watchwave.fun Open in urlscan Pro
2a07:7800::221 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://watchwave.fun/
Effective URL:
https://watchwave.fun/stpage.php
Submission: On November 26 via api (November 26th 2024, 11:18:18 pm UTC) from US — Scanned from GB

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 11 HTTP transactions. The main IP is 2a07:7800::221, located in United Kingdom and belongs to TWENTYI 20i Limited, GB. The main domain is watchwave.fun.
TLS certificate: Issued by R11 on November 12th 2024. Valid for: 3 months.

This is the only time watchwave.fun was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 5	2a07:7800::221 2a07:7800::221	48254 (TWENTYI 2...) (TWENTYI 20i Limited)
6	2a00:86c0:209... 2a00:86c0:2091::1	40027 (NETFLIX-ASN) (NETFLIX-ASN)
1	49.44.220.70 49.44.220.70	55836 (RELIANCEJ...) (RELIANCEJIO-IN Reliance Jio Infocomm Limited)
11	3

5 2a07:7800::221 (United Kingdom) 1 redirects

ASN48254 (TWENTYI 20i Limited, GB)

watchwave.fun	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:86c0:2091::1 (United States)

ASN40027 (NETFLIX-ASN, US)

assets.nflxext.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 49.44.220.70 (India)

ASN55836 (RELIANCEJIO-IN Reliance Jio Infocomm Limited, IN)

occ-0-2087-2164.1.nflxso.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	nflxext.com assets.nflxext.com — Cisco Umbrella Rank: 5272	139 KB
5	watchwave.fun 1 redirects watchwave.fun	658 KB
1	nflxso.net occ-0-2087-2164.1.nflxso.net	249 KB
11	3

	Domain	Requested by
6	assets.nflxext.com	watchwave.fun
5	watchwave.fun	1 redirects watchwave.fun
1	occ-0-2087-2164.1.nflxso.net	watchwave.fun
11	3

This site contains no links.

Subject Issuer	Validity	Valid
*.watchwave.fun R11	`2024-11-12` - `2025-02-10`	3 months	crt.sh
*.1.nflxso.net DigiCert Secure Site ECC CA-1	`2024-11-03` - `2024-12-10`	a month	crt.sh

This page contains 1 frames:

Primary Page: https://watchwave.fun/stpage.php
Frame ID: 8365C5017AB3ABA72434BEBF3CFC5450
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Watchwave-Shows Online, Watch Movies Online

Page URL History Show full URLs

https://watchwave.fun/ HTTP 302
https://watchwave.fun/stpage.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

11
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

1046 kB
Transfer

1326 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://watchwave.fun/ HTTP 302
https://watchwave.fun/stpage.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request stpage.php Show response watchwave.fun/ Redirect Chain https://watchwave.fun/ https://watchwave.fun/stpage.php	7 KB 2 KB	27ms 27ms	Document text/html	2a07:7800::221 TWENTYI 20i Limited
General Check archive.org Show headers Download Go to Full URL https://watchwave.fun/stpage.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a07:7800::221 , United Kingdom, ASN48254 (TWENTYI 20i Limited, GB), Reverse DNS Software Apache / PHP/7.4.33 Resource Hash `143d589f73ebec88b41aee0e631a59cd1284bf1fa8a572db6d995f1fbefa7300` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers content-encoding gzip content-type text/html; charset=UTF-8 date Tue, 26 Nov 2024 23:18:12 GMT server Apache vary Accept-Encoding Accept-Encoding x-cdn-cache-status MISS x-cdn-node-is-at-origin 1 x-origin-cache-status MISS x-powered-by PHP/7.4.33 x-provided-by StackCDN x-via LHR2 Redirect headers cache-control no-store, no-cache, must-revalidate content-length 0 content-type text/html; charset=UTF-8 date Tue, 26 Nov 2024 23:18:12 GMT expires Thu, 19 Nov 1981 08:52:00 GMT location stpage.php pragma no-cache server Apache x-cdn-cache-status EXPIRED x-cdn-node-is-at-origin 1 x-origin-cache-status EXPIRED x-powered-by PHP/7.4.33 x-provided-by StackCDN x-via LHR2
GET H2	200	stpage.css watchwave.fun/css/	5 KB 5 KB	30ms 29ms	Stylesheet text/css	2a07:7800::221 TWENTYI 20i Limited
General Check archive.org Show headers Download Go to Full URL https://watchwave.fun/css/stpage.css Requested by Host: watchwave.fun URL: https://watchwave.fun/stpage.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a07:7800::221 , United Kingdom, ASN48254 (TWENTYI 20i Limited, GB), Reverse DNS Software Apache / Resource Hash `11bceff4bef2630ebf4e17ac5a6b799a8d021f21835c51bc4c050a97a9384c5a` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://watchwave.fun/stpage.php Response headers x-cdn-node-is-at-origin 1 x-via LHR2 etag "13a9-627cc174d0880" x-cdn-cache-status EXPIRED accept-ranges bytes content-length 5033 date Tue, 26 Nov 2024 23:18:12 GMT x-origin-cache-status EXPIRED content-type text/css last-modified Tue, 26 Nov 2024 07:49:38 GMT server Apache x-provided-by StackCDN vary Accept-Encoding
GET H/1.1	200 OK	tv.png assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/	11 KB 11 KB	90ms 26ms	Image image/png	2a00:86c0:2091::1 NETFLIX-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/tv.png Requested by Host: watchwave.fun URL: https://watchwave.fun/stpage.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2a00:86c0:2091::1 , United States, ASN40027 (NETFLIX-ASN, US), Reverse DNS Software nginx / Resource Hash `b68ea2c7bea397aa11fadb189ce7d83862baebaf03ece643eb5aa9fb5f755056` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://watchwave.fun/ Response headers Content-MD5 d5lKZzJ7qVff2IDjOpHwQQ== Cache-Control max-age=604801 Connection keep-alive Expires Tue, 03 Dec 2024 23:18:14 GMT Accept-Ranges bytes Content-Length 11418 Date Tue, 26 Nov 2024 23:18:13 GMT Content-Type image/png Last-Modified Wed, 14 Nov 2018 18:20:41 GMT Server nginx
GET H/1.1	200 OK	mobile-0819.jpg assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/	48 KB 49 KB	90ms 24ms	Image image/jpeg	2a00:86c0:2091::1 NETFLIX-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/mobile-0819.jpg Requested by Host: watchwave.fun URL: https://watchwave.fun/stpage.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2a00:86c0:2091::1 , United States, ASN40027 (NETFLIX-ASN, US), Reverse DNS Software nginx / Resource Hash `492fdebd363e40cbba153a244bcfe2a7f5f7cf20aff0805fe45d5c7e2180b875` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://watchwave.fun/ Response headers Content-MD5 pIMz1DwZYS7WGYf6Xb/zxQ== Cache-Control max-age=604801 Connection keep-alive Expires Tue, 03 Dec 2024 23:18:14 GMT Accept-Ranges bytes Content-Length 49614 Date Tue, 26 Nov 2024 23:18:13 GMT Content-Type image/jpeg Last-Modified Wed, 14 Aug 2019 17:59:05 GMT Server nginx
GET H/1.1	200 OK	AAAABVr8nYuAg0xDpXDv0VI9HUoH7r2aGp4TKRCsKNQrMwxzTtr-NlwOHeS8bCI2oeZddmu3nMYr3j9MjYhHyjBASb1FaOGYZNYvPBCL.png occ-0-2087-2164.1.nflxso.net/dnm/api/v6/19OhWN2dO19C9txTON9tvTFtefw/	249 KB 249 KB	765ms 154ms	Image image/png	49.44.220.70 RELIANCEJIO-IN Re...
General Check archive.org Show headers Download Go to Show image Full URL https://occ-0-2087-2164.1.nflxso.net/dnm/api/v6/19OhWN2dO19C9txTON9tvTFtefw/AAAABVr8nYuAg0xDpXDv0VI9HUoH7r2aGp4TKRCsKNQrMwxzTtr-NlwOHeS8bCI2oeZddmu3nMYr3j9MjYhHyjBASb1FaOGYZNYvPBCL.png?r=54d Requested by Host: watchwave.fun URL: https://watchwave.fun/stpage.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 49.44.220.70 , India, ASN55836 (RELIANCEJIO-IN Reliance Jio Infocomm Limited, IN), Reverse DNS Software nginx / Resource Hash `1e5a6122c8e39862aa1c92eae0e83e92458232d930620e9ca0c68e9be425aa67` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://watchwave.fun/ Response headers Cache-Control max-age=31104000, public, s-maxage=604800 Timing-Allow-Origin * Accept-CH Device-Memory, Downlink, DPR, ECT, RTT, Save-Data, Viewport-Width, Width ETag "2995e70023477ef72300f24e45aba1d5" Connection keep-alive Accept-Ranges bytes Access-Control-Allow-Origin * Content-Length 254586 Date Tue, 26 Nov 2024 23:18:13 GMT Content-Type image/png Last-Modified Thu, 01 Jun 2023 21:27:38 GMT Server nginx
GET H/1.1	206 Partial Content	video-tv-in-0819.m4v assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/	49 KB 0	75ms 24ms	Media video/x-m4v	2a00:86c0:2091::1 NETFLIX-ASN
General Check archive.org Show headers Download Go to Full URL https://assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/video-tv-in-0819.m4v Requested by Host: watchwave.fun URL: https://watchwave.fun/stpage.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2a00:86c0:2091::1 , United States, ASN40027 (NETFLIX-ASN, US), Reverse DNS Software nginx / Resource Hash Request headers Referer https://watchwave.fun/ Accept-Encoding identity;q=1, ;q=0 User-Agent* Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Range bytes=0- Response headers Content-MD5 pYX28yVkH4IOMnLz7ACG7Q== Cache-Control max-age=604801 Connection keep-alive Content-Range bytes 0-267711/267712 Expires Tue, 03 Dec 2024 23:18:14 GMT Content-Length 267712 Date Tue, 26 Nov 2024 23:18:13 GMT Content-Type video/x-m4v Last-Modified Mon, 12 Aug 2019 20:49:12 GMT Server nginx
GET H/1.1	206 Partial Content	video-devices-in.m4v assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/	73 KB 73 KB	75ms 24ms	Media video/x-m4v	2a00:86c0:2091::1 NETFLIX-ASN
General Check archive.org Show headers Download Go to Full URL https://assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/video-devices-in.m4v Requested by Host: watchwave.fun URL: https://watchwave.fun/stpage.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2a00:86c0:2091::1 , United States, ASN40027 (NETFLIX-ASN, US), Reverse DNS Software nginx / Resource Hash `92259a1c73354bce2540a94397feed47d41bde07f23359decea3187799e5c19d` Request headers Referer https://watchwave.fun/ Accept-Encoding identity;q=1, ;q=0 User-Agent* Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Range bytes=0- Response headers Content-MD5 c+JdHa496slk30MRHATJcw== Cache-Control max-age=604801 Connection keep-alive Content-Range bytes 0-74302/74303 Expires Tue, 03 Dec 2024 23:18:14 GMT Content-Length 74303 Date Tue, 26 Nov 2024 23:18:13 GMT Content-Type video/x-m4v Last-Modified Wed, 23 Jan 2019 00:35:07 GMT Server nginx
GET H2	200	bg.jpg watchwave.fun/assets/image/	649 KB 650 KB	32ms 32ms	Image image/jpeg	2a07:7800::221 TWENTYI 20i Limited
General Check archive.org Show headers Download Go to Show image Full URL https://watchwave.fun/assets/image/bg.jpg Requested by Host: watchwave.fun URL: https://watchwave.fun/css/stpage.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a07:7800::221 , United Kingdom, ASN48254 (TWENTYI 20i Limited, GB), Reverse DNS Software Apache / Resource Hash `9dccfa09682ea897f484a57307fb4e6dcd5160b5e3fd60f0304f9d7ad25bd045` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://watchwave.fun/css/stpage.css Response headers x-via LHR2 etag "a252e-627d41c15ba80" x-cdn-cache-status EXPIRED accept-ranges bytes content-length 664878 date Tue, 26 Nov 2024 23:18:12 GMT x-origin-cache-status EXPIRED content-type image/jpeg last-modified Tue, 26 Nov 2024 17:23:38 GMT server Apache x-provided-by StackCDN x-cdn-node-is-at-origin 1
GET H/1.1	206 Partial Content	video-tv-in-0819.m4v assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/	5 KB 6 KB	63ms 31ms	Media video/x-m4v	2a00:86c0:2091::1 NETFLIX-ASN
General Check archive.org Show headers Download Go to Full URL https://assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/video-tv-in-0819.m4v Requested by Host: watchwave.fun URL: https://watchwave.fun/stpage.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2a00:86c0:2091::1 , United States, ASN40027 (NETFLIX-ASN, US), Reverse DNS Software nginx / Resource Hash `87c71d9108c7ead2c27f80bc5e874f9292f8aa8b657fa9bee6835bddf758cdb8` Request headers Referer https://watchwave.fun/ Accept-Encoding identity;q=1, ;q=0 User-Agent* Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Range bytes=262144- Response headers Content-MD5 pYX28yVkH4IOMnLz7ACG7Q== Cache-Control max-age=604801 Content-Range bytes 262144-267711/267712 Expires Tue, 03 Dec 2024 23:18:14 GMT Content-Length 5568 Date Tue, 26 Nov 2024 23:18:13 GMT Last-Modified Mon, 12 Aug 2019 20:49:12 GMT Content-Type video/x-m4v Server nginx
GET H/1.1	206 Partial Content	video-tv-in-0819.m4v assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/	229 KB 0	1ms 1ms	Media video/x-m4v	2a00:86c0:2091::1 NETFLIX-ASN
General Check archive.org Show headers Download Go to Full URL https://assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/video-tv-in-0819.m4v Requested by Host: watchwave.fun URL: https://watchwave.fun/stpage.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2a00:86c0:2091::1 , United States, ASN40027 (NETFLIX-ASN, US), Reverse DNS Software nginx / Resource Hash Request headers Referer https://watchwave.fun/ Accept-Encoding identity;q=1, ;q=0 User-Agent* Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Range bytes=32768- Response headers Content-MD5 pYX28yVkH4IOMnLz7ACG7Q== Cache-Control max-age=604801 Content-Range bytes 32768-267711/267712 Expires Tue, 03 Dec 2024 23:18:14 GMT Content-Length 234944 Date Tue, 26 Nov 2024 23:18:13 GMT Last-Modified Mon, 12 Aug 2019 20:49:12 GMT Content-Type video/x-m4v Server nginx
GET H2	404	favicon.ico watchwave.fun/	196 B 397 B	31ms 31ms	Other text/html	2a07:7800::221 TWENTYI 20i Limited
General Check archive.org Show headers Download Go to Full URL https://watchwave.fun/favicon.ico Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a07:7800::221 , United Kingdom, ASN48254 (TWENTYI 20i Limited, GB), Reverse DNS Software Apache / Resource Hash `80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://watchwave.fun/stpage.php Response headers content-encoding gzip x-via LHR2 x-cdn-cache-status EXPIRED x-origin-cache-status EXPIRED date Tue, 26 Nov 2024 23:18:14 GMT content-type text/html; charset=iso-8859-1 vary Accept-Encoding server Apache x-cdn-node-is-at-origin 1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			watchwave.fun/	1969-12-31 23:59:59	Name: PHPSESSID Value: 55044002e435aee0fbbb2993ea0755cc

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://watchwave.fun/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.nflxext.com
occ-0-2087-2164.1.nflxso.net
watchwave.fun
2a00:86c0:2091::1
2a07:7800::221
49.44.220.70
11bceff4bef2630ebf4e17ac5a6b799a8d021f21835c51bc4c050a97a9384c5a
143d589f73ebec88b41aee0e631a59cd1284bf1fa8a572db6d995f1fbefa7300
1e5a6122c8e39862aa1c92eae0e83e92458232d930620e9ca0c68e9be425aa67
492fdebd363e40cbba153a244bcfe2a7f5f7cf20aff0805fe45d5c7e2180b875
80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880
87c71d9108c7ead2c27f80bc5e874f9292f8aa8b657fa9bee6835bddf758cdb8
92259a1c73354bce2540a94397feed47d41bde07f23359decea3187799e5c19d
9dccfa09682ea897f484a57307fb4e6dcd5160b5e3fd60f0304f9d7ad25bd045
b68ea2c7bea397aa11fadb189ce7d83862baebaf03ece643eb5aa9fb5f755056

watchwave.fun Open in urlscan Pro 2a07:7800::221 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

11 Requests

100 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

1046 kBTransfer

1326 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

watchwave.fun Open in urlscan Pro
2a07:7800::221 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

1046 kB
Transfer

1326 kB
Size

1
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!