/ Redirect Chain
|
24 KB 24 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
egeoxc2x0szngkamt810v6c5
www.grizvolt.ru/misc/ali/reply/LinkedinAUT/img/ |
73 KB 74 KB |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
3vkck9b8p4b1omivo4pym9c96
www.grizvolt.ru/misc/ali/reply/LinkedinAUT/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
_checkpoint-frontend_stylesheets_login_fastrack_desktop_en_US.css
www.grizvolt.ru/misc/ali/reply/LinkedinAUT/img/ |
166 KB 167 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
djzv59yelk5urv2ujlazfyvrk
static.licdn.com/sc/h/ |
9 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: LinkedIn (Social Network)5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| trustedTypes boolean| crossOriginIsolated1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
www.grizvolt.ru/ | Name: PHPSESSID Value: h7lsfm4nckidneuehtg8jt5005 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
static.licdn.com
www.grizvolt.ru
2606:2800:233:6a53:4ac1:3bc8:ee4e:5990
2a01:5f20::28
022daa454cca9ec5239dd48f64b6a29ed2a140c38bcbe894c5a0c43eace6f4e1
2372845295923c7fb12c1037fe5c748ee751f6582d4aaaa54ec2a5d9dae776a5
894c1f9daf5bd4ab67187facdd5157a470b12a9699db53728dbd744e7bfc00f6
fadf34ab3a5d0c22f46af87308c62bf8deb79e6c684f15963aeb656943eb51e4