lnc-lnfo.com Open in urlscan Pro
213.226.123.24 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.surveymonkey.de/tr/v1/te/Bp1_2B5_2Ff_2Bl7BK_2BoQpOH6attjc27KWfC4LQgUiR2_2FYBimhOCOKWJnqK0iMUpAYP4kiEwFMurnQttFqH...
Effective URL:
https://lnc-lnfo.com/info/63fe10
Submission: On March 01 via manual (March 1st 2023, 11:57:57 am UTC) from SG — Scanned from DE

Summary HTTP 14 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 3 countries across 5 domains to perform 14 HTTP transactions. The main IP is 213.226.123.24, located in St Petersburg, Russian Federation and belongs to ITRESHENIYA-AS, RU. The main domain is lnc-lnfo.com.
TLS certificate: Issued by R3 on March 1st 2023. Valid for: 3 months.

This is the only time lnc-lnfo.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Disney (Entertainment)

Domain & IP information

	IP Address	AS Autonomous System
1 1	52.222.139.14 52.222.139.14	16509 (AMAZON-02) (AMAZON-02)
1 1	198.199.109.95 198.199.109.95	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
2 13	213.226.123.24 213.226.123.24	49943 (ITRESHENI...) (ITRESHENIYA-AS)
1	2606:4700::68... 2606:4700::6811:190e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:400d:803::2003	15169 (GOOGLE) (GOOGLE)
14	3

1 52.222.139.14 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-52-222-139-14.ams50.r.cloudfront.net

www.surveymonkey.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 198.199.109.95 (San Francisco, United States) 1 redirects

ASN14061 (DIGITALOCEAN-ASN, US)
PTR: codeanyproxy.com

maue93-avidjaaba277938.codeanyapp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 213.226.123.24 (St Petersburg, Russian Federation) 2 redirects

ASN49943 (ITRESHENIYA-AS, RU)

lnc-lnfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400d:803::2003 (Ireland)

ASN15169 (GOOGLE, US)

www.google.be	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	lnc-lnfo.com 2 redirects lnc-lnfo.com	559 KB
2	google.be www.google.be — Cisco Umbrella Rank: 14860
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 195	27 KB
1	codeanyapp.com 1 redirects maue93-avidjaaba277938.codeanyapp.com	96 B
1	surveymonkey.de 1 redirects www.surveymonkey.de — Cisco Umbrella Rank: 641074	2 KB
14	5

	Domain	Requested by
13	lnc-lnfo.com	2 redirects lnc-lnfo.com
2	www.google.be	lnc-lnfo.com
1	cdnjs.cloudflare.com	lnc-lnfo.com
1	maue93-avidjaaba277938.codeanyapp.com	1 redirects
1	www.surveymonkey.de	1 redirects
14	5

This site contains no links.

Subject Issuer	Validity	Valid
app-sslcon.com R3	`2023-03-01` - `2023-05-30`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-08-03` - `2023-08-02`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://lnc-lnfo.com/info/63fe10
Frame ID: 87F25DA501C19CE16FD7D6249188905D
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Warning | Disney+

Page URL History Show full URLs

https://www.surveymonkey.de/tr/v1/te/Bp1_2B5_2Ff_2Bl7BK_2BoQpOH6attjc27KWfC4LQgUiR2_2FYBimhOCOKWJnqK0iMU... HTTP 301
https://maue93-avidjaaba277938.codeanyapp.com/ HTTP 302
https://lnc-lnfo.com/info/63fe10 Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css

React (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+data-react

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

14
Requests

7 %
HTTPS

40 %
IPv6

5
Domains

5
Subdomains

3
IPs

3
Countries

586 kB
Transfer

966 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.surveymonkey.de/tr/v1/te/Bp1_2B5_2Ff_2Bl7BK_2BoQpOH6attjc27KWfC4LQgUiR2_2FYBimhOCOKWJnqK0iMUpAYP4kiEwFMurnQttFqH6mroGrQ2fbIJq1sQuGevBoBjvmgG_2Fy33KexcvDtxQRHJm_2Bcph9SjZYV4nXlRIyasKezcgmVaJGmgByZGdT_2FFIkJAduDBgM_3D HTTP 301
https://maue93-avidjaaba277938.codeanyapp.com/ HTTP 302
https://lnc-lnfo.com/info/63fe10 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4

https://lnc-lnfo.com/info/bootstrap.min.css HTTP 302
https://www.google.be/

Request Chain 5

https://lnc-lnfo.com/info/sample.css HTTP 302
https://www.google.be/

14 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request 63fe10 Show response
lnc-lnfo.com/info/
Redirect Chain

https://www.surveymonkey.de/tr/v1/te/Bp1_2B5_2Ff_2Bl7BK_2BoQpOH6attjc27KWfC4LQgUiR2_2FYBimhOCOKWJnqK0iMUpAYP4kiEwFMurnQttFqH6mroGrQ2fbIJq1sQuGevBoBjvmgG_2Fy33KexcvDtxQRHJm_2Bcph9SjZYV4nXlRIyasKezcg...
https://maue93-avidjaaba277938.codeanyapp.com/
https://lnc-lnfo.com/info/63fe10

13 KB
4 KB

372ms
207ms

Document
text/html

213.226.123.24
ITRESHENIYA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://lnc-lnfo.com/info/63fe10
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.226.123.24 St Petersburg, Russian Federation, ASN49943 (ITRESHENIYA-AS, RU),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: eb9e3edc17ef15fcccbbcb09038cb4cc2905cf27023d9e81a6bb4dc9a4e5a1ba

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate
Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 3601
Content-Type: text/html; charset=UTF-8
Date: Wed, 01 Mar 2023 11:57:52 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive: timeout=5, max=100
Pragma: no-cache
Server: Apache/2.4.29 (Ubuntu)
Vary: Accept-Encoding

Redirect headers

content-length: 0
content-type: text/html; charset=UTF-8
date: Wed, 01 Mar 2023 11:38:22 GMT
location: https://lnc-lnfo.com/info/63fe10
server: openresty

GET
H/1.1 200
OK app_styles_bundle.css
lnc-lnfo.com/style/ 298 KB
41 KB 46ms
46ms Stylesheet
text/css 213.226.123.24
ITRESHENIYA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://lnc-lnfo.com/style/app_styles_bundle.css
Requested by: Host: lnc-lnfo.com
URL: https://lnc-lnfo.com/info/63fe10
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.226.123.24 St Petersburg, Russian Federation, ASN49943 (ITRESHENIYA-AS, RU),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 0029f1286a69af2513ce3bc9b9818f73b1dae86d6e69e6190e32e8ceb20404d8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://lnc-lnfo.com/info/63fe10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Wed, 01 Mar 2023 11:57:52 GMT
Content-Encoding: gzip
Last-Modified: Thu, 08 Sep 2022 17:33:52 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "4a835-5e82dd538e000-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 41140

GET
H/1.1 200
OK main.css
lnc-lnfo.com/style/ 29 KB
4 KB 122ms
40ms Stylesheet
text/css 213.226.123.24
ITRESHENIYA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://lnc-lnfo.com/style/main.css
Requested by: Host: lnc-lnfo.com
URL: https://lnc-lnfo.com/info/63fe10
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.226.123.24 St Petersburg, Russian Federation, ASN49943 (ITRESHENIYA-AS, RU),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 7f969dfd78c9a121df069f10e78d4b6072b83276a27f0908041db9a2fb46967f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://lnc-lnfo.com/info/63fe10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Wed, 01 Mar 2023 11:57:52 GMT
Content-Encoding: gzip
Last-Modified: Thu, 08 Sep 2022 17:33:52 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "749c-5e82dd538e000-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 3995

GET
H/1.1 200
OK react.css
lnc-lnfo.com/style/ 40 KB
8 KB 124ms
42ms Stylesheet
text/css 213.226.123.24
ITRESHENIYA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://lnc-lnfo.com/style/react.css
Requested by: Host: lnc-lnfo.com
URL: https://lnc-lnfo.com/info/63fe10
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.226.123.24 St Petersburg, Russian Federation, ASN49943 (ITRESHENIYA-AS, RU),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 5acc14f1488930083712f8ed8aa2a253d377a7b46112509ab3b6fdea19908aca

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://lnc-lnfo.com/info/63fe10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Wed, 01 Mar 2023 11:57:52 GMT
Content-Encoding: gzip
Last-Modified: Thu, 08 Sep 2022 17:33:52 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "9ea8-5e82dd538e000-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 7437

GET
H2 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/ 85 KB
27 KB 80ms
20ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.min.js

Requested by

Host: lnc-lnfo.com
URL: https://lnc-lnfo.com/info/63fe10

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://lnc-lnfo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Wed, 01 Mar 2023 11:57:52 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 6796030
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 27277
last-modified: Mon, 04 May 2020 16:11:48 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec4-15283"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YeA4Dp2EpRF028YkYdQpPYfCggxqe12uaj8uFc%2Fzb%2BOtpjkuh62BQvZHBzTrEUI4smiM%2FXDjTSwQBCSlPcDgyOAF0eGwoa%2F5yo%2FURk%2F7Z0RBpc00v36h%2F3EkLvOkpxnqVJA6W8tyKY2gObwjEg37K9ag"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7a113993ff495c80-FRA
expires: Mon, 19 Feb 2024 11:57:52 GMT

GET
H2

200

/
www.google.be/
Redirect Chain

https://lnc-lnfo.com/info/bootstrap.min.css
https://www.google.be/

0
0

291ms
134ms

Stylesheet
text/html

2a00:1450:400d:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google.be/
Requested by: Host: lnc-lnfo.com
URL: https://lnc-lnfo.com/info/63fe10
Protocol: H2
Server: 2a00:1450:400d:803::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://lnc-lnfo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Redirect headers

Pragma: no-cache
Date: Wed, 01 Mar 2023 11:57:52 GMT
Server: Apache/2.4.29 (Ubuntu)
Content-Type: text/html; charset=UTF-8
location: https://www.google.be
Cache-Control: no-store, no-cache, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Content-Length: 0
Expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H2

200

/
www.google.be/
Redirect Chain

https://lnc-lnfo.com/info/sample.css
https://www.google.be/

0
0

400ms
243ms

Stylesheet
text/html

2a00:1450:400d:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google.be/
Requested by: Host: lnc-lnfo.com
URL: https://lnc-lnfo.com/info/63fe10
Protocol: H2
Server: 2a00:1450:400d:803::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://lnc-lnfo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Redirect headers

Pragma: no-cache
Date: Wed, 01 Mar 2023 11:57:52 GMT
Server: Apache/2.4.29 (Ubuntu)
Content-Type: text/html; charset=UTF-8
location: https://www.google.be
Cache-Control: no-store, no-cache, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Content-Length: 0
Expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H/1.1 200
OK multilang.js Show response
lnc-lnfo.com/js/ 2 KB
1 KB 124ms
39ms Script
application/javascript 213.226.123.24
ITRESHENIYA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://lnc-lnfo.com/js/multilang.js
Requested by: Host: lnc-lnfo.com
URL: https://lnc-lnfo.com/info/63fe10
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.226.123.24 St Petersburg, Russian Federation, ASN49943 (ITRESHENIYA-AS, RU),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 46f41440725e888ad2fc80cf56ed824bd9da5102e4c0df3236b8ad6d70d51db1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://lnc-lnfo.com/info/63fe10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Wed, 01 Mar 2023 11:57:52 GMT
Content-Encoding: gzip
Last-Modified: Tue, 04 Oct 2022 18:43:50 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "988-5ea39d7510580-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 989

GET
H/1.1 200
OK icon-loader-32@3x.png
lnc-lnfo.com/img/ 4 KB
5 KB 43ms
42ms Image
image/png 213.226.123.24
ITRESHENIYA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://lnc-lnfo.com/img/icon-loader-32@3x.png
Requested by: Host: lnc-lnfo.com
URL: https://lnc-lnfo.com/info/63fe10
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.226.123.24 St Petersburg, Russian Federation, ASN49943 (ITRESHENIYA-AS, RU),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 23248741c76ca3d003122a50aacffd608d0d568c7048b296ef73a1ec1ca59c5d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://lnc-lnfo.com/info/63fe10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Wed, 01 Mar 2023 11:57:53 GMT
Last-Modified: Thu, 08 Sep 2022 17:33:50 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "11d7-5e82dd51a5b80"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 4567

GET
H/1.1 200
OK logo.svg
lnc-lnfo.com/img/ico/ 7 KB
7 KB 40ms
39ms Image
image/svg+xml 213.226.123.24
ITRESHENIYA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://lnc-lnfo.com/img/ico/logo.svg
Requested by: Host: lnc-lnfo.com
URL: https://lnc-lnfo.com/info/63fe10
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.226.123.24 St Petersburg, Russian Federation, ASN49943 (ITRESHENIYA-AS, RU),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 6a7eb353b38a935a0ec168fb6429a2705ee9a9b5003831787f8fa66b6a6b3554

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://lnc-lnfo.com/info/63fe10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Wed, 01 Mar 2023 11:57:53 GMT
Last-Modified: Thu, 08 Sep 2022 17:33:50 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "1b3d-5e82dd51a5b80"
Content-Type: image/svg+xml
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 6973

GET
H/1.1 200
OK Avenir-Roman-12.woff
lnc-lnfo.com/fonts/ 42 KB
42 KB 40ms
39ms Font
application/font-woff 213.226.123.24
ITRESHENIYA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://lnc-lnfo.com/fonts/Avenir-Roman-12.woff
Requested by: Host: lnc-lnfo.com
URL: https://lnc-lnfo.com/style/main.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.226.123.24 St Petersburg, Russian Federation, ASN49943 (ITRESHENIYA-AS, RU),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 4442cba812240f56b7adde799c1a97c7970875d0d01cbf1c5667e25c6beed2cf

Request headers

Referer: https://lnc-lnfo.com/style/main.css
Origin: https://lnc-lnfo.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Wed, 01 Mar 2023 11:57:53 GMT
Last-Modified: Thu, 08 Sep 2022 17:33:50 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "a868-5e82dd51a5b80"
Content-Type: application/font-woff
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 43112

GET
H/1.1 200
OK Avenir-Heavy-05.woff
lnc-lnfo.com/fonts/ 56 KB
56 KB 40ms
40ms Font
application/font-woff 213.226.123.24
ITRESHENIYA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://lnc-lnfo.com/fonts/Avenir-Heavy-05.woff
Requested by: Host: lnc-lnfo.com
URL: https://lnc-lnfo.com/style/main.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.226.123.24 St Petersburg, Russian Federation, ASN49943 (ITRESHENIYA-AS, RU),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 1920ca5153bc2ae87e17795a12ac5835113513b922c95d0bf44ee026200b8631

Request headers

Referer: https://lnc-lnfo.com/style/main.css
Origin: https://lnc-lnfo.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Wed, 01 Mar 2023 11:57:53 GMT
Last-Modified: Thu, 08 Sep 2022 17:33:50 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "df50-5e82dd51a5b80"
Content-Type: application/font-woff
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 57168

GET
H/1.1 200
OK languages.json Show response
lnc-lnfo.com/js/orra/ 390 KB
391 KB 40ms
40ms XHR
application/json 213.226.123.24
ITRESHENIYA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://lnc-lnfo.com/js/orra/languages.json
Requested by: Host: lnc-lnfo.com
URL: https://lnc-lnfo.com/js/multilang.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.226.123.24 St Petersburg, Russian Federation, ASN49943 (ITRESHENIYA-AS, RU),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: b07b41091a1e4cb23bc7f6e800c7f48947f6b97eb1bc3e4bf3437f34f48ca1b2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://lnc-lnfo.com/info/63fe10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Wed, 01 Mar 2023 11:57:53 GMT
Last-Modified: Sun, 15 Jan 2023 09:45:48 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "61974-5f24a54d06b00"
Content-Type: application/json
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 399732

POST
H/1.1 200
OK online
lnc-lnfo.com/user/ 0
0 105ms
104ms Fetch
text/html 213.226.123.24
ITRESHENIYA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://lnc-lnfo.com/user/online
Requested by: Host: lnc-lnfo.com
URL: https://lnc-lnfo.com/info/63fe10
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.226.123.24 St Petersburg, Russian Federation, ASN49943 (ITRESHENIYA-AS, RU),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash

Request headers

Referer: https://lnc-lnfo.com/info/63fe10
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary2PYy3HUjOeTfOqhj

Response headers

Pragma: no-cache
Date: Wed, 01 Mar 2023 11:57:56 GMT
Server: Apache/2.4.29 (Ubuntu)
Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=5, max=97
Content-Length: 0
Expires: Thu, 19 Nov 1981 08:52:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Disney (Entertainment)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.surveymonkey.de/	1970-01-20 10:01:13	Name: ep201 Value: "V7rHUnGDH84E7myfCCLh0dYwfBw="
.surveymonkey.de/	1970-01-20 12:10:47	Name: ep203 Value: "xzEGRs8qZoTsjwEv6i85WrkVb0o="
lnc-lnfo.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 28lkc6214cb7tm2o677hhums0c

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
lnc-lnfo.com
maue93-avidjaaba277938.codeanyapp.com
www.google.be
www.surveymonkey.de
198.199.109.95
213.226.123.24
2606:4700::6811:190e
2a00:1450:400d:803::2003
52.222.139.14
0029f1286a69af2513ce3bc9b9818f73b1dae86d6e69e6190e32e8ceb20404d8
1920ca5153bc2ae87e17795a12ac5835113513b922c95d0bf44ee026200b8631
23248741c76ca3d003122a50aacffd608d0d568c7048b296ef73a1ec1ca59c5d
4442cba812240f56b7adde799c1a97c7970875d0d01cbf1c5667e25c6beed2cf
46f41440725e888ad2fc80cf56ed824bd9da5102e4c0df3236b8ad6d70d51db1
5acc14f1488930083712f8ed8aa2a253d377a7b46112509ab3b6fdea19908aca
6a7eb353b38a935a0ec168fb6429a2705ee9a9b5003831787f8fa66b6a6b3554
7f969dfd78c9a121df069f10e78d4b6072b83276a27f0908041db9a2fb46967f
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
b07b41091a1e4cb23bc7f6e800c7f48947f6b97eb1bc3e4bf3437f34f48ca1b2
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eb9e3edc17ef15fcccbbcb09038cb4cc2905cf27023d9e81a6bb4dc9a4e5a1ba

lnc-lnfo.com Open in urlscan Pro 213.226.123.24 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

14 Requests

7 %HTTPS

40 %IPv6

5 Domains

5 Subdomains

3 IPs

3 Countries

586 kBTransfer

966 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

9 JavaScript Global Variables

3 Cookies

Indicators

lnc-lnfo.com Open in urlscan Pro
213.226.123.24 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

7 %
HTTPS

40 %
IPv6

5
Domains

5
Subdomains

3
IPs

3
Countries

586 kB
Transfer

966 kB
Size

3
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!