2ly.link Open in urlscan Pro
35.226.132.161  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

• https://2ly.link/js/app.bundle.js HTTP 302
• https://2ly.link/?slug=/js/app.bundle.js HTTP 302
• https://linklyhq.com/

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request 1zH90 Show response 2ly.link/	3 KB 3 KB	365ms 125ms	Document text/html	35.226.132.161 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://2ly.link/1zH90 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.226.132.161 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 161.132.226.35.bc.googleusercontent.com Software / Resource Hash 6cfef77fafe94820b40b668418c76f654b5c4400e62100fc13942178ff2c6111 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-origin * access-control-expose-headers cache-control no-cache content-length 2890 content-type text/html; charset=utf-8 cross-origin-window-policy deny date Mon, 12 Aug 2024 22:51:07 GMT referer https://2ly.link/1zH90 x-content-type-options nosniff x-download-options noopen x-frame-options SAMEORIGIN x-permitted-cross-domain-policies none x-request-id fc681450c1d2eacb06aa29914eb3e965 x-xss-protection 1; mode=block
GET H2	200	bootstrap.min.css maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/	141 KB 25 KB	58ms 21ms	Stylesheet text/css	2606:4700::6812:bcf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css Requested by Host: 2ly.link URL: https://2ly.link/1zH90 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://2ly.link/ Origin https://2ly.link User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Mon, 12 Aug 2024 22:51:07 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT cdn-edgestorageid 752 strict-transport-security max-age=31536000; includeSubDomains; preload age 13150140 cdn-cachedat 10/31/2023 18:48:44 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 last-modified Mon, 25 Jan 2021 22:04:04 GMT cdn-proxyver 1.04 cdn-requestpullcode 200 server cloudflare etag W/"450fc463b8b1a349df717056fbb3e078" vary Accept-Encoding content-type text/css; charset=utf-8 access-control-allow-origin * cdn-cache HIT cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cache-control public, max-age=31919000 cdn-requestid b5a5735e4292883f579b01d2431ac7dc timing-allow-origin * cdn-requestcountrycode DE cdn-status 200 cf-ray 8b240739e9e12c55-FRA cdn-requestpullsuccess True
GET		/ linklyhq.com/ Redirect Chain https://2ly.link/js/app.bundle.js https://2ly.link/?slug=/js/app.bundle.js https://linklyhq.com/	0 0
GET H2	200	/ 125412565258.xyz/Login/ Frame FD97	0 0	418ms 185ms	Document text/html	104.251.111.203 ZAYO-6461
General Check archive.org Show headers Download Go to Full URL https://125412565258.xyz/Login/ Requested by Host: 2ly.link URL: https://2ly.link/1zH90 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 104.251.111.203 Toronto, Canada, ASN6461 (ZAYO-6461, US), Reverse DNS cp3.hostsilo.com Software LiteSpeed / PHP/5.6.40 Resource Hash Request headers Referer https://2ly.link/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers content-encoding br content-type text/html; charset=UTF-8 date Mon, 12 Aug 2024 22:51:07 GMT server LiteSpeed vary Accept-Encoding x-powered-by PHP/5.6.40
GET H2	404	favicon.ico 2ly.link/	2 KB 2 KB	115ms 115ms	Other text/html	35.226.132.161 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://2ly.link/favicon.ico Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.226.132.161 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 161.132.226.35.bc.googleusercontent.com Software / Resource Hash 19d29c03d4c782bb78592bb835cc02316fb173d63efe39effbdc10b5ebc814d4 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://2ly.link/1zH90 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Response headers date Mon, 12 Aug 2024 22:51:08 GMT x-content-type-options nosniff x-permitted-cross-domain-policies none cross-origin-window-policy deny x-download-options noopen x-frame-options SAMEORIGIN content-type text/html; charset=utf-8 access-control-allow-origin * access-control-expose-headers cache-control max-age=0, private, must-revalidate access-control-allow-credentials true content-length 1598 x-xss-protection 1; mode=block x-request-id 8186bd26c8015fc980ab491f88f953e9

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

linklyhq.com

URL

https://linklyhq.com/

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: AKBank (Banking)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| redirect function| not_found function| isIOS function| cloneDeviceMotionEvent object| iframe

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://2ly.link/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

125412565258.xyz
2ly.link
linklyhq.com
maxcdn.bootstrapcdn.com
linklyhq.com
104.251.111.203
2606:4700::6812:bcf
35.226.132.161
19d29c03d4c782bb78592bb835cc02316fb173d63efe39effbdc10b5ebc814d4
2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d
6cfef77fafe94820b40b668418c76f654b5c4400e62100fc13942178ff2c6111