linkedinshare2022.iceiy.com
185.27.134.176  Malicious Activity! Public Scan Open in urlscan Pro

Internal
urlscan.io (IP) urlscan.io (Domain)
Effective Hostname
VirusTotal SecurityTrails crt.sh
Submitted URL
Google Safe Browsing Archive.org
Effective URL Pivot
Google Safe Browsing Archive.org
Effective IP
VirusTotal SecurityTrails Domaintools Censys
Go To Rescan
Add Verdict Report
Submitted URL:
http://linkedin.com/slink?code=eygUnTmS 14yr old
Effective URL:
https://linkedinshare2022.iceiy.com/secured/?i=2 5yr old
Submission: On January 31 via manual (January 31st 2022, 10:53:51 am UTC) from IE — Scanned from DE Go Pro

Only in urlscan Pro

  • Select different country locations for Private Scans.
  • Use a global network of additional scanning locations and residential IPs for scanning.
  • Interact with pages while you are scanning them.
  • Download files from remote websites.
  • Scan websites on the Tor Network.
Click for more information
Free trials of urlscan Pro are available.
Summary HTTP 9 Redirects Links 3  Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 3 countries across 5 domains to perform 9 HTTP transactions. The main IP is 185.27.134.176, located in United Kingdom and belongs to WILDCARD-AS Wildcard UK Limited, GB. The main domain is linkedinshare2022.iceiy.com. 5yr old
TLS certificate: Issued by GoGetSSL RSA DV CA on January 25th 2022. Valid for: 3mo.
This is the only time linkedinshare2022.iceiy.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: OneDrive (Online)

Domain & IP information

IP Address AS Autonomous System
2 2 2620:1ec:21::14 2620:1ec:21::14 8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 3 185.27.134.219 185.27.134.219 34119 (WILDCARD-...) (WILDCARD-AS Wildcard UK Limited)
4 185.27.134.176 185.27.134.176 34119 (WILDCARD-...) (WILDCARD-AS Wildcard UK Limited)
2 2a00:1450:400... 2a00:1450:4001:811::200a 15169 (GOOGLE) (GOOGLE)
1 2a00:1450:400... 2a00:1450:4001:828::2003 15169 (GOOGLE) (GOOGLE)
9 5
2    2620:1ec:21::14 (United States) 2 redirects
IP Lookup
urlscan.io SecurityTrails VirusTotal AbuseIPDB Censys Domaintools ipinfo.io Shodan
ASN Lookup
urlscan.io CAIDA Rank ipinfo.io CIRCL BGP Ranking

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
linkedin.com 14yr old
VirusTotal SecurityTrails crt.sh Domaintools
www.linkedin.com 14yr old
VirusTotal SecurityTrails crt.sh Domaintools
3    185.27.134.219 (United Kingdom) 1 redirects
IP Lookup
urlscan.io SecurityTrails VirusTotal AbuseIPDB Censys Domaintools ipinfo.io Shodan
ASN Lookup
urlscan.io CAIDA Rank ipinfo.io CIRCL BGP Ranking

ASN34119 (WILDCARD-AS Wildcard UK Limited, GB)
25redimeongodlove01.hstn.me 5yr old
VirusTotal SecurityTrails crt.sh Domaintools
4    185.27.134.176 (United Kingdom)
IP Lookup
urlscan.io SecurityTrails VirusTotal AbuseIPDB Censys Domaintools ipinfo.io Shodan
ASN Lookup
urlscan.io CAIDA Rank ipinfo.io CIRCL BGP Ranking

ASN34119 (WILDCARD-AS Wildcard UK Limited, GB)
linkedinshare2022.iceiy.com 5yr old
VirusTotal SecurityTrails crt.sh Domaintools
2    2a00:1450:4001:811::200a (Frankfurt am Main, Germany)
IP Lookup
urlscan.io SecurityTrails VirusTotal AbuseIPDB Censys Domaintools ipinfo.io Shodan
ASN Lookup
urlscan.io CAIDA Rank ipinfo.io CIRCL BGP Ranking

ASN15169 (GOOGLE, US)
fonts.googleapis.com 10yr old
VirusTotal SecurityTrails crt.sh Domaintools
1    2a00:1450:4001:828::2003 (Frankfurt am Main, Germany)
IP Lookup
urlscan.io SecurityTrails VirusTotal AbuseIPDB Censys Domaintools ipinfo.io Shodan
ASN Lookup
urlscan.io CAIDA Rank ipinfo.io CIRCL BGP Ranking

ASN15169 (GOOGLE, US)
fonts.gstatic.com 10yr old
VirusTotal SecurityTrails crt.sh Domaintools
Apex Domain
Subdomains		 Transfer
4 iceiy.com
linkedinshare2022.iceiy.com 5yr old
311 KB
3 hstn.me 1 redirects
25redimeongodlove01.hstn.me 5yr old
31 KB
2 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 47 10yr old
2 KB
2 linkedin.com 2 redirects
linkedin.com — Cisco Umbrella Rank: 290 14yr old
www.linkedin.com — Cisco Umbrella Rank: 647 14yr old
2 KB
1 gstatic.com
fonts.gstatic.com 10yr old
17 KB
9 5
Domain Requested by
4 linkedinshare2022.iceiy.com 25redimeongodlove01.hstn.me
linkedinshare2022.iceiy.com
3 25redimeongodlove01.hstn.me 1 redirects 25redimeongodlove01.hstn.me
2 fonts.googleapis.com linkedinshare2022.iceiy.com
1 fonts.gstatic.com fonts.googleapis.com
1 www.linkedin.com 1 redirects
1 linkedin.com 1 redirects
9 6

This site contains links to these domains. Also see Links.

Domain
simple-view2022.000webhostapp.com
Subject Issuer Validity Valid
25redimeongodlove01.hstn.me
GoGetSSL RSA DV CA		 2022-01-25 -
2022-04-25		 3mo crt.sh
linkedinshare2022.iceiy.com
GoGetSSL RSA DV CA		 2022-01-25 -
2022-04-25		 3mo crt.sh
upload.video.google.com
GTS CA 1C3		 2021-12-27 -
2022-03-21		 3mo crt.sh
*.gstatic.com
GTS CA 1C3		 2021-12-27 -
2022-03-21		 3mo crt.sh

This page contains 1 frames:

Primary Page: https://linkedinshare2022.iceiy.com/secured/?i=2
Frame ID: 4CFE90940675231330C48C5587BCDE98
Requests: 14 HTTP requests in this frame

Screenshot Go Pro

Only in urlscan Pro

Use the Visual Search feature to find pages with visually similar screenshots.
Click for more information
Free trials of urlscan Pro are available.
Full Image

Page Title

Adobe Document Cloud

Page URL History Go Pro

Only in urlscan Pro

Search our real-time database of newly observed domains and hostnames. Pivot on different attributes, and setup keyword alerts for newly observed domains.
Click for more information
Free trials of urlscan Pro are available.
 Show full URLs

  1. http://linkedin.com/slink?code=eygUnTmS HTTP 301
    https://www.linkedin.com/slink?code=eygUnTmS HTTP 301
    https://25redimeongodlove01.hstn.me/ Page URL
  2. https://25redimeongodlove01.hstn.me/?i=1 HTTP 301
    https://linkedinshare2022.iceiy.com/secured/?i=1 Page URL
  3. https://linkedinshare2022.iceiy.com/secured/?i=2 Page URL

Detected technologies

(Font scripts)
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

9
Requests

100 %
HTTPS

60 %
IPv6

5
Domains

6
Subdomains

5
IPs

3
Countries

361 kB
Transfer

739 kB
Size

6
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://linkedin.com/slink?code=eygUnTmS HTTP 301
    https://www.linkedin.com/slink?code=eygUnTmS HTTP 301
    https://25redimeongodlove01.hstn.me/ Page URL
  2. https://25redimeongodlove01.hstn.me/?i=1 HTTP 301
    https://linkedinshare2022.iceiy.com/secured/?i=1 Page URL
  3. https://linkedinshare2022.iceiy.com/secured/?i=2 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://linkedin.com/slink?code=eygUnTmS HTTP 301
  • https://www.linkedin.com/slink?code=eygUnTmS HTTP 301
  • https://25redimeongodlove01.hstn.me/
Request Chain 2
  • https://25redimeongodlove01.hstn.me/?i=1 HTTP 301
  • https://linkedinshare2022.iceiy.com/secured/?i=1

9 HTTP transactions Go Pro

Only in urlscan Pro

Inspect WebSocket connections, examine POST data effortlessly, and track overlap counts in real time. Features live search and filtering across all HTTP output, complete with full response metadata for deep analysis.
Click for more information
Free trials of urlscan Pro are available.
5 data transactions

Method
Protocol		 Status Resource
Path		 Size
x-fer		 Time
Latency		 Type
MIME-Type		 IP
Location
GET
H2 		200
 / Show response
25redimeongodlove01.hstn.me/
Redirect Chain
  • http://linkedin.com/slink?code=eygUnTmS
  • https://www.linkedin.com/slink?code=eygUnTmS
  • https://25redimeongodlove01.hstn.me/
839 B
699 B 		350ms
25ms 		Document
text/html		 185.27.134.219
WILDCARD-AS Wildc...
General
Check archive.org
Download Go to
Full URL
https://25redimeongodlove01.hstn.me/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.27.134.219 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS
Software
nginx /
Resource Hash
f914edf37a769f13c5e9c9ce1d2b7ac9d615f0db8b38406d9bb8624d900ce564

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

server
nginx
date
Mon, 31 Jan 2022 10:53:51 GMT
content-type
text/html
vary
Accept-Encoding
expires
Thu, 01 Jan 1970 00:00:01 GMT
cache-control
no-cache
content-encoding
gzip

Redirect headers

cache-control
no-cache, no-store
pragma
no-cache
content-encoding
gzip
expires
Thu, 01 Jan 1970 00:00:00 GMT
location
https://25redimeongodlove01.hstn.me
vary
Accept-Encoding
expect-ct
max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
content-security-policy
default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id lnkd.demdex.net blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'
x-frame-options
sameorigin
x-li-fabric
prod-lor1
x-li-pop
afd-prod-lor1-x
x-li-proto
http/2
x-li-uuid
AAXW3pmaA+4tyhehfei83g==
x-cache
CONFIG_NOCACHE
x-msedge-ref
Ref A: 9993CA325C1E4D3492FA242C4B4DB29E Ref B: FRAEDGE1114 Ref C: 2022-01-31T10:53:51Z
date
Mon, 31 Jan 2022 10:53:50 GMT
GET
H2 		200
 aes.js Show response
25redimeongodlove01.hstn.me/ 		30 KB
31 KB 		50ms
50ms 		Script
application/javascript		 185.27.134.219
WILDCARD-AS Wildc...
General
Check archive.org
Download Go to
Full URL
https://25redimeongodlove01.hstn.me/aes.js
Requested by
Host: 25redimeongodlove01.hstn.me
URL: https://25redimeongodlove01.hstn.me/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.27.134.219 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS
Software
nginx /
Resource Hash
d2701c86a2a31a641520e72121749dbbabeed4b1a59aece20bbf14f9c9de82bc

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://25redimeongodlove01.hstn.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Mon, 31 Jan 2022 10:53:51 GMT
last-modified
Sun, 16 Sep 2018 19:22:29 GMT
server
nginx
accept-ranges
bytes
etag
"5b9ead75-79e6"
content-length
31206
content-type
application/javascript
GET
H2 		200
 / Show response
linkedinshare2022.iceiy.com/secured/
Redirect Chain
  • https://25redimeongodlove01.hstn.me/?i=1
  • https://linkedinshare2022.iceiy.com/secured/?i=1
847 B
704 B 		205ms
25ms 		Document
text/html		 185.27.134.176
WILDCARD-AS Wildc...
General
Check archive.org
Download Go to
Full URL
https://linkedinshare2022.iceiy.com/secured/?i=1
Requested by
Host: 25redimeongodlove01.hstn.me
URL: https://25redimeongodlove01.hstn.me/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.27.134.176 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS
Software
nginx /
Resource Hash
26a0409cfa1a3637163273d1812343b5caf5c360f801ec4ac66faea6d9ed8e7e

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://25redimeongodlove01.hstn.me/

Response headers

server
nginx
date
Mon, 31 Jan 2022 10:53:51 GMT
content-type
text/html
vary
Accept-Encoding
expires
Thu, 01 Jan 1970 00:00:01 GMT
cache-control
no-cache
content-encoding
gzip

Redirect headers

server
nginx
date
Mon, 31 Jan 2022 10:53:51 GMT
content-type
text/html; charset=iso-8859-1
content-length
256
location
https://linkedinshare2022.iceiy.com/secured/?i=1
cache-control
max-age=0
expires
Mon, 31 Jan 2022 10:53:51 GMT
GET
H2 		200
 aes.js Show response
linkedinshare2022.iceiy.com/ 		30 KB
31 KB 		50ms
49ms 		Script
application/javascript		 185.27.134.176
WILDCARD-AS Wildc...
General
Check archive.org
Download Go to
Full URL
https://linkedinshare2022.iceiy.com/aes.js
Requested by
Host: linkedinshare2022.iceiy.com
URL: https://linkedinshare2022.iceiy.com/secured/?i=1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.27.134.176 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS
Software
nginx /
Resource Hash
d2701c86a2a31a641520e72121749dbbabeed4b1a59aece20bbf14f9c9de82bc

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://linkedinshare2022.iceiy.com/secured/?i=1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Mon, 31 Jan 2022 10:53:51 GMT
last-modified
Sat, 08 Aug 2015 08:12:26 GMT
server
nginx
accept-ranges
bytes
etag
"55c5b9ea-79e6"
content-length
31206
content-type
application/javascript
GET
H2 		200
 Primary Request / Show response
linkedinshare2022.iceiy.com/secured/ 		4 KB
2 KB 		46ms
46ms 		Document
text/html		 185.27.134.176
WILDCARD-AS Wildc...
General
Check archive.org
Download Go to
Full URL
https://linkedinshare2022.iceiy.com/secured/?i=2
Requested by
Host: linkedinshare2022.iceiy.com
URL: https://linkedinshare2022.iceiy.com/secured/?i=1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.27.134.176 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS
Software
nginx /
Resource Hash
1549bb93de26b2ac05b1728e539c7a558297e1b78c11835b3ce23a67ba1c60c6

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://linkedinshare2022.iceiy.com/secured/?i=1

Response headers

server
nginx
date
Mon, 31 Jan 2022 10:53:51 GMT
content-type
text/html
vary
Accept-Encoding
last-modified
Sat, 29 Jan 2022 00:00:21 GMT
cache-control
max-age=2592000, public, proxy-revalidate, public, proxy-revalidate
expires
Wed, 02 Mar 2022 10:53:51 GMT
content-encoding
gzip
GET
H2 		200
 css
fonts.googleapis.com/ 		3 KB
1 KB 		136ms
49ms 		Stylesheet
text/css		 2a00:1450:4001:811::200a
GOOGLE
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:600
Requested by
Host: linkedinshare2022.iceiy.com
URL: https://linkedinshare2022.iceiy.com/secured/?i=2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
1046dcfe1f67de0521db77b5ec951dc6ec19ba4ccabae74cb75c67201b8f883e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://linkedinshare2022.iceiy.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Mon, 31 Jan 2022 10:18:51 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Mon, 31 Jan 2022 10:53:52 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Mon, 31 Jan 2022 10:53:52 GMT
GET
H2 		200
 style.css
linkedinshare2022.iceiy.com/secured/css/ 		381 KB
278 KB 		31ms
31ms 		Stylesheet
text/css		 185.27.134.176
WILDCARD-AS Wildc...
General
Check archive.org
Download Go to
Full URL
https://linkedinshare2022.iceiy.com/secured/css/style.css
Requested by
Host: linkedinshare2022.iceiy.com
URL: https://linkedinshare2022.iceiy.com/secured/?i=2
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.27.134.176 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS
Software
nginx /
Resource Hash
642b38248cae0d74e6f91969812d37e13c518d2d2f8cc1facf8deaaed29f1432

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://linkedinshare2022.iceiy.com/secured/?i=2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Mon, 31 Jan 2022 10:53:51 GMT
content-encoding
gzip
last-modified
Tue, 25 Jan 2022 19:41:15 GMT
server
nginx
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=2592000, public, proxy-revalidate, public, proxy-revalidate, must-revalidate
expires
Wed, 02 Mar 2022 10:53:51 GMT
GET
H2 		200
 css
fonts.googleapis.com/ 		0
695 B 		47ms
47ms 		Other
text/css		 2a00:1450:4001:811::200a
GOOGLE
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:600
Requested by
Host: linkedinshare2022.iceiy.com
URL: https://linkedinshare2022.iceiy.com/secured/?i=2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://linkedinshare2022.iceiy.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Mon, 31 Jan 2022 09:34:51 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Mon, 31 Jan 2022 10:53:52 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Mon, 31 Jan 2022 10:53:52 GMT
GET
DATA 		200
OK 		truncated
/ 		254 KB
0 		Image
image/jpeg
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f54e17087d9db3a62619c6f43bda5ea2233bd3f4e382314420590299e1774235

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type
image/jpeg
GET
DATA 		200
OK 		truncated
/ 		15 KB
0 		Image
image/png
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
028851bdb881c7f0851ccceeba93f94b77edf707ac1e8e1a94cf6106a11b249b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type
image/png
GET
DATA 		200
OK 		truncated
/ 		1 KB
0 		Image
image/png
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
685f77342ca77f562bb319cf666966ebd283ba9ad568148bf4d6f66d5fa08eb5

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type
image/png
GET
DATA 		200
OK 		truncated
/ 		2 KB
0 		Image
image/png
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f5abe79538714148a390de1c7d7d568746510a32e14b37feacc4812155825558

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type
image/png
GET
DATA 		200
OK 		truncated
/ 		2 KB
0 		Image
image/png
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a2b00dc7e4ff8539cf742bf8d295c111dea08acf46328483d68640135887e70a

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type
image/png
GET
H2 		200
 memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsgH1x4gaVI.woff2
fonts.gstatic.com/s/opensans/v27/ 		16 KB
17 KB 		128ms
40ms 		Font
font/woff2		 2a00:1450:4001:828::2003
GOOGLE
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v27/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsgH1x4gaVI.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:600
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
578ea33c3a1daec87277cd626647c55f3e0abd72c0673cde0fe40d4fb8fd5579
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://linkedinshare2022.iceiy.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date
Fri, 28 Jan 2022 04:37:20 GMT
x-content-type-options
nosniff
age
281792
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
16712
x-xss-protection
0
last-modified
Thu, 28 Oct 2021 00:30:40 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Sat, 28 Jan 2023 04:37:20 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: OneDrive (Online) Go Pro

Only in urlscan Pro

Use our Phishing URL feed to retrieve phishing pages targeting 3000+ brands in real-time. Set up monitoring and alerts. Use maliciousness scores and AI-powered brand name recognition to hunt for brand impersonation.
Click for more information
Free trials of urlscan Pro are available.

1 JavaScript Window variables Go Pro

Only in urlscan Pro

Inspect and pivot on JavaScript variables, identifiers, and other key site metadata data with urlscan Pro. Reveal and search on client-side frameworks, runtime variables, and custom values.
Click for more information
Free trials of urlscan Pro are available.

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

function| popupwnd

6 Cookies Go Pro

Only in urlscan Pro

Review, search, and pivot on browser cookies and persistence site data to see how a site tracks users and keeps sessions alive across visits.
Click for more information
Free trials of urlscan Pro are available.

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path Expires Name / Value
.linkedin.com/ 1970-01-20
18:05:40 		Name: bcookie
Value: "v=2&548d047b-6296-4def-8f4f-47a048389069"
.www.linkedin.com/ 1970-01-20
18:05:40 		Name: bscookie
Value: "v=1&20220131105351945ed7d3-3080-49ca-8471-dbd14d48c421AQHaUUHYR7d9acBuzioDJAdLp6gWTEBD"
.linkedin.com/ 1970-01-20
17:55:33 		Name: li_gc
Value: MTswOzE2NDM2MjY0MzE7MjswMjFv+ixWiUoWl2QPLI/ZexLcyySpfAElpjDqoGuMa8g1aA==
.linkedin.com/ 1970-01-20
00:35:12 		Name: lidc
Value: "b=OGST07:s=O:r=O:a=O:p=O:g=2223:u=1:x=1:i=1643626431:t=1643712831:v=2:sig=AQEMhdI8pwDvsXMwdz2f4E_SZm7apuRy"
25redimeongodlove01.hstn.me/ 1970-01-25
20:05:16 		Name: __test
Value: 36d9c539abe1aea92765c12e6080bf73
linkedinshare2022.iceiy.com/ 1970-01-25
20:05:16 		Name: __test
Value: 36d9c539abe1aea92765c12e6080bf73