Submitted URL: https://www.linkedin.com/slink?code=e_Dk_nh5#ukhfjpmuuhkltb=cgmipsfxgycaruMWkwdDI3eDAwY3pxYzAwMTE1MDAyMDBvMDQwMTU0NTc4NWF...
Effective URL: http://covidsubs.shop/anchor/
Submission: On July 03 via api from BE — Scanned from DE

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 2 HTTP transactions. The main IP is 209.200.243.15, located in Canada and belongs to SPRINTLINK, US. The main domain is covidsubs.shop.
This is the only time covidsubs.shop was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 2620:1ec:21::14 8068 (MICROSOFT...)
1 2 209.200.243.15 1239 (SPRINTLINK)
2 2
Apex Domain
Subdomains
Transfer
2 covidsubs.shop
covidsubs.shop
1 KB
1 linkedin.com
www.linkedin.com — Cisco Umbrella Rank: 544
3 KB
0 moltensugars.com Failed
moltensugars.com Failed
2 3
Domain Requested by
2 covidsubs.shop 1 redirects
1 www.linkedin.com 1 redirects
0 moltensugars.com Failed covidsubs.shop
2 3

This site contains no links.

Subject Issuer Validity Valid

This page contains 1 frames:

Frame: https://moltensugars.com/0/0/0/bd2335170fd34396dcd0203d2676b042/2_247186_48132/24_606180_0154578_4/1089747069_mh1qw9
Frame ID: EC0D563B04E1C152948AACFA1B1D88BA
Requests: 2 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://www.linkedin.com/slink?code=e_Dk_nh5 HTTP 301
    http://covidsubs.shop/anchor HTTP 301
    http://covidsubs.shop/anchor/ Page URL

Page Statistics

2
Requests

0 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

1 kB
Transfer

1 kB
Size

4
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://www.linkedin.com/slink?code=e_Dk_nh5 HTTP 301
    http://covidsubs.shop/anchor HTTP 301
    http://covidsubs.shop/anchor/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://covidsubs.shop/ukhfjpmuuhkltb=cgmipsfxgycaruMWkwdDI3eDAwY3pxYzAwMTE1MDAyMDBvMDQwMTU0NTc4NWFxYQ== HTTP 302
  • https://moltensugars.com/0/0/0/bd2335170fd34396dcd0203d2676b042/2_247186_48132/24_606180_0154578_4/1089747069_mh1qw9

2 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
covidsubs.shop/anchor/
Redirect Chain
  • https://www.linkedin.com/slink?code=e_Dk_nh5
  • http://covidsubs.shop/anchor
  • http://covidsubs.shop/anchor/
614 B
861 B
Document
General
Full URL
http://covidsubs.shop/anchor/
Protocol
HTTP/1.1
Server
209.200.243.15 , Canada, ASN1239 (SPRINTLINK, US),
Reverse DNS
hyundai.goonforever.org.uk
Software
Apache /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Connection
close
Content-Length
614
Content-Type
text/html; charset=UTF-8
Date
Mon, 03 Jul 2023 02:34:26 GMT
ETag
"266-5ef9e84920dac"
Last-Modified
Mon, 12 Dec 2022 09:56:31 GMT
Server
Apache

Redirect headers

Connection
close
Content-Length
237
Content-Type
text/html; charset=iso-8859-1
Date
Mon, 03 Jul 2023 02:34:26 GMT
Location
http://covidsubs.shop/anchor/
Server
Apache
1089747069_mh1qw9
moltensugars.com/0/0/0/bd2335170fd34396dcd0203d2676b042/2_247186_48132/24_606180_0154578_4/
Redirect Chain
  • http://covidsubs.shop/ukhfjpmuuhkltb=cgmipsfxgycaruMWkwdDI3eDAwY3pxYzAwMTE1MDAyMDBvMDQwMTU0NTc4NWFxYQ==
  • https://moltensugars.com/0/0/0/bd2335170fd34396dcd0203d2676b042/2_247186_48132/24_606180_0154578_4/1089747069_mh1qw9
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
moltensugars.com
URL
https://moltensugars.com/0/0/0/bd2335170fd34396dcd0203d2676b042/2_247186_48132/24_606180_0154578_4/1089747069_mh1qw9

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| onbeforetoggle object| onscrollend

4 Cookies

Domain/Path Name / Value
.linkedin.com/ Name: bcookie
Value: "v=2&616d2663-9be6-4904-82a6-13268458a954"
.www.linkedin.com/ Name: bscookie
Value: "v=1&20230703023426e0f16127-582d-413b-8598-8530949c64a6AQHT4_58GfamKpisndkqXAYHHGhJ95Mz"
.linkedin.com/ Name: li_gc
Value: MTswOzE2ODgzNTE2NjY7MjswMjHxa2IoWCV8yxPS+eQWDENhf9smxWRFQWcdrSF8I9/w2w==
.linkedin.com/ Name: lidc
Value: "b=VGST03:s=V:r=V:a=V:p=V:g=2908:u=1:x=1:i=1688351666:t=1688438066:v=2:sig=AQH3OiEOnHvUBvZ4sflHT-hJ7cuH-yYw"

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

covidsubs.shop
moltensugars.com
www.linkedin.com
moltensugars.com
209.200.243.15
2620:1ec:21::14