etoll.s-linkt.io
Open in
urlscan Pro
104.21.96.67
Malicious Activity!
Public Scan
Effective URL: https://etoll.s-linkt.io/
Submission: On May 20 via manual from AU — Scanned from AU
Summary
TLS certificate: Issued by E1 on May 18th 2023. Valid for: 3 months.
This is the only time etoll.s-linkt.io was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Linkt (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 104.20.139.65 104.20.139.65 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
11 | 104.21.96.67 104.21.96.67 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 172.217.194.95 172.217.194.95 | 15169 (GOOGLE) (GOOGLE) | |
3 | 45.60.48.24 45.60.48.24 | 19551 (INCAPSULA) (INCAPSULA) | |
1 | 74.125.130.94 74.125.130.94 | 15169 (GOOGLE) (GOOGLE) | |
16 | 4 |
ASN15169 (GOOGLE, US)
PTR: si-in-f95.1e100.net
fonts.googleapis.com |
ASN15169 (GOOGLE, US)
PTR: sb-in-f94.1e100.net
fonts.gstatic.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
s-linkt.io
etoll.s-linkt.io |
366 KB |
3 |
linkt.com.au
manage.linkt.com.au |
4 KB |
1 |
gstatic.com
fonts.gstatic.com |
48 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 35 |
1 KB |
1 |
tinyurl.com
1 redirects
tinyurl.com — Cisco Umbrella Rank: 15887 |
547 B |
16 | 5 |
Domain | Requested by | |
---|---|---|
11 | etoll.s-linkt.io |
etoll.s-linkt.io
|
3 | manage.linkt.com.au |
etoll.s-linkt.io
|
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | fonts.googleapis.com |
etoll.s-linkt.io
|
1 | tinyurl.com | 1 redirects |
16 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
s-linkt.io E1 |
2023-05-18 - 2023-08-16 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-04-24 - 2023-07-17 |
3 months | crt.sh |
MANAGE.CITYLINK.COM.AU Thawte RSA CA 2018 |
2022-09-28 - 2023-09-29 |
a year | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-04-24 - 2023-07-17 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://etoll.s-linkt.io/
Frame ID: E122A42983C9A39C4CC789DA66095604
Requests: 16 HTTP requests in this frame
Screenshot
Page Title
linktPage URL History Show full URLs
-
https://tinyurl.com/mpny4u2c
HTTP 301
https://etoll.s-linkt.io/ Page URL
Detected technologies
Vue.js (JavaScript Frameworks) ExpandDetected patterns
- <[^>]+\sdata-v(?:ue)?-
Google Font API (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://tinyurl.com/mpny4u2c
HTTP 301
https://etoll.s-linkt.io/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
16 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
etoll.s-linkt.io/ Redirect Chain
|
828 B 858 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
5 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
config.js
etoll.s-linkt.io/ |
60 B 445 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
chunk-vendors.5f41e082.js
etoll.s-linkt.io/js/ |
959 KB 258 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.91320221.js
etoll.s-linkt.io/js/ |
14 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
chunk-vendors.2b35c01c.css
etoll.s-linkt.io/css/ |
206 KB 35 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.a8c9b542.css
etoll.s-linkt.io/css/ |
57 KB 11 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
visits
etoll.s-linkt.io/api/num/record/ |
41 B 391 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
user
etoll.s-linkt.io/api/card/websocket-domain/ |
121 B 504 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
linkt_logo.93d970a4.svg
etoll.s-linkt.io/img/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo-Transurban.cc5a7e14.png
etoll.s-linkt.io/img/ |
25 KB 26 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon-twitter.png
manage.linkt.com.au/retailweb/resources/retailer/linkt/img/icons/ |
545 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
facebook-icon.png
manage.linkt.com.au/retailweb/resources/retailer/linkt/img/icons/ |
494 B 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon-youtube.png
manage.linkt.com.au/retailweb/resources/retailer/linkt/img/icons/ |
424 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
element-icons.ff18efd1.woff
etoll.s-linkt.io/fonts/ |
28 KB 28 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v35/ |
47 KB 48 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Linkt (Transportation)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| webpackChunklinkt function| clearImmediate function| setImmediate function| _ object| $cookies7 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
etoll.s-linkt.io/api | Name: JSESSIONID Value: 13716AD71EF5BC9663BAC08591726057 |
|
etoll.s-linkt.io/ | Name: domainName Value: wss%3A%2F%2Feeee.tolllinkt.online%2Fapi%2Fapprove%2F |
|
.linkt.com.au/ | Name: visid_incap_1644040 Value: mix33vgpQU+B+eSKPY3iCDc1aWQAAAAAQUIPAAAAAAA2sjMGMs9Z8gv0uyvK/vl/ |
|
manage.linkt.com.au/ | Name: AWSALBCORS Value: S6DiuK+TQV+HsPX8Q1K/qaVXiPRUoPUicPsgcfVYjJZRBH3snW6a1praOyKl2DN1fSXOiBvhbATYHp30zUyT0q46ULLb0aSCjd59fYs8nP+asrM75ZaEOvENgJDO |
|
.linkt.com.au/ | Name: nlbi_1644040 Value: +wSUNX9umS8JXyvu4XKpuwAAAADsqmEkG7C75cKWH/MAJ8mY |
|
.linkt.com.au/ | Name: incap_ses_404_1644040 Value: O1TcKaJ7EhroUSzz4E2bBTc1aWQAAAAAdb+PsW1GVF03iETJ2C4ffQ== |
|
etoll.s-linkt.io/ | Name: userIp Value: 66.203.112.161 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
etoll.s-linkt.io
fonts.googleapis.com
fonts.gstatic.com
manage.linkt.com.au
tinyurl.com
104.20.139.65
104.21.96.67
172.217.194.95
45.60.48.24
74.125.130.94
0853aaa2d688c7126e27018d557e1ba07d11e1f5f45f1d0c318412006aa8fab8
1c8219ce2ffc4f9848e40d93d9da5f3d97c67c0754e39bba76858708d25d0704
1d26fb4550d79ddd00ed695c52e9f888abac94e0d3bc3ed161dffbe8b07d9bdb
39f39b80a59f7656580f8cc2f037ed54a49a6415e03cbdb2a09584be63241330
55249775ca508b84f9ae864910450bd7d3f884f6a0b4fb9c8a4383e09961181f
67c5e1a39cce0c03cd5f194e9daa6f4c805ede1b6852258158bdfe87f6b3edad
6cc997d64a81ba73c53ce8f43ac3629036ac71b1ad6a7bf9f0429f6908b95b21
785b3c6cc775a90a0c69c4ca9228dce8d19e91fdbea991ce3ed438f3e77e38c2
794e4bb51b9f1f7efeadab401b75b6f8c65038238b9f9bd694f0a451962a88bd
7c7818c25a18e8a38553fcbcbc2ad0b5e964103a7d2e494f82815e3f70bf3fc5
85cdaa21c8d06fc4322303a35cea7cd1acdfa9695ad1882598fd107cf3d17522
9fbfd27008b65331500624e892dc227171c779c24bfd257cbb4ac8e35de57d75
ab40a58972be2ceab32e7e35dab3131b959aae63835d7bda1a79ae51f9a73c17
b6c8d196e7ba5d78fe49e3c40cfa146f549f0edba08455f4fe3de75a79f94995
d5661d91e8d56409f4525f8f58265c356c204e9fde3eda57a61d1a8594483bc1
f9d4f01c414929081bc49637b884fdbbe68c626cfead3f295f4b737b3cf4e4dc