urlscan.io logo urlscan.io
SecurityTrails logo

opnmax.com Open in urlscan Pro
2a06:98c1:3120::3  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://vidvedaa.com/nftlz.html
Effective URL: https://opnmax.com/wp-includes/Requests/Text/nflzxe/logn.php?locale=GB&ID=1&ui-action=signIn&ui-id=TIzVUCgeNadXXIFo...
Submission: On August 02 via automatic, source phishtank — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 8 HTTP transactions. The main IP is 2a06:98c1:3120::3, located in United States and belongs to CLOUDFLARENET, US. The main domain is opnmax.com.
TLS certificate: Issued by GTS CA 1P5 on June 27th 2023. Valid for: 3 months.
This is the only time opnmax.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

IP Address AS Autonomous System
1 115.111.183.33 4755 (TATACOMM-...)
7 2a06:98c1:312... 13335 (CLOUDFLAR...)
8 2
Apex Domain
Subdomains		 Transfer
7 opnmax.com
opnmax.com
469 KB
1 vidvedaa.com
vidvedaa.com
358 B
8 2
Domain Requested by
7 opnmax.com opnmax.com
1 vidvedaa.com
8 2

This site contains no links.

Subject Issuer Validity Valid
vidvedaa.com
cPanel, Inc. Certification Authority		 2023-07-23 -
2023-10-21		 3 months crt.sh
opnmax.com
GTS CA 1P5		 2023-06-27 -
2023-09-25		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://opnmax.com/wp-includes/Requests/Text/nflzxe/logn.php?locale=GB&ID=1&ui-action=signIn&ui-id=TIzVUCgeNadXXIFoLxePmIeXzZRfDGXA
Frame ID: 2EB236A69A22AA3E8B4606B28AF86CDB
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Netflix

Page URL History Show full URLs

  1. https://vidvedaa.com/nftlz.html Page URL
  2. https://opnmax.com/wp-includes/Requests/Text/nflzxe/ Page URL
  3. https://opnmax.com/wp-includes/Requests/Text/nflzxe/logn.php?locale=GB&ID=1&ui-action=signIn&ui... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)
Overall confidence: 100%
Detected patterns
  • <[^>]+data-react

Page Statistics

8
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

469 kB
Transfer

747 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://vidvedaa.com/nftlz.html Page URL
  2. https://opnmax.com/wp-includes/Requests/Text/nflzxe/ Page URL
  3. https://opnmax.com/wp-includes/Requests/Text/nflzxe/logn.php?locale=GB&ID=1&ui-action=signIn&ui-id=TIzVUCgeNadXXIFoLxePmIeXzZRfDGXA Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
nftlz.html
vidvedaa.com/ 		116 B
358 B 		Document
General
Check archive.org
Download Go to
Full URL
https://vidvedaa.com/nftlz.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
115.111.183.33 Howrah, India, ASN4755 (TATACOMM-AS TATA Communications formerly VSNL is Leading ISP, IN),
Reverse DNS
msgserv.fldec.com
Software
Apache /
Resource Hash
d9369f5043f34d362f42f37be9611f05a748807bce622410191c01b09cb1edfc

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Connection
Keep-Alive
Content-Length
116
Content-Type
text/html
Date
Wed, 02 Aug 2023 13:05:09 GMT
Keep-Alive
timeout=5, max=100
Last-Modified
Thu, 27 Jul 2023 22:53:59 GMT
Server
Apache
/
opnmax.com/wp-includes/Requests/Text/nflzxe/ 		193 B
696 B 		Document
General
Check archive.org
Download Go to
Full URL
https://opnmax.com/wp-includes/Requests/Text/nflzxe/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://vidvedaa.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
no-store, no-cache, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
7f0687eebfda18f9-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Wed, 02 Aug 2023 13:05:12 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DMIBg6BO91Ug6imxSanT54UFoa%2BcU4ZGDYofW%2B0zC1TceMol1dF8w3I%2F4sP9k6DDkDTt7XuBfWxKZJ6EVrJYu8xep9WItZ82lWwpzGeTPFk9FpGpA5L%2FbAUP84TRGCqaC9JclLy1IIXM"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
Primary Request logn.php
opnmax.com/wp-includes/Requests/Text/nflzxe/ 		146 KB
26 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://opnmax.com/wp-includes/Requests/Text/nflzxe/logn.php?locale=GB&ID=1&ui-action=signIn&ui-id=TIzVUCgeNadXXIFoLxePmIeXzZRfDGXA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
09bf8fa611c1d6177c2f62aa611c67c3f6247a5dac097eeb0cd4e7e04bb965f3

Request headers

Referer
https://opnmax.com/wp-includes/Requests/Text/nflzxe/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
no-store, no-cache, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
7f0687f4893718f9-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Wed, 02 Aug 2023 13:05:12 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NNIWoAj1IzTps0kyAn51vG7y07Esc1Te2riP%2BhiGnN0J6z2eR1YHvvUipt3iVv4GeGoN%2FUvTLay1YCN0had%2Bhbvb1BwXK5aJMNnpJdl44wsqfszfyHViTGF2DHxii8TWi1I%2FI17ygRwy"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
styles.css
opnmax.com/wp-includes/Requests/Text/nflzxe/num/ 		125 KB
20 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://opnmax.com/wp-includes/Requests/Text/nflzxe/num/styles.css
Requested by
Host: opnmax.com
URL: https://opnmax.com/wp-includes/Requests/Text/nflzxe/logn.php?locale=GB&ID=1&ui-action=signIn&ui-id=TIzVUCgeNadXXIFoLxePmIeXzZRfDGXA
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f521d107608bffd10caec93b5970ffe49f4b9c4c5ac0072249744483569eb2fd

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://opnmax.com/wp-includes/Requests/Text/nflzxe/logn.php?locale=GB&ID=1&ui-action=signIn&ui-id=TIzVUCgeNadXXIFoLxePmIeXzZRfDGXA
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date
Wed, 02 Aug 2023 13:05:12 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
75504
cf-polished
origSize=159960
alt-svc
h3=":443"; ma=86400
cf-bgj
minify
last-modified
Mon, 02 Sep 2019 09:43:08 GMT
server
cloudflare
etag
W/"270d8-5d6ce42c-386018;gz"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yaePAVAiwT7%2B4Y%2B1iEjZzmei52hqmIbU8HGFcGwzXXLK6GftWujR2%2FyG%2F6FLCrGikhlx4d0%2BOV%2BGvbyzwYuGSOSqbA7yVJS%2BJJz%2FIfVwsh4DSMaN7WJTrPRNmhF%2FGtQ5gO0Mz55ZUDzy"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
public, max-age=31536000
cf-ray
7f0687f50d708fdd-FRA
expires
Tue, 08 Aug 2023 16:06:48 GMT
js.js
opnmax.com/wp-includes/Requests/Text/nflzxe/num/ 		86 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://opnmax.com/wp-includes/Requests/Text/nflzxe/num/js.js
Requested by
Host: opnmax.com
URL: https://opnmax.com/wp-includes/Requests/Text/nflzxe/logn.php?locale=GB&ID=1&ui-action=signIn&ui-id=TIzVUCgeNadXXIFoLxePmIeXzZRfDGXA
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6fdf878caa6115ab88f270d81cfdbccbaa93935924bb9d015b0c4cf4a1d483db

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://opnmax.com/wp-includes/Requests/Text/nflzxe/logn.php?locale=GB&ID=1&ui-action=signIn&ui-id=TIzVUCgeNadXXIFoLxePmIeXzZRfDGXA
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date
Wed, 02 Aug 2023 13:05:12 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
75798
cf-polished
origSize=88145
alt-svc
h3=":443"; ma=86400
cf-bgj
minify
last-modified
Mon, 02 Sep 2019 07:39:54 GMT
server
cloudflare
etag
W/"15851-5d6cc74a-385fd2;gz"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tMjUZ8VCYJYb4Q4lkEzX2Au%2BAart3ANLTY5fxsigUapO4b%2BVY46f0MT4IAIvRQr68YRrD9SrGnAUJchZ56HFUulihExJ9DuiyoEwyfN8fZxMgEDB05di8cuxK8RwW2qrcqysThWE8KTn"}],"group":"cf-nel","max_age":604800}
content-type
application/x-javascript
cache-control
public, max-age=31536000
cf-ray
7f0687f50d738fdd-FRA
expires
Tue, 08 Aug 2023 16:01:54 GMT
lg.jpg
opnmax.com/wp-includes/Requests/Text/nflzxe/num/ 		316 KB
317 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://opnmax.com/wp-includes/Requests/Text/nflzxe/num/lg.jpg
Requested by
Host: opnmax.com
URL: https://opnmax.com/wp-includes/Requests/Text/nflzxe/logn.php?locale=GB&ID=1&ui-action=signIn&ui-id=TIzVUCgeNadXXIFoLxePmIeXzZRfDGXA
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b6f686dd1b217855ff2021f666230131bed3a20c83dd31498500962c967d44dd

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://opnmax.com/wp-includes/Requests/Text/nflzxe/logn.php?locale=GB&ID=1&ui-action=signIn&ui-id=TIzVUCgeNadXXIFoLxePmIeXzZRfDGXA
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date
Wed, 02 Aug 2023 13:05:12 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
49468
alt-svc
h3=":443"; ma=86400
content-length
323733
last-modified
Mon, 02 Sep 2019 09:25:16 GMT
server
cloudflare
etag
"4f095-5d6cdffc-385fd3;;;"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RkY3cbuitEj7wSf4Awe365u76Vu68cErNXTaRNfYUP0CjEYwbTVUgI%2F3N3Z3Ax4PEN3YcCTxKxLfKy8JvmAXXvg5spzweXRijfSSoEknvutVNhwK%2Fq%2FNTJ6i%2BKunCadD1fONKdY0eppO"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7f0687f52d9f8fdd-FRA
expires
Tue, 08 Aug 2023 23:20:44 GMT
FB-f-Logo__blue_57.png
opnmax.com/wp-includes/Requests/Text/nflzxe/num/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://opnmax.com/wp-includes/Requests/Text/nflzxe/num/FB-f-Logo__blue_57.png
Requested by
Host: opnmax.com
URL: https://opnmax.com/wp-includes/Requests/Text/nflzxe/logn.php?locale=GB&ID=1&ui-action=signIn&ui-id=TIzVUCgeNadXXIFoLxePmIeXzZRfDGXA
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://opnmax.com/wp-includes/Requests/Text/nflzxe/logn.php?locale=GB&ID=1&ui-action=signIn&ui-id=TIzVUCgeNadXXIFoLxePmIeXzZRfDGXA
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date
Wed, 02 Aug 2023 13:05:12 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
75504
alt-svc
h3=":443"; ma=86400
content-length
1455
last-modified
Thu, 29 Aug 2019 05:59:42 GMT
server
cloudflare
etag
"5af-5d6769ce-385fcc;;;"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0ipfd9T5MVj%2BJs7UjFdyH40tYtPpwXM3cb0ot03GWZUedX0EoUgtgR3DDfvAajk56R7ckrPuOwe%2FOnXFCOgtejfuACN9%2FaNz7aoAhHFv414nMxjrP6g9BSOO12LNDXTCHxx%2BkFmkidYe"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7f0687f53dad8fdd-FRA
expires
Tue, 08 Aug 2023 16:06:48 GMT
nf-icon-v1-93.woff
opnmax.com/wp-includes/Requests/Text/nflzxe/num/ 		72 KB
72 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://opnmax.com/wp-includes/Requests/Text/nflzxe/num/nf-icon-v1-93.woff
Requested by
Host: opnmax.com
URL: https://opnmax.com/wp-includes/Requests/Text/nflzxe/num/styles.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d

Request headers

Referer
https://opnmax.com/wp-includes/Requests/Text/nflzxe/num/styles.css
Origin
https://opnmax.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date
Wed, 02 Aug 2023 13:05:12 GMT
content-encoding
br
cf-cache-status
REVALIDATED
last-modified
Thu, 29 Aug 2019 05:28:42 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"11f64-5d67628a-385fe7;;;"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FVdaHM%2FKpyEY43iK23U2z52WYrefcXiAmvmQLQrrVOuNu1QGCFQhTphZvqxTenWFqW6Vr0Lyx7xAiGr21%2BawO%2F8N6LEfmTLpEPiutRJcqLwdwNlGUfxIUgntiVV2RRM4vLU%2FA%2B%2FcL%2BUq"}],"group":"cf-nel","max_age":604800}
content-type
application/font-woff
cache-control
max-age=31536000
cf-ray
7f0687f55dd08fdd-FRA
alt-svc
h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| OqlSEjIIF6 function| QvpDFhb7 function| xTFqLdnWz string| input_type function| ddkkj function| EvsPoLnRIksyT function| LdlFylezZcsTLcHXJ function| IhIhLMyUcdycOtFs5

1 Cookies

Domain/Path Name / Value
opnmax.com/ Name: PHPSESSID
Value: jobj80o3gei5ujm9qlv70vklvk