l.anize.co Open in urlscan Pro
193.169.255.250 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://l.anize.co/
Effective URL:
http://l.anize.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&zoeoa1tGxqrVTGz...
Submission: On June 24 via api (June 24th 2019, 4:20:24 am UTC) from GB

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 9 HTTP transactions. The main IP is 193.169.255.250, located in Poland and belongs to WHF-LTD-AS, PL. The main domain is l.anize.co.

This is the only time l.anize.co was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: LinkedIn (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
4	193.169.255.250 193.169.255.250	210273 (WHF-LTD-AS) (WHF-LTD-AS)
4	2a02:26f0:6c0... 2a02:26f0:6c00:28c::25ea	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	205.204.101.142 205.204.101.142	45102 (CNNIC-ALI...) (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co.)
9	3

4 193.169.255.250 (Poland)

ASN210273 (WHF-LTD-AS, PL)

l.anize.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a02:26f0:6c00:28c::25ea (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

static.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 205.204.101.142 (San Mateo, United States)

ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN)

passport.alibaba.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	licdn.com static.licdn.com	59 KB
4	anize.co l.anize.co	23 KB
1	alibaba.com passport.alibaba.com
9	3

	Domain	Requested by
4	static.licdn.com	l.anize.co
4	l.anize.co	static.licdn.com
1	passport.alibaba.com	l.anize.co
9	3

This site contains no links.

Subject Issuer	Validity	Valid
*.licdn.com DigiCert SHA2 Secure Server CA	`2019-04-01` - `2021-05-07`	2 years	crt.sh
*.alibaba.com GlobalSign Organization Validation CA - SHA256 - G2	`2019-06-20` - `2019-09-26`	3 months	crt.sh
	`1970-01-01` - `1970-01-01`	a few seconds	crt.sh

This page contains 2 frames:

Primary Page: http://l.anize.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&zoeoa1tGxqrVTGzdpDgQT0Zj2tkLUky44FswniE98IYp8hePI3mtGfKWsh1WPMkw4XH91WYyYIwN51jsJ4tGCg08Y7khoy0h8XqbB7vFHnyoJfjvXhYtgicgpIgbSj2AQN8QMPO2U6v0&id=
Frame ID: 817291F5EE16F6A8109C643C19D55232
Requests: 8 HTTP requests in this frame

Frame: https://passport.alibaba.com/icbu_login.htm?return_url=https%3A%2F%2Fwww.alibaba.com%2F
Frame ID: 8E6E980A1E549C4C07378CF1641ED652
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://l.anize.co/ Page URL
http://l.anize.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-si... Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Page Statistics

9
Requests

56 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

82 kB
Transfer

349 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://l.anize.co/ Page URL
http://l.anize.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&zoeoa1tGxqrVTGzdpDgQT0Zj2tkLUky44FswniE98IYp8hePI3mtGfKWsh1WPMkw4XH91WYyYIwN51jsJ4tGCg08Y7khoy0h8XqbB7vFHnyoJfjvXhYtgicgpIgbSj2AQN8QMPO2U6v0&id= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK / Show response
l.anize.co/ 270 B
478 B 78ms
33ms Document
text/html 193.169.255.250
WHF-LTD-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://l.anize.co/
Protocol: HTTP/1.1
Server: 193.169.255.250 , Poland, ASN210273 (WHF-LTD-AS, PL),
Reverse DNS
Software: Apache /
Resource Hash: 7660355df771cdbcabf0395e266db16d5131c37445c3e660ef1c259394306617

Request headers

Host: l.anize.co
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 24 Jun 2019 04:20:08 GMT
Server: Apache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK Primary Request / Show response
l.anize.co/l.php/ 21 KB
22 KB 34ms
33ms Document
text/html 193.169.255.250
WHF-LTD-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://l.anize.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&zoeoa1tGxqrVTGzdpDgQT0Zj2tkLUky44FswniE98IYp8hePI3mtGfKWsh1WPMkw4XH91WYyYIwN51jsJ4tGCg08Y7khoy0h8XqbB7vFHnyoJfjvXhYtgicgpIgbSj2AQN8QMPO2U6v0&id=
Protocol: HTTP/1.1
Server: 193.169.255.250 , Poland, ASN210273 (WHF-LTD-AS, PL),
Reverse DNS
Software: Apache /
Resource Hash: 288e8c8d324dae7eb94767feb71baa7ea2220a4af522abca27fa21d4cbeff483

Request headers

Host: l.anize.co
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer: http://l.anize.co/
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://l.anize.co/

Response headers

Date: Mon, 24 Jun 2019 04:20:08 GMT
Server: Apache
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK %2Fcheckpoint-frontend%2Fstylesheets%2Flogin%2Ffastrack%2Fdesktop_en_US.css
static.licdn.com/sc/p/com.linkedin.checkpoint%3Acheckpoint-static-content%2B2.0.262/f/ 190 KB
20 KB 57ms
6ms Stylesheet
text/css 2a02:26f0:6c00:28c::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://static.licdn.com/sc/p/com.linkedin.checkpoint%3Acheckpoint-static-content%2B2.0.262/f/%2Fcheckpoint-frontend%2Fstylesheets%2Flogin%2Ffastrack%2Fdesktop_en_US.css
Requested by: Host: l.anize.co
URL: http://l.anize.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&zoeoa1tGxqrVTGzdpDgQT0Zj2tkLUky44FswniE98IYp8hePI3mtGfKWsh1WPMkw4XH91WYyYIwN51jsJ4tGCg08Y7khoy0h8XqbB7vFHnyoJfjvXhYtgicgpIgbSj2AQN8QMPO2U6v0&id=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:28c::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: Play /
Resource Hash: f165af10f04c3852fccb6500761ca16126a86acf7f6138e7c75a98caa33c0fa1

Request headers

Referer: http://l.anize.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&zoeoa1tGxqrVTGzdpDgQT0Zj2tkLUky44FswniE98IYp8hePI3mtGfKWsh1WPMkw4XH91WYyYIwN51jsJ4tGCg08Y7khoy0h8XqbB7vFHnyoJfjvXhYtgicgpIgbSj2AQN8QMPO2U6v0&id=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 24 Jun 2019 04:20:09 GMT
Content-Encoding: gzip
X-CDN-CLIENT-IP-VERSION: IPV6
X-CDN: AKAM
X-Li-Pop: prod-efr5
X-CDN-Proto: HTTP1
Connection: keep-alive
Content-Length: 19961
X-LI-UUID: n0VMjR0AqxXA7uyk9SoAAA==
Timing-Allow-Origin: *
Last-Modified: Mon, 05 Nov 2012 04:00:51 GMT
Server: Play
Cache-Control: max-age=31536000, immutable
Vary: Accept-Encoding
Content-Type: text/css
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-CDN, X-CDN-CLIENT-IP-VERSION, X-CDN-Proto
X-LI-Proto: http/1.1
X-LI-Static-Content: 1
X-Li-Fabric: prod-lva1
Expires: Tue, 23 Jun 2020 01:54:41 GMT

GET
H/1.1 200
OK 7iptgtauoer8as7pb8k008o4c Show response
static.licdn.com/sc/h/br/ 55 KB
14 KB 56ms
5ms Script
text/javascript 2a02:26f0:6c00:28c::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://static.licdn.com/sc/h/br/7iptgtauoer8as7pb8k008o4c
Requested by: Host: l.anize.co
URL: http://l.anize.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&zoeoa1tGxqrVTGzdpDgQT0Zj2tkLUky44FswniE98IYp8hePI3mtGfKWsh1WPMkw4XH91WYyYIwN51jsJ4tGCg08Y7khoy0h8XqbB7vFHnyoJfjvXhYtgicgpIgbSj2AQN8QMPO2U6v0&id=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:28c::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: Play /
Resource Hash: f22081906f87637d3fc7f822eedf67e37b3d9e2bb780bc533404e95f753b7433

Request headers

Referer: http://l.anize.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&zoeoa1tGxqrVTGzdpDgQT0Zj2tkLUky44FswniE98IYp8hePI3mtGfKWsh1WPMkw4XH91WYyYIwN51jsJ4tGCg08Y7khoy0h8XqbB7vFHnyoJfjvXhYtgicgpIgbSj2AQN8QMPO2U6v0&id=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

X-EdgeConnect-Origin-MEX-Latency: 90
Date: Mon, 24 Jun 2019 04:20:09 GMT
Content-Encoding: br
X-CDN-CLIENT-IP-VERSION: IPV6
X-CDN: AKAM
X-Li-Pop: prod-efr5
X-EdgeConnect-MidMile-RTT: 0
X-CDN-Proto: HTTP1
Connection: keep-alive
Content-Length: 13659
X-LI-UUID: z/udZhwAqxWgefK5ZCsAAA==
Timing-Allow-Origin: *
Last-Modified: Mon, 05 Nov 2012 04:00:51 GMT
Server: Play
Cache-Control: max-age=31536000, immutable
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-CDN, X-CDN-CLIENT-IP-VERSION, X-CDN-Proto
X-LI-Proto: http/1.1
X-LI-Static-Content: 1
X-Li-Fabric: prod-lva1
Expires: Mon, 22 Jun 2020 09:32:32 GMT

GET
H/1.1 200
OK ce5359m270sii9ud195l3tlfz Show response
static.licdn.com/sc/h/br/ 72 KB
20 KB 56ms
6ms Script
text/javascript 2a02:26f0:6c00:28c::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://static.licdn.com/sc/h/br/ce5359m270sii9ud195l3tlfz
Requested by: Host: l.anize.co
URL: http://l.anize.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&zoeoa1tGxqrVTGzdpDgQT0Zj2tkLUky44FswniE98IYp8hePI3mtGfKWsh1WPMkw4XH91WYyYIwN51jsJ4tGCg08Y7khoy0h8XqbB7vFHnyoJfjvXhYtgicgpIgbSj2AQN8QMPO2U6v0&id=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:28c::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: Play /
Resource Hash: fcaea8f8347e9e5ba2b3e7351379fc74fc4ddae29878307cad7ae85fdbfe132a

Request headers

Referer: http://l.anize.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&zoeoa1tGxqrVTGzdpDgQT0Zj2tkLUky44FswniE98IYp8hePI3mtGfKWsh1WPMkw4XH91WYyYIwN51jsJ4tGCg08Y7khoy0h8XqbB7vFHnyoJfjvXhYtgicgpIgbSj2AQN8QMPO2U6v0&id=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 24 Jun 2019 04:20:09 GMT
Content-Encoding: br
X-CDN-CLIENT-IP-VERSION: IPV6
X-CDN: AKAM
X-Li-Pop: prod-efr5
X-CDN-Proto: HTTP1
Connection: keep-alive
Content-Length: 20188
X-LI-UUID: rnCNghwAqxUgwhnjZCsAAA==
Timing-Allow-Origin: *
Last-Modified: Mon, 05 Nov 2012 04:00:51 GMT
Server: Play
Cache-Control: max-age=31536000, immutable
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-CDN, X-CDN-CLIENT-IP-VERSION, X-CDN-Proto
X-LI-Proto: http/1.1
X-LI-Static-Content: 1
X-Li-Fabric: prod-lva1
Expires: Tue, 23 Jun 2020 01:21:15 GMT

GET
H2 200 icbu_login.htm
passport.alibaba.com/ Frame 8E6E 0
0 1757ms
160ms Document
text/html 205.204.101.142
CNNIC-ALIBABA-US-...

General

Check archive.org

Show headers Download Go to

Full URL

https://passport.alibaba.com/icbu_login.htm?return_url=https%3A%2F%2Fwww.alibaba.com%2F

Requested by

Host: l.anize.co
URL: http://l.anize.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&zoeoa1tGxqrVTGzdpDgQT0Zj2tkLUky44FswniE98IYp8hePI3mtGfKWsh1WPMkw4XH91WYyYIwN51jsJ4tGCg08Y7khoy0h8XqbB7vFHnyoJfjvXhYtgicgpIgbSj2AQN8QMPO2U6v0&id=

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

205.204.101.142 San Mateo, United States, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN),

Reverse DNS

Software

Tengine /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:method: GET
:authority: passport.alibaba.com
:scheme: https
:path: /icbu_login.htm?return_url=https%3A%2F%2Fwww.alibaba.com%2F
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
referer: http://l.anize.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&zoeoa1tGxqrVTGzdpDgQT0Zj2tkLUky44FswniE98IYp8hePI3mtGfKWsh1WPMkw4XH91WYyYIwN51jsJ4tGCg08Y7khoy0h8XqbB7vFHnyoJfjvXhYtgicgpIgbSj2AQN8QMPO2U6v0&id=
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://l.anize.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&zoeoa1tGxqrVTGzdpDgQT0Zj2tkLUky44FswniE98IYp8hePI3mtGfKWsh1WPMkw4XH91WYyYIwN51jsJ4tGCg08Y7khoy0h8XqbB7vFHnyoJfjvXhYtgicgpIgbSj2AQN8QMPO2U6v0&id=

Response headers

status: 200
date: Mon, 24 Jun 2019 04:20:10 GMT
content-type: text/html;charset=UTF-8
server: Tengine
vary: Accept-Encoding
htrace-id: 0bb40dab15613500107217645e20ef
p3p: CP='CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
set-cookie: cookie2=u696a163be46dfb524aee37813163675; Domain=.alibaba.com; Path=/; HttpOnly t=4d3d30973d6289fe47dfd1f5b892c214; Domain=.alibaba.com; Expires=Fri, 23-Mar-2029 05:00:10 GMT; Path=/ xman_t=nj/Mt7t57YGLio7EEbn3mCfSEbub5YA8hNpg5RyfLwc0kt3JvDLWwMCluYjeog7Hxl/A5fmFZX4=; Domain=.alibaba.com; Expires=Fri, 20-Sep-2019 03:26:50 GMT; Path=/; HttpOnly _tb_token_=7e7eb37835a35; Domain=.alibaba.com; Path=/
havana_s_v: 4.0.1.2-SNAPSHOT
havana_s_ip: 4547554335655a4468686a4671356d516f673d3d
havana_s_host: 56447249394562762b4f6b4941734349734b6272612f61644e68764341615a57676c73744b42445238555a7561513d3d
havana_s_tag: 285873024335988|134217728^|^^
havana_s_ucode: US:US
havana_s_tid: 0bb40dab15613500107217645e20ef
havana_s_group: havana-session
havana_s_status: STATUS_NOT_EXISTED
content-language: zh-CN
expires: Thu, 01 Jan 1970 00:00:01 GMT
cache-control: no-cache no-store
pragma: no-cache
content-encoding: gzip
strict-transport-security: max-age=31536000
timing-allow-origin: *
eagleid: 0bb40dab15613500107217645e20ef

GET
H/1.1 200
OK djzv59yelk5urv2ujlazfyvrk
static.licdn.com/sc/h/ 9 KB
4 KB 7ms
6ms Image
image/svg+xml 2a02:26f0:6c00:28c::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.licdn.com/sc/h/djzv59yelk5urv2ujlazfyvrk
Requested by: Host: l.anize.co
URL: http://l.anize.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&zoeoa1tGxqrVTGzdpDgQT0Zj2tkLUky44FswniE98IYp8hePI3mtGfKWsh1WPMkw4XH91WYyYIwN51jsJ4tGCg08Y7khoy0h8XqbB7vFHnyoJfjvXhYtgicgpIgbSj2AQN8QMPO2U6v0&id=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:28c::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: Play /
Resource Hash: fadf34ab3a5d0c22f46af87308c62bf8deb79e6c684f15963aeb656943eb51e4

Request headers

Referer: https://static.licdn.com/sc/p/com.linkedin.checkpoint%3Acheckpoint-static-content%2B2.0.262/f/%2Fcheckpoint-frontend%2Fstylesheets%2Flogin%2Ffastrack%2Fdesktop_en_US.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 24 Jun 2019 04:20:09 GMT
Content-Encoding: gzip
X-CDN-CLIENT-IP-VERSION: IPV6
X-CDN: AKAM
X-Li-Pop: prod-ela1
X-CDN-Proto: HTTP1
Connection: keep-alive
Content-Length: 3501
X-LI-UUID: WjVM2nUgKBWAC41itioAAA==
Timing-Allow-Origin: *
Last-Modified: Mon, 05 Nov 2012 04:00:51 GMT
Server: Play
Cache-Control: max-age=31536000, immutable
Vary: Accept-Encoding
Content-Type: image/svg+xml
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-CDN, X-CDN-CLIENT-IP-VERSION, X-CDN-Proto
X-LI-Proto: http/1.1
X-LI-Static-Content: 1
X-Li-Fabric: prod-lor1
Expires: Mon, 16 Mar 2020 12:39:33 GMT

POST
H/1.1 404
Not Found track Show response
l.anize.co/li/ 325 B
525 B 33ms
32ms XHR
text/html 193.169.255.250
WHF-LTD-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://l.anize.co/li/track
Requested by: Host: static.licdn.com
URL: https://static.licdn.com/sc/h/br/7iptgtauoer8as7pb8k008o4c
Protocol: HTTP/1.1
Security: , ,
Server: 193.169.255.250 , Poland, ASN210273 (WHF-LTD-AS, PL),
Reverse DNS
Software: Apache /
Resource Hash: 22efb437807cb4b863943eb83a66fdcd793de9c635235465b08ad825251e4b4e

Request headers

Csrf-Token
Origin: http://l.anize.co
Referer: http://l.anize.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&zoeoa1tGxqrVTGzdpDgQT0Zj2tkLUky44FswniE98IYp8hePI3mtGfKWsh1WPMkw4XH91WYyYIwN51jsJ4tGCg08Y7khoy0h8XqbB7vFHnyoJfjvXhYtgicgpIgbSj2AQN8QMPO2U6v0&id=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type: application/json

Response headers

Date: Mon, 24 Jun 2019 04:20:13 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=98
Content-Length: 325
Content-Type: text/html; charset=iso-8859-1

POST
H/1.1 404
Not Found track Show response
l.anize.co/li/ 325 B
525 B 33ms
32ms XHR
text/html 193.169.255.250
WHF-LTD-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://l.anize.co/li/track
Requested by: Host: static.licdn.com
URL: https://static.licdn.com/sc/h/br/7iptgtauoer8as7pb8k008o4c
Protocol: HTTP/1.1
Security: , ,
Server: 193.169.255.250 , Poland, ASN210273 (WHF-LTD-AS, PL),
Reverse DNS
Software: Apache /
Resource Hash: 22efb437807cb4b863943eb83a66fdcd793de9c635235465b08ad825251e4b4e

Request headers

Referer: http://l.anize.co/l.php/?https://www.linkedin.com/login?trk=guest_homepage-basic_nav-header-signin&zoeoa1tGxqrVTGzdpDgQT0Zj2tkLUky44FswniE98IYp8hePI3mtGfKWsh1WPMkw4XH91WYyYIwN51jsJ4tGCg08Y7khoy0h8XqbB7vFHnyoJfjvXhYtgicgpIgbSj2AQN8QMPO2U6v0&id=
Origin: http://l.anize.co
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
content-type: application/json

Response headers

Date: Mon, 24 Jun 2019 04:20:14 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=97
Content-Length: 325
Content-Type: text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: LinkedIn (Social Network)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	error	URL: https://static.licdn.com/sc/h/br/7iptgtauoer8as7pb8k008o4c(Line 10) Message: [object XMLHttpRequest]

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

l.anize.co
passport.alibaba.com
static.licdn.com
193.169.255.250
205.204.101.142
2a02:26f0:6c00:28c::25ea
22efb437807cb4b863943eb83a66fdcd793de9c635235465b08ad825251e4b4e
288e8c8d324dae7eb94767feb71baa7ea2220a4af522abca27fa21d4cbeff483
7660355df771cdbcabf0395e266db16d5131c37445c3e660ef1c259394306617
f165af10f04c3852fccb6500761ca16126a86acf7f6138e7c75a98caa33c0fa1
f22081906f87637d3fc7f822eedf67e37b3d9e2bb780bc533404e95f753b7433
fadf34ab3a5d0c22f46af87308c62bf8deb79e6c684f15963aeb656943eb51e4
fcaea8f8347e9e5ba2b3e7351379fc74fc4ddae29878307cad7ae85fdbfe132a

l.anize.co Open in urlscan Pro 193.169.255.250 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

9 Requests

56 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

82 kBTransfer

349 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

9 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

l.anize.co Open in urlscan Pro
193.169.255.250 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

56 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

82 kB
Transfer

349 kB
Size

0
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!