cl1ck.link Open in urlscan Pro
2606:4700:3035::ac43:8e12 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://cl1ck.link/documnts/
Effective URL:
https://cl1ck.link/documnts/invoice.php?cmd=login_submit&id=80f9bd56dd60b31c2dfd92cd9173cf8480f9bd56dd60b31c2dfd92c...
Submission: On November 01 via manual (November 1st 2021, 4:27:01 pm UTC) from US — Scanned from DE

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 7 IPs in 3 countries across 7 domains to perform 13 HTTP transactions. The main IP is 2606:4700:3035::ac43:8e12, located in United States and belongs to CLOUDFLARENET, US. The main domain is cl1ck.link.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on October 17th 2021. Valid for: a year.

This is the only time cl1ck.link was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: OneDrive (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 3	2606:4700:303... 2606:4700:3035::ac43:8e12	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2606:50c0:800... 2606:50c0:8003::153	54113 (FASTLY) (FASTLY)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:1b	20446 (HIGHWINDS3) (HIGHWINDS3)
3	2606:4700::68... 2606:4700::6810:125e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:bcf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	34.96.122.219 34.96.122.219	15169 (GOOGLE) (GOOGLE)
1	151.101.12.193 151.101.12.193	54113 (FASTLY) (FASTLY)
13	7

3 2606:4700:3035::ac43:8e12 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

cl1ck.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:50c0:8003::153 (United States)

ASN54113 (FASTLY, US)

lipis.github.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:1b (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6810:125e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:bcf (United States)

ASN13335 (CLOUDFLARENET, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.96.122.219 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 219.122.96.34.bc.googleusercontent.com

gallery.mailchimp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.12.193 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

i.imgur.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	cloudflare.com cdnjs.cloudflare.com	75 KB
3	github.io lipis.github.io	81 KB
3	cl1ck.link 1 redirects cl1ck.link	25 KB
2	mailchimp.com gallery.mailchimp.com	34 KB
1	imgur.com i.imgur.com	657 B
1	bootstrapcdn.com maxcdn.bootstrapcdn.com	14 KB
1	jquery.com code.jquery.com	24 KB
13	7

	Domain	Requested by
3	cdnjs.cloudflare.com	cl1ck.link
3	lipis.github.io	cl1ck.link lipis.github.io
3	cl1ck.link	1 redirects cl1ck.link
2	gallery.mailchimp.com	cl1ck.link
1	i.imgur.com	cl1ck.link
1	maxcdn.bootstrapcdn.com	cl1ck.link
1	code.jquery.com	cl1ck.link
13	7

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-10-17` - `2022-10-16`	a year	crt.sh
www.github.com DigiCert SHA2 High Assurance Server CA	`2020-05-06` - `2022-04-14`	2 years	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2021-07-14` - `2022-08-14`	a year	crt.sh
gallery.mailchimp.com GTS CA 1D4	`2021-10-23` - `2022-01-21`	3 months	crt.sh
*.imgur.com DigiCert SHA2 Secure Server CA	`2020-01-15` - `2022-03-16`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://cl1ck.link/documnts/invoice.php?cmd=login_submit&id=80f9bd56dd60b31c2dfd92cd9173cf8480f9bd56dd60b31c2dfd92cd9173cf84&session=80f9bd56dd60b31c2dfd92cd9173cf8480f9bd56dd60b31c2dfd92cd9173cf84
Frame ID: 5142DFE9FE9E3E3CB38F04DB276837A9
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Dr1ve

Page URL History Show full URLs

https://cl1ck.link/documnts/ HTTP 302
https://cl1ck.link/documnts/invoice.php?cmd=login_submit&id=80f9bd56dd60b31c2dfd92cd9173cf8480f... Page URL

Page Statistics

13
Requests

100 %
HTTPS

71 %
IPv6

7
Domains

7
Subdomains

7
IPs

3
Countries

252 kB
Transfer

739 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://cl1ck.link/documnts/ HTTP 302
https://cl1ck.link/documnts/invoice.php?cmd=login_submit&id=80f9bd56dd60b31c2dfd92cd9173cf8480f9bd56dd60b31c2dfd92cd9173cf84&session=80f9bd56dd60b31c2dfd92cd9173cf8480f9bd56dd60b31c2dfd92cd9173cf84 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request invoice.php Show response
cl1ck.link/documnts/
Redirect Chain

https://cl1ck.link/documnts/
https://cl1ck.link/documnts/invoice.php?cmd=login_submit&id=80f9bd56dd60b31c2dfd92cd9173cf8480f9bd56dd60b31c2dfd92cd9173cf84&session=80f9bd56dd60b31c2dfd92cd9173cf8480f9bd56dd60b31c2dfd92cd9173cf84

6 KB
2 KB

127ms
127ms

Document
text/html

2606:4700:3035::ac43:8e12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cl1ck.link/documnts/invoice.php?cmd=login_submit&id=80f9bd56dd60b31c2dfd92cd9173cf8480f9bd56dd60b31c2dfd92cd9173cf84&session=80f9bd56dd60b31c2dfd92cd9173cf8480f9bd56dd60b31c2dfd92cd9173cf84
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::ac43:8e12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cde90eb855e53358b4e9ed60f333999d5becc4f26e936a410fa51e1b7aa0c9fb

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

date: Mon, 01 Nov 2021 16:26:57 GMT
content-type: text/html; charset=UTF-8
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=i599UIGpeEH6E1926fU6duIALLfRMN87L0OMTLbfUIrcgQqMJdLuZ3%2BAWXTDzBCcTIVOl7MLCBQomD4TA%2BUYUHWqd%2FqjHwZA1ll%2BmhMOq%2BHBvnO1j6%2BSSkVt%2F0CVorrazX%2FPzVSqlO2z"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 6a767cd9bd967045-FRA
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

Redirect headers

date: Mon, 01 Nov 2021 16:26:56 GMT
content-type: text/html; charset=UTF-8
location: invoice.php?cmd=login_submit&id=80f9bd56dd60b31c2dfd92cd9173cf8480f9bd56dd60b31c2dfd92cd9173cf84&session=80f9bd56dd60b31c2dfd92cd9173cf8480f9bd56dd60b31c2dfd92cd9173cf84
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ci1Lk9aWtHH2yyjCjhBhwMaZjHxcbwoIKZhYs0%2Fa0A%2BFfSBHrB1G4%2BCoQrcDdz3Qk75uXAJGI6xsQm9KSMGgNEMcPLYX7EhDgVe9H%2BOYUzwvUtoDB4YYxSIivrJNZjD3MeUGwfH9%2Bwat"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 6a767cd77f8b7045-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 style.css
cl1ck.link/documnts/ 142 KB
22 KB 30ms
29ms Stylesheet
text/css 2606:4700:3035::ac43:8e12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cl1ck.link/documnts/style.css
Requested by: Host: cl1ck.link
URL: https://cl1ck.link/documnts/invoice.php?cmd=login_submit&id=80f9bd56dd60b31c2dfd92cd9173cf8480f9bd56dd60b31c2dfd92cd9173cf84&session=80f9bd56dd60b31c2dfd92cd9173cf8480f9bd56dd60b31c2dfd92cd9173cf84
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::ac43:8e12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e47f539b3efa5736cde86e47f8282e6bcc26f33ba447378af0e0472a06f6c400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl1ck.link/documnts/invoice.php?cmd=login_submit&id=80f9bd56dd60b31c2dfd92cd9173cf8480f9bd56dd60b31c2dfd92cd9173cf84&session=80f9bd56dd60b31c2dfd92cd9173cf8480f9bd56dd60b31c2dfd92cd9173cf84
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 16:26:57 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 27 Apr 2021 17:13:36 GMT
server: cloudflare
age: 412
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=64IVrGqqaAmbe4QVxv4QmRq7FSR%2Fx7B3%2Bj9Lv9nmS1ZRyN5qIUI6oFoPoXKu385NEWrGNwe6wBBeH7aMh2nqD7ALVGkb8keFo3txt%2BzMAOvHfSHkqUOYpbXcpUT7sXzdHshw82okMZIr"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=2592000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6a767cdaa8077045-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
expires: Wed, 01 Dec 2021 16:20:05 GMT

GET
H2 200 font-awesome.css
lipis.github.io/bootstrap-social/assets/css/ 34 KB
7 KB 39ms
7ms Stylesheet
text/css 2606:50c0:8003::153
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://lipis.github.io/bootstrap-social/assets/css/font-awesome.css
Requested by: Host: cl1ck.link
URL: https://cl1ck.link/documnts/invoice.php?cmd=login_submit&id=80f9bd56dd60b31c2dfd92cd9173cf8480f9bd56dd60b31c2dfd92cd9173cf84&session=80f9bd56dd60b31c2dfd92cd9173cf8480f9bd56dd60b31c2dfd92cd9173cf84
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:50c0:8003::153 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: GitHub.com /
Resource Hash: 34f195f17d62b4789625aa8cb3535024a72d40fc4d88ee1383154688b9bfaa27

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl1ck.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

x-fastly-request-id: badd13fb288dc399a5322dd46ff0f065401bf371
date: Mon, 01 Nov 2021 16:26:57 GMT
content-encoding: gzip
age: 475
x-cache: HIT
content-length: 7075
x-served-by: cache-fra19137-FRA
access-control-allow-origin: *
last-modified: Sun, 19 Feb 2017 02:54:15 GMT
server: GitHub.com
x-github-request-id: A254:01A9:74460D:B38F60:617A1909
x-timer: S1635784017.096677,VS0,VE1
etag: W/"58a908d7-8938"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
via: 1.1 varnish
expires: Thu, 28 Oct 2021 03:39:13 GMT
cache-control: max-age=600
permissions-policy: interest-cohort=()
accept-ranges: bytes
x-origin-cache: HIT
x-proxy-cache: MISS
x-cache-hits: 1

GET
H2 200 jquery-3.2.1.slim.min.js Show response
code.jquery.com/ 68 KB
24 KB 30ms
11ms Script
application/javascript 2001:4de0:ac18::1:a:1b
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.2.1.slim.min.js
Requested by: Host: cl1ck.link
URL: https://cl1ck.link/documnts/invoice.php?cmd=login_submit&id=80f9bd56dd60b31c2dfd92cd9173cf8480f9bd56dd60b31c2dfd92cd9173cf84&session=80f9bd56dd60b31c2dfd92cd9173cf8480f9bd56dd60b31c2dfd92cd9173cf84
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:1b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398

Request headers

Referer: https://cl1ck.link/
Origin: https://cl1ck.link
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 16:26:57 GMT
content-encoding: gzip
last-modified: Mon, 20 Mar 2017 19:01:15 GMT
server: nginx
etag: W/"58d026fb-10fdd"
vary: Accept-Encoding
x-hw: 1635784017.dop211.fr8.t,1635784017.cds252.fr8.hn,1635784017.cds257.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 23856

GET
H2 200 popper.min.js Show response
cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/ 19 KB
7 KB 148ms
131ms Script
application/javascript 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js

Requested by

Host: cl1ck.link
URL: https://cl1ck.link/documnts/invoice.php?cmd=login_submit&id=80f9bd56dd60b31c2dfd92cd9173cf8480f9bd56dd60b31c2dfd92cd9173cf84&session=80f9bd56dd60b31c2dfd92cd9173cf8480f9bd56dd60b31c2dfd92cd9173cf84

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://cl1ck.link/
Origin: https://cl1ck.link
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 16:26:57 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 342949
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 6157
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:15:37 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03fa9-4af4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SZaUNRU%2Bdi%2BjMtLdTBykpp1tQgyCtm5naPPcg%2FI%2FivdryfYaBEVGWeLhcnxNDWD1zNUWsro1etUpPSUKc5WqcyocZXzLl%2F2unqROlAt0WSbtPi2hOXbYzLhT2CjOKZBH0AIRtpgGuCJukJIoKLlEzyDt"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6a767cdacc481e47-FRA
expires: Sat, 22 Oct 2022 16:26:57 GMT

GET
H2 200 bootstrap.min.js Show response
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/ 48 KB
14 KB 44ms
21ms Script
application/javascript 2606:4700::6812:bcf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://cl1ck.link/
Origin: https://cl1ck.link
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 16:26:57 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 601
age: 4656
cdn-cachedat: 08/04/2021 00:04:37
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cdn-proxyver: 1.0
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:04 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: 42ebbb279058028e9c45c5dad7963155
cf-ray: 6a767cdadad94a55-FRA
cdn-requestcountrycode: DE
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 bootstrap-social.css
lipis.github.io/bootstrap-social/ 27 KB
4 KB 38ms
6ms Stylesheet
text/css 2606:50c0:8003::153
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://lipis.github.io/bootstrap-social/bootstrap-social.css
Requested by: Host: cl1ck.link
URL: https://cl1ck.link/documnts/invoice.php?cmd=login_submit&id=80f9bd56dd60b31c2dfd92cd9173cf8480f9bd56dd60b31c2dfd92cd9173cf84&session=80f9bd56dd60b31c2dfd92cd9173cf8480f9bd56dd60b31c2dfd92cd9173cf84
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:50c0:8003::153 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: GitHub.com /
Resource Hash: ae799b5fe65766697dc5b3542adfea5df8290a2eb32c95fbaaa47eeef5ffd596

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl1ck.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

x-fastly-request-id: a31ce83c179d62b8e532aa651543ded1940a19ee
date: Mon, 01 Nov 2021 16:26:57 GMT
content-encoding: gzip
age: 448
x-cache: HIT
content-length: 3227
x-served-by: cache-fra19137-FRA
access-control-allow-origin: *
last-modified: Sun, 19 Feb 2017 02:54:15 GMT
server: GitHub.com
x-github-request-id: 8354:BC10:22D54A:27BE7B:617E4016
x-timer: S1635784017.096779,VS0,VE0
etag: W/"58a908d7-6da7"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
via: 1.1 varnish
expires: Sun, 31 Oct 2021 07:13:42 GMT
cache-control: max-age=600
permissions-policy: interest-cohort=()
accept-ranges: bytes
x-origin-cache: HIT
x-proxy-cache: HIT
x-cache-hits: 2

GET
H2 200 9f80177f-8db5-4706-8dff-e45ce9b59847.png
gallery.mailchimp.com/11a794c9d35aab7bf678aa0d3/images/ 24 KB
24 KB 38ms
8ms Image
image/png 34.96.122.219
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gallery.mailchimp.com/11a794c9d35aab7bf678aa0d3/images/9f80177f-8db5-4706-8dff-e45ce9b59847.png
Requested by: Host: cl1ck.link
URL: https://cl1ck.link/documnts/invoice.php?cmd=login_submit&id=80f9bd56dd60b31c2dfd92cd9173cf8480f9bd56dd60b31c2dfd92cd9173cf84&session=80f9bd56dd60b31c2dfd92cd9173cf8480f9bd56dd60b31c2dfd92cd9173cf84
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.122.219 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 219.122.96.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 8466c73f277d2875e0251f54a10cfaccd195c1c7541b48c4a397a64c75c520fa

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl1ck.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 16:20:05 GMT
age: 412
x-guploader-uploadid: ADPycdtOhoZyeO_OFA56ZQ0RluuPMgNmMmfjB-sisN0Zfn-6BlB5cubRBa5dhVQA2_tHeI5XeMC9o9KC9SLQz7t2uBvK8djMhw
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24428
last-modified: Wed, 06 Nov 2019 00:40:58 GMT
server: UploadServer
etag: "50f8e68b3b496c56dbb07aa371a02f40"
x-goog-hash: crc32c=P0TdLg==, md5=UPjmiztJbFbbsHqjcaAvQA==
x-goog-generation: 1573000858026454
cache-control: public, max-age=3600
x-goog-stored-content-length: 24428
accept-ranges: bytes
content-type: image/png
expires: Mon, 01 Nov 2021 17:20:05 GMT

GET
H2 200 socket.io.js Show response
cdnjs.cloudflare.com/ajax/libs/socket.io/1.7.1/ 207 KB
41 KB 42ms
27ms Script
application/javascript 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/socket.io/1.7.1/socket.io.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0fbade78bbd7df1292d1ac6595dffb1cd06e05b2429cfd553ef5d79974c0b84d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl1ck.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 16:26:57 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 285542
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 41362
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:16:21 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03fd5-33bbf"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PRRT%2FnOLYt85CI3%2FNAkchXmcMQxpRSk4OL9hKyMjMVfK%2F7U%2BqXqY0LOTEIy0f2zBIOVikThdPbfbNcJeppCKl7SykSVw%2Fga%2BmG7ZR5WNBzbISytRwx47FRdlyt2wBp1rkV98JWeaZ4nV83GNImHzqS7v"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6a767cdb0b88691b-FRA
expires: Sat, 22 Oct 2022 16:26:57 GMT

GET
H2 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.1.1/ 85 KB
27 KB 18ms
18ms Script
application/javascript 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.1.1/jquery.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl1ck.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 16:26:57 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 338926
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 27192
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:11:48 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec4-152b5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=p28VNEzDMSqu%2FJM%2BXR6794sl8Qe8Ia0AOJMXrMuQQVmu%2Fn4MiZEgDa%2ByFihutoLubB6kv%2BUCuEmV64exOSDu4wKMGR4kI6pzS84Rtk6gIPCZEdqDIMuVKnv9591m96Bza0E7ggpkoAGB9JHTTCZTno4u"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6a767cdb4bef691b-FRA
expires: Sat, 22 Oct 2022 16:26:57 GMT

GET
H2 200 a220d2f1-2f96-4581-bbde-7ce2b8c8d463.png
gallery.mailchimp.com/11a794c9d35aab7bf678aa0d3/images/ 9 KB
9 KB 8ms
8ms Image
image/png 34.96.122.219
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gallery.mailchimp.com/11a794c9d35aab7bf678aa0d3/images/a220d2f1-2f96-4581-bbde-7ce2b8c8d463.png
Requested by: Host: cl1ck.link
URL: https://cl1ck.link/documnts/style.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.122.219 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 219.122.96.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 4b9657404d54be245d3375b5e566d73d0ed2ae5e5d5be40312f0fc1bd7872d52

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl1ck.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 16:20:05 GMT
age: 412
x-guploader-uploadid: ADPycdtJGaGBThCrYUToGtmzVOjeXA9clUzll4gVkvYayXhpYGcCV6RiaC3BnHpg1QaUmWSbu1Ke-SbJfRCtr3dmFw0
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9241
last-modified: Wed, 06 Nov 2019 00:53:59 GMT
server: UploadServer
etag: "c647fc214a90b45fb9cfe2b6cb5372fc"
x-goog-hash: crc32c=fdQRCQ==, md5=xkf8IUqQtF+5z+K2y1Ny/A==
x-goog-generation: 1573001639102324
cache-control: public, max-age=3600
x-goog-stored-content-length: 9241
accept-ranges: bytes
content-type: image/png
expires: Mon, 01 Nov 2021 17:20:05 GMT

GET
H2 200 1Uch1gu.png
i.imgur.com/ 334 B
657 B 31ms
7ms Image
image/png 151.101.12.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/1Uch1gu.png

Requested by

Host: cl1ck.link
URL: https://cl1ck.link/documnts/style.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.12.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

dea34f261a8f1665528217ef9040fc6e4ed0517be859fe25c8e440f02c10ac0a

Security Headers

Name	Value
Strict-Transport-Security	max-age=300
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cl1ck.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 16:26:57 GMT
x-content-type-options: nosniff
age: 907966
x-cache: HIT, HIT
content-length: 334
x-served-by: cache-bwi5171-BWI, cache-fra19124-FRA
last-modified: Wed, 06 Nov 2019 01:00:14 GMT
server: cat factory 1.0
x-timer: S1635784017.247890,VS0,VE1
etag: "cada78d8d0cc419a5a87d8c0695ea394"
strict-transport-security: max-age=300
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-cache-hits: 1, 1

GET
H2 200 fontawesome-webfont.woff2
lipis.github.io/bootstrap-social/assets/fonts/ 70 KB
71 KB 20ms
7ms Font
font/woff2 2606:50c0:8003::153
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://lipis.github.io/bootstrap-social/assets/fonts/fontawesome-webfont.woff2?v=4.6.3
Requested by: Host: lipis.github.io
URL: https://lipis.github.io/bootstrap-social/assets/css/font-awesome.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:50c0:8003::153 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: GitHub.com /
Resource Hash: 7dacf83f51179de8d7980a513e67ab3a08f2c6272bb5946df8fd77c0d1763b73

Request headers

Referer: https://lipis.github.io/bootstrap-social/assets/css/font-awesome.css
Origin: https://cl1ck.link
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

x-fastly-request-id: bfedba6b19328ea6e286d5191ba64698cc46bc05
date: Mon, 01 Nov 2021 16:26:57 GMT
via: 1.1 varnish
age: 471
x-cache: HIT
content-length: 71896
x-served-by: cache-fra19125-FRA
last-modified: Sun, 19 Feb 2017 02:54:15 GMT
server: GitHub.com
x-github-request-id: AAC0:8120:109BA6:17BEC2:617E319F
x-timer: S1635784017.237990,VS0,VE1
etag: "58a908d7-118d8"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
expires: Sun, 31 Oct 2021 06:13:11 GMT
cache-control: max-age=600
permissions-policy: interest-cohort=()
accept-ranges: bytes
x-origin-cache: HIT
x-proxy-cache: MISS
x-cache-hits: 1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: OneDrive (Online)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
cl1ck.link
code.jquery.com
gallery.mailchimp.com
i.imgur.com
lipis.github.io
maxcdn.bootstrapcdn.com
151.101.12.193
2001:4de0:ac18::1:a:1b
2606:4700:3035::ac43:8e12
2606:4700::6810:125e
2606:4700::6812:bcf
2606:50c0:8003::153
34.96.122.219
0fbade78bbd7df1292d1ac6595dffb1cd06e05b2429cfd553ef5d79974c0b84d
34f195f17d62b4789625aa8cb3535024a72d40fc4d88ee1383154688b9bfaa27
4b9657404d54be245d3375b5e566d73d0ed2ae5e5d5be40312f0fc1bd7872d52
7dacf83f51179de8d7980a513e67ab3a08f2c6272bb5946df8fd77c0d1763b73
8466c73f277d2875e0251f54a10cfaccd195c1c7541b48c4a397a64c75c520fa
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
ae799b5fe65766697dc5b3542adfea5df8290a2eb32c95fbaaa47eeef5ffd596
cde90eb855e53358b4e9ed60f333999d5becc4f26e936a410fa51e1b7aa0c9fb
dea34f261a8f1665528217ef9040fc6e4ed0517be859fe25c8e440f02c10ac0a
e47f539b3efa5736cde86e47f8282e6bcc26f33ba447378af0e0472a06f6c400
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b

cl1ck.link Open in urlscan Pro 2606:4700:3035::ac43:8e12 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

13 Requests

100 %HTTPS

71 %IPv6

7 Domains

7 Subdomains

7 IPs

3 Countries

252 kBTransfer

739 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

9 JavaScript Global Variables

0 Cookies

Indicators

cl1ck.link Open in urlscan Pro
2606:4700:3035::ac43:8e12 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

71 %
IPv6

7
Domains

7
Subdomains

7
IPs

3
Countries

252 kB
Transfer

739 kB
Size

0
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!