urlscan.io logo urlscan.io
SecurityTrails logo

linkd-4tn.pages.dev Open in urlscan Pro
188.114.96.3  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://linkd-4tn.pages.dev/linkd.html
Effective URL: https://linkd-4tn.pages.dev/linkd
Submission: On June 08 via automatic, source openphish — Scanned from NL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 4 countries across 4 domains to perform 9 HTTP transactions. The main IP is 188.114.96.3, located in Amsterdam, Netherlands and belongs to CLOUDFLARENET, US. The main domain is linkd-4tn.pages.dev.
TLS certificate: Issued by WE1 on June 5th 2024. Valid for: 3 months.
This is the only time linkd-4tn.pages.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: LinkedIn (Social Network) Generic Cloudflare (Online)

Domain & IP information

IP Address AS Autonomous System
2 7 188.114.96.3 13335 (CLOUDFLAR...)
1 128.204.223.94 57367 (ECO-ATMAN...)
2 104.18.10.207 13335 (CLOUDFLAR...)
1 2620:1ec:21::14 8068 (MICROSOFT...)
9 4
Apex Domain
Subdomains		 Transfer
7 pages.dev
linkd-4tn.pages.dev
9 KB
2 bootstrapcdn.com
maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 1268
stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 3330
31 KB
1 linkedin.com
www.linkedin.com — Cisco Umbrella Rank: 553
27 KB
1 serv00.net
apatech123.serv00.net
336 KB
9 4
Domain Requested by
7 linkd-4tn.pages.dev 2 redirects linkd-4tn.pages.dev
1 www.linkedin.com
1 stackpath.bootstrapcdn.com linkd-4tn.pages.dev
1 maxcdn.bootstrapcdn.com linkd-4tn.pages.dev
1 apatech123.serv00.net linkd-4tn.pages.dev
9 5

This site contains no links.

Subject Issuer Validity Valid
linkd-4tn.pages.dev
WE1		 2024-06-05 -
2024-09-03		 3 months crt.sh
*.serv00.net
R3		 2024-04-04 -
2024-07-03		 3 months crt.sh
bootstrapcdn.com
GTS CA 1P5		 2024-05-25 -
2024-08-23		 3 months crt.sh
www.linkedin.com
DigiCert SHA2 Secure Server CA		 2024-01-30 -
2024-07-30		 6 months crt.sh

This page contains 1 frames:

Primary Page: https://linkd-4tn.pages.dev/linkd
Frame ID: DAB117C09C1DE4FDE170ECA7CDFBED32
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Messages | Linkedln | Welcome back

Page URL History Show full URLs

  1. http://linkd-4tn.pages.dev/linkd.html HTTP 307
    https://linkd-4tn.pages.dev/linkd.html HTTP 308
    https://linkd-4tn.pages.dev/linkd Page URL
  2. https://linkd-4tn.pages.dev/cdn-cgi/phish-bypass?atok=4TOvpm404nnrFtY7nJW65Fdh04m_MYXyVz2xEE71oww-171785... HTTP 301
    https://linkd-4tn.pages.dev/linkd Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

9
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

5
Subdomains

4
IPs

4
Countries

402 kB
Transfer

486 kB
Size

4
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://linkd-4tn.pages.dev/linkd.html HTTP 307
    https://linkd-4tn.pages.dev/linkd.html HTTP 308
    https://linkd-4tn.pages.dev/linkd Page URL
  2. https://linkd-4tn.pages.dev/cdn-cgi/phish-bypass?atok=4TOvpm404nnrFtY7nJW65Fdh04m_MYXyVz2xEE71oww-1717855841-0.0.1.1-%2Flinkd HTTP 301
    https://linkd-4tn.pages.dev/linkd Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://linkd-4tn.pages.dev/linkd.html HTTP 307
  • https://linkd-4tn.pages.dev/linkd.html HTTP 308
  • https://linkd-4tn.pages.dev/linkd

9 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
linkd
linkd-4tn.pages.dev/
Redirect Chain
  • http://linkd-4tn.pages.dev/linkd.html
  • https://linkd-4tn.pages.dev/linkd.html
  • https://linkd-4tn.pages.dev/linkd
4 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://linkd-4tn.pages.dev/linkd
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
afac3959145cadeb83ae2cae5bccce5766d575705371ef6efad4fbb0d2b56004
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Accept-Language
nl-NL,nl;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

cf-ray
89097780d9d637f8-FRA
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Sat, 08 Jun 2024 14:10:41 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KIqTnq%2BMcMSQynUU9Do3J2CLEjGHlKV6k181rq2KXapZDjXU4E6XflECFI3yQ687UKzduqYKmJQ5nS2u1iNP5MA6wl3Mou5q28lo6Xv2OvGDnoctzPQXtNqTJS3najvBvTUcJELQ"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-frame-options
SAMEORIGIN

Redirect headers

access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
cf-ray
89097780897837f8-FRA
content-length
0
date
Sat, 08 Jun 2024 14:10:41 GMT
location
/linkd
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
strict-origin-when-cross-origin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DYtHZzjNsYA7Og3XGK5uxhgVNGApA%2BHPQFXZ6frxUNGINk4N3cvNEowZJIHjkWAGEVXo6F8BhRU0lmxV8AxWst2%2BUIHeeaAOC8nqAPrEaCJ29ZsKww64H9biFfTSf0nr1SBmtQYD"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
cf.errors.css
linkd-4tn.pages.dev/cdn-cgi/styles/ 		23 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://linkd-4tn.pages.dev/cdn-cgi/styles/cf.errors.css
Requested by
Host: linkd-4tn.pages.dev
URL: https://linkd-4tn.pages.dev/linkd
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://linkd-4tn.pages.dev/linkd
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 08 Jun 2024 14:10:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 04 Jun 2024 12:26:34 GMT
server
cloudflare
etag
W/"665f07fa-5df3"
x-frame-options
DENY
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=7200, public
cf-ray
890977811a2537f8-FRA
expires
Sat, 08 Jun 2024 16:10:41 GMT
icon-exclamation.png
linkd-4tn.pages.dev/cdn-cgi/images/ 		452 B
634 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://linkd-4tn.pages.dev/cdn-cgi/images/icon-exclamation.png?1376755637
Requested by
Host: linkd-4tn.pages.dev
URL: https://linkd-4tn.pages.dev/cdn-cgi/styles/cf.errors.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://linkd-4tn.pages.dev/cdn-cgi/styles/cf.errors.css
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 08 Jun 2024 14:10:41 GMT
x-content-type-options
nosniff
last-modified
Tue, 04 Jun 2024 12:26:34 GMT
server
cloudflare
etag
"665f07fa-1c4"
x-frame-options
DENY
vary
Accept-Encoding
content-type
image/png
cache-control
max-age=7200, public
accept-ranges
bytes
cf-ray
890977814a5a37f8-FRA
content-length
452
expires
Sat, 08 Jun 2024 16:10:41 GMT
Primary Request linkd
linkd-4tn.pages.dev/
Redirect Chain
  • https://linkd-4tn.pages.dev/cdn-cgi/phish-bypass?atok=4TOvpm404nnrFtY7nJW65Fdh04m_MYXyVz2xEE71oww-1717855841-0.0.1.1-%2Flinkd
  • https://linkd-4tn.pages.dev/linkd
100 B
558 B 		Document
General
Check archive.org
Download Go to
Full URL
https://linkd-4tn.pages.dev/linkd
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9e3d9cfbb86e79dba455cbaa005638f5ee5179784c3daca09088db0d972aae4f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
nl-NL,nl;q=0.9;q=0.9
Referer
https://linkd-4tn.pages.dev/linkd
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
cache-control
public, max-age=0, must-revalidate
cf-ray
8909779c3dfb37f8-FRA
content-encoding
br
content-type
text/html; charset=utf-8
date
Sat, 08 Jun 2024 14:10:45 GMT
etag
W/"3ce29730add83349ad0e1e128628f427"
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
strict-origin-when-cross-origin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Lxb%2FWEGBb43zZX69kZIBA5t8BrBTmBjxXQ2v7MuD8Gbv1IKeYRvm5KpH4A8FnKQdZJQ19NaBwpG4jnOR8kKKJVpwRIUA%2Ff%2FM%2BfDXApAr0D7ep7W5%2BhObxS1gouRvk6EbLThQ2%2FEl"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-content-type-options
nosniff

Redirect headers

cache-control
private, no-cache
cf-ray
8909779c0db537f8-FRA
content-length
167
content-type
text/html
date
Sat, 08 Jun 2024 14:10:45 GMT
location
https://linkd-4tn.pages.dev/linkd
server
cloudflare
x-content-type-options
nosniff
x-frame-options
DENY
linTst.js
apatech123.serv00.net/ 		336 KB
336 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://apatech123.serv00.net/linTst.js
Requested by
Host: linkd-4tn.pages.dev
URL: https://linkd-4tn.pages.dev/linkd
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
128.204.223.94 , Poland, ASN57367 (ECO-ATMAN-PL ECO-ATMAN-, PL),
Reverse DNS
web4.serv00.com
Software
nginx /
Resource Hash
413e6fcc8cd97d997638f9fdb7dec582dc694602bd1f00fcd1cb274ac02a88c6

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://linkd-4tn.pages.dev/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 08 Jun 2024 14:10:45 GMT
last-modified
Tue, 04 Jun 2024 22:37:12 GMT
server
nginx
accept-ranges
bytes
etag
"665f9718-53ee7"
content-length
343783
content-type
application/javascript
jquery-3.3.1.js
linkd-4tn.pages.dev/js/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://linkd-4tn.pages.dev/js/jquery-3.3.1.js
Requested by
Host: linkd-4tn.pages.dev
URL: https://linkd-4tn.pages.dev/linkd
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://linkd-4tn.pages.dev/linkd
Origin
https://linkd-4tn.pages.dev
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 08 Jun 2024 14:10:46 GMT
referrer-policy
strict-origin-when-cross-origin
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LVPUM5l%2BoTh5%2BkdgWjz%2F5493Nm6sn%2Bdp62Fi2yNZHWSl7asS6LPCIdHQnZxs9TLZVgzXiuAm%2FJFbKmxrv3hNqCmNRMjGVdNBWBzGYFoPqrjxL1NVj2FrSLrPYCOL58eHMOHol6Yi"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
cache-control
no-store
cf-ray
890977a0ec9737f8-FRA
alt-svc
h3=":443"; ma=86400
content-length
0
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/ 		48 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
Requested by
Host: linkd-4tn.pages.dev
URL: https://linkd-4tn.pages.dev/linkd
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.10.207 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://linkd-4tn.pages.dev/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 08 Jun 2024 14:10:46 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
cdn-edgestorageid
1048
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
5256819
cdn-cachedat
03/18/2024 12:46:36
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
last-modified
Mon, 25 Jan 2021 22:04:04 GMT
cdn-proxyver
1.04
cdn-requestpullcode
200
server
cloudflare
etag
W/"14d449eb8876fa55e1ef3c2cc52b0c17"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cache-control
public, max-age=31919000
cdn-requestid
e3f3bfe1b89f7f16a5a4802a3640b8c7
timing-allow-origin
*
cdn-requestcountrycode
DE
cdn-status
200
cf-ray
890977a10a779760-FRA
cdn-requestpullsuccess
True
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/ 		50 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js
Requested by
Host: linkd-4tn.pages.dev
URL: https://linkd-4tn.pages.dev/linkd
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.10.207 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://linkd-4tn.pages.dev/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 08 Jun 2024 14:10:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
cdn-edgestorageid
723
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
7498179
cdn-cachedat
11/15/2021 23:30:00
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
last-modified
Mon, 25 Jan 2021 22:04:06 GMT
cdn-proxyver
1.0
cdn-requestpullcode
200
server
cloudflare
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cache-control
public, max-age=31919000
cdn-requestid
a35b0179a28ed953258d0fb41376a09c
timing-allow-origin
*
cdn-requestcountrycode
DE
cdn-status
200
cf-ray
890977a11a7b9760-FRA
cdn-requestpullsuccess
True
favicon.ico
www.linkedin.com/ 		24 KB
27 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://www.linkedin.com/favicon.ico
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
19b079c09197fba68d021fa3ba394ec91703909ffd237efa3eb9a2bca13148ec
Security Headers
Name Value
Content-Security-Policy default-src 'none'; connect-src 'self' *.licdn.com *.linkedin.com cdn.linkedin.oribi.io dpm.demdex.net/id lnkd.demdex.net blob: accounts.google.com/gsi/ linkedin.sc.omtrdc.net/b/ss/ *.microsoft.com *.adnxs.com login.microsoftonline.com; script-src 'report-sample' 'sha256-SSoodjUD3LGm2FfFCVHGqEb8D4UM3OOigidT2UKDcYg=' 'sha256-cKTgdnmO6+hXd85a9wKg1effVfVzenUAtUCyOKY9bQE=' 'sha256-DwtT8+ZZKpxH9pqZNAmJ3GdbLAh5SsYaXR3omTXPCns=' 'sha256-sV9jZa797T0QWBzcU/CNd4tpBhTnh+TFdLnfjlitl28=' 'sha256-aa/Q8CRBDSqTQbCIyioPhZaz+G+dbPyu7BzsjInEmiU=' 'sha256-THuVhwbXPeTR0HszASqMOnIyxqEgvGyBwSPBKBF/iMc=' 'sha256-zTIusdVJJeXz9+iox2a+pdDglzbpRpFVRzEwvW4AONk=' 'sha256-iC8MPqNLw0FDnsBf4DlSkFLNTwhkI85aouiAEB819ic=' 'sha256-2EqrEvcPzl8c6/TSGVvaVMEe7lg700MAz/te4/3kTYY=' 'sha256-y5uW69VItKj51mcc7UD9qfptDVUqicZL+bItEpvVNDw=' 'sha256-DatsFGoJ8gFkzzxo47Ou76WZ+3QBPOQHtBu9p9b3DhA=' 'sha256-k95cyM8gFgPziZe5VQ2IvJvBUVyd5zFt2CokIUwqdHE=' 'sha256-PyCXNcEkzRWqbiNr087fizmiBBrq9O6GGD8eV3P09Ik=' 'sha256-RFqsjmAF1N5LnfpaHFvPqFlVkeIS/DtTAFor+JjJJVc=' 'sha256-2SQ55Erm3CPCb+k03EpNxU9bdV3XL9TnVTriDs7INZ4=' 'sha256-S/KSPe186K/1B0JEjbIXcCdpB97krdzX05S+dHnQjUs=' 'sha256-3RIGhhApBii1KY+aW1xk7kFyoQY8vSVE5DfT7E9SJUc=' 'sha256-9pXOIwF4N0gPltLd3AI69lkCjSC2H/Eb3sc5zdmUyYU=' 'sha256-jou6v/Nleyzoc+LXktAv1Fp8M807dVVxy7E/yzVljHc=' 'sha256-6E4e/3dSvj/8JZT2S2yR91mspqM6MyOpKl5lrhHsZa8=' 'sha256-3woF8BZ54TeXM+czaH3aXoaJsVpiamuAKFsXDykAR/Q=' 'sha256-vIfNcKb8ixJg1cfJIoNNYjWcm0lezj1/XpUNFiZyVsU=' 'sha256-cLsHUHFgT/VGX04cZrJ9xgm4HbzTR7ptutkxK+7BlMk=' 'sha256-BwU8jMnQYUhjOpsDVABpfddV/DlP1ZYrFcTumYw7x54=' 'sha256-wz6ika9i3WU3bpUPdhYDZeO/NrDQniDyiscN0LWnyaY=' 'sha256-wy4DvlEW9PHPIGvQJW6Wv4woBSa/0LJHs8LHsBVVXCs=' 'sha256-065A0cJTDQ+hyKvufSL/flW02hIbgLndOINLRWux6To=' 'sha256-Ga5SLB8hPdWUE8Wb6LgZ05D9Z5vrdLAaPbDBW2m3BI8=' static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com snap.licdn.com; img-src data: blob: * android-webview-video-poster:; font-src data: *; style-src 'self' 'unsafe-inline' static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com; media-src 'self' *.licdn.com *.lynda.com; worker-src 'self' blob: static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com; frame-src 'self' www.youtube.com/embed/ www.youtube-nocookie.com/embed/ lnkd.demdex.net smartlock.google.com accounts.google.com player.vimeo.com *.linkedin.com www.slideshare.net *.megaphone.fm *.omny.fm *.sounder.fm msit.powerbi.com app.powerbi.com linkedin.github.io *.licdn.com *.adnxs.com acdn.adnxs-simple.com radar.cedexis.com edge-auth.microsoft.com; frame-ancestors 'self' *.www.linkedin.com:*; manifest-src 'self'; report-uri https://www.linkedin.com/security/csp?f=d
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options sameorigin

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://linkd-4tn.pages.dev/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000
content-security-policy
default-src 'none'; connect-src 'self' *.licdn.com *.linkedin.com cdn.linkedin.oribi.io dpm.demdex.net/id lnkd.demdex.net blob: accounts.google.com/gsi/ linkedin.sc.omtrdc.net/b/ss/ *.microsoft.com *.adnxs.com login.microsoftonline.com; script-src 'report-sample' 'sha256-SSoodjUD3LGm2FfFCVHGqEb8D4UM3OOigidT2UKDcYg=' 'sha256-cKTgdnmO6+hXd85a9wKg1effVfVzenUAtUCyOKY9bQE=' 'sha256-DwtT8+ZZKpxH9pqZNAmJ3GdbLAh5SsYaXR3omTXPCns=' 'sha256-sV9jZa797T0QWBzcU/CNd4tpBhTnh+TFdLnfjlitl28=' 'sha256-aa/Q8CRBDSqTQbCIyioPhZaz+G+dbPyu7BzsjInEmiU=' 'sha256-THuVhwbXPeTR0HszASqMOnIyxqEgvGyBwSPBKBF/iMc=' 'sha256-zTIusdVJJeXz9+iox2a+pdDglzbpRpFVRzEwvW4AONk=' 'sha256-iC8MPqNLw0FDnsBf4DlSkFLNTwhkI85aouiAEB819ic=' 'sha256-2EqrEvcPzl8c6/TSGVvaVMEe7lg700MAz/te4/3kTYY=' 'sha256-y5uW69VItKj51mcc7UD9qfptDVUqicZL+bItEpvVNDw=' 'sha256-DatsFGoJ8gFkzzxo47Ou76WZ+3QBPOQHtBu9p9b3DhA=' 'sha256-k95cyM8gFgPziZe5VQ2IvJvBUVyd5zFt2CokIUwqdHE=' 'sha256-PyCXNcEkzRWqbiNr087fizmiBBrq9O6GGD8eV3P09Ik=' 'sha256-RFqsjmAF1N5LnfpaHFvPqFlVkeIS/DtTAFor+JjJJVc=' 'sha256-2SQ55Erm3CPCb+k03EpNxU9bdV3XL9TnVTriDs7INZ4=' 'sha256-S/KSPe186K/1B0JEjbIXcCdpB97krdzX05S+dHnQjUs=' 'sha256-3RIGhhApBii1KY+aW1xk7kFyoQY8vSVE5DfT7E9SJUc=' 'sha256-9pXOIwF4N0gPltLd3AI69lkCjSC2H/Eb3sc5zdmUyYU=' 'sha256-jou6v/Nleyzoc+LXktAv1Fp8M807dVVxy7E/yzVljHc=' 'sha256-6E4e/3dSvj/8JZT2S2yR91mspqM6MyOpKl5lrhHsZa8=' 'sha256-3woF8BZ54TeXM+czaH3aXoaJsVpiamuAKFsXDykAR/Q=' 'sha256-vIfNcKb8ixJg1cfJIoNNYjWcm0lezj1/XpUNFiZyVsU=' 'sha256-cLsHUHFgT/VGX04cZrJ9xgm4HbzTR7ptutkxK+7BlMk=' 'sha256-BwU8jMnQYUhjOpsDVABpfddV/DlP1ZYrFcTumYw7x54=' 'sha256-wz6ika9i3WU3bpUPdhYDZeO/NrDQniDyiscN0LWnyaY=' 'sha256-wy4DvlEW9PHPIGvQJW6Wv4woBSa/0LJHs8LHsBVVXCs=' 'sha256-065A0cJTDQ+hyKvufSL/flW02hIbgLndOINLRWux6To=' 'sha256-Ga5SLB8hPdWUE8Wb6LgZ05D9Z5vrdLAaPbDBW2m3BI8=' static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com snap.licdn.com; img-src data: blob: * android-webview-video-poster:; font-src data: *; style-src 'self' 'unsafe-inline' static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com; media-src 'self' *.licdn.com *.lynda.com; worker-src 'self' blob: static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com; frame-src 'self' www.youtube.com/embed/ www.youtube-nocookie.com/embed/ lnkd.demdex.net smartlock.google.com accounts.google.com player.vimeo.com *.linkedin.com www.slideshare.net *.megaphone.fm *.omny.fm *.sounder.fm msit.powerbi.com app.powerbi.com linkedin.github.io *.licdn.com *.adnxs.com acdn.adnxs-simple.com radar.cedexis.com edge-auth.microsoft.com; frame-ancestors 'self' *.www.linkedin.com:*; manifest-src 'self'; report-uri https://www.linkedin.com/security/csp?f=d
x-content-type-options
nosniff
date
Sat, 08 Jun 2024 14:10:46 GMT
x-cache
CONFIG_NOCACHE
content-length
24838
x-li-uuid
AAYaYXuGOGUEZIhLf1qGfw==
last-modified
Tue, 16 Apr 2024 21:20:54 GMT
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: 3521F889C4AF4C52BB9017095F9672AF Ref B: BRU30EDGE0606 Ref C: 2024-06-08T14:10:46Z
etag
"661eebb6-6106"
x-frame-options
sameorigin
content-type
image/x-icon
x-li-fabric
prod-ltx1
cache-control
max-age=604800,private
x-li-proto
http/2
accept-ranges
bytes
expires
Sat, 15 Jun 2024 14:10:46 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: LinkedIn (Social Network) Generic Cloudflare (Online)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

string| ai function| $ function| jQuery object| bootstrap function| _0x20a9 function| _0x3646

4 Cookies

Domain/Path Name / Value
.linkd-4tn.pages.dev/ Name: __cf_mw_byp
Value: 4TOvpm404nnrFtY7nJW65Fdh04m_MYXyVz2xEE71oww-1717855841-0.0.1.1-/linkd
.linkedin.com/ Name: bcookie
Value: "v=2&22924d3e-dbad-479d-8c4d-b4cec09ae347"
.www.linkedin.com/ Name: bscookie
Value: "v=1&2024060814104697ad5bfb-3eaf-475e-8762-d3a1f0e87a6eAQG_7XFqyZxxvBlE4CFbfhK2viCoBim1"
.linkedin.com/ Name: li_gc
Value: MTswOzE3MTc4NTU4NDY7MjswMjF2jL8Iioxgds51lv+3rtBRh3XEt5+oXGu7mtgvatr+MA==

7 Console Messages

Source Level URL
Text
javascript warning
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network error URL: https://linkd-4tn.pages.dev/js/jquery-3.3.1.js
Message:
Failed to load resource: the server responded with a status of 404 ()
recommendation verbose URL: https://linkd-4tn.pages.dev/linkd
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
other warning URL: https://linkd-4tn.pages.dev/linkd
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://linkd-4tn.pages.dev/linkd
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://linkd-4tn.pages.dev/linkd
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Frame-Options SAMEORIGIN