www.gsams.biz Open in urlscan Pro
192.185.28.103  Malicious Activity! Public Scan

4 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set / Show response www.gsams.biz/e4f5e2f2c2/https:/www.netflix.com/account/	17 KB 6 KB	573ms 457ms	Document text/html	192.185.28.103
General Check archive.org Show headers Download Go to Full URL http://www.gsams.biz/e4f5e2f2c2/https:/www.netflix.com/account/ Protocol HTTP/1.1 Server 192.185.28.103 Houston, United States, ASN (), Reverse DNS adecconsultants.com Software nginx/1.12.2 / Resource Hash cbfe57949f2537ec2299454820d67da7f3794f14e2fec93fcd372a23ce155f9f Request headers Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8 Connection keep-alive Accept-Encoding gzip, deflate Host www.gsams.biz Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Pragma no-cache Date Mon, 29 Jan 2018 08:05:09 GMT Content-Encoding gzip Server nginx/1.12.2 Transfer-Encoding chunked Connection keep-alive Content-Type text/html Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Set-Cookie PHPSESSID=e94aaf2997ed1130f5fb0c027ccd47aa; path=/ Expires Thu, 19 Nov 1981 08:52:00 GMT
GET S	200	none.css www.topbro.com/lightbox/style/css/	99 KB 20 KB	130ms 18ms	Stylesheet text/css	185.38.44.163
General Check archive.org Show headers Download Go to Full URL https://www.topbro.com/lightbox/style/css/none.css Requested by Host: www.gsams.biz URL: http://www.gsams.biz/e4f5e2f2c2/https:/www.netflix.com/account/ Protocol SPDY Server 185.38.44.163 , United Kingdom, ASN (), Reverse DNS ns1.thewebhostserver.com Software LiteSpeed / Resource Hash e801505cd25e8a04ff7946f43818a1ab2b4f259696d618fbf2bf92a462bd5226 Request headers Referer http://www.gsams.biz/e4f5e2f2c2/https:/www.netflix.com/account/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers date Mon, 29 Jan 2018 08:05:09 GMT content-encoding gzip last-modified Tue, 12 Sep 2017 21:57:44 GMT server LiteSpeed etag "18b4e-59b85858-fa21bfbdf2a4b153;gz" vary Accept-Encoding content-type text/css status 200 cache-control public, max-age=604800 accept-ranges bytes alt-svc quic=":443"; ma=2592000; v="35,37,38,39" content-length 20213 expires Mon, 05 Feb 2018 08:05:09 GMT
GET S	200	new.css www.topbro.com/lightbox/style/css/	8 KB 2 KB	130ms 19ms	Stylesheet text/css	185.38.44.163
General Check archive.org Show headers Download Go to Full URL https://www.topbro.com/lightbox/style/css/new.css Requested by Host: www.gsams.biz URL: http://www.gsams.biz/e4f5e2f2c2/https:/www.netflix.com/account/ Protocol SPDY Server 185.38.44.163 , United Kingdom, ASN (), Reverse DNS ns1.thewebhostserver.com Software LiteSpeed / Resource Hash 5e08dd7e9e469c5027f50a3875fa26512779e2b6a98dd3b77fa39abf410cf904 Request headers Referer http://www.gsams.biz/e4f5e2f2c2/https:/www.netflix.com/account/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers date Mon, 29 Jan 2018 08:05:09 GMT content-encoding gzip last-modified Tue, 12 Sep 2017 22:01:42 GMT server LiteSpeed etag "1e89-59b85946-4bd38febc182c937;gz" vary Accept-Encoding content-type text/css status 200 cache-control public, max-age=604800 accept-ranges bytes alt-svc quic=":443"; ma=2592000; v="35,37,38,39" content-length 2382 expires Mon, 05 Feb 2018 08:05:09 GMT
GET S	200	FB-f-Logo__blue_57.png www.topbro.com/lightbox/style/img/	1 KB 2 KB	18ms 18ms	Image image/png	185.38.44.163
General Check archive.org Show headers Download Go to Show image Full URL https://www.topbro.com/lightbox/style/img/FB-f-Logo__blue_57.png Requested by Host: www.gsams.biz URL: http://www.gsams.biz/e4f5e2f2c2/https:/www.netflix.com/account/ Protocol SPDY Server 185.38.44.163 , United Kingdom, ASN (), Reverse DNS ns1.thewebhostserver.com Software LiteSpeed / Resource Hash 3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece Request headers Referer http://www.gsams.biz/e4f5e2f2c2/https:/www.netflix.com/account/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers date Mon, 29 Jan 2018 08:05:09 GMT last-modified Sun, 14 May 2017 16:12:42 GMT server LiteSpeed etag "5af-591881fa-9cc2e1534c6d287c;;;" content-type image/png status 200 cache-control public, max-age=604800 accept-ranges bytes alt-svc quic=":443"; ma=2592000; v="35,37,38,39" content-length 1455 expires Mon, 05 Feb 2018 08:05:09 GMT
GET S	200	login-the-crown_2-1500x1000.jpg assets.nflxext.com/ffe/siteui/acquisition/login/	84 KB 85 KB	28ms 7ms	Image image/jpeg	92.123.92.113
General Check archive.org Show headers Download Go to Show image Full URL https://assets.nflxext.com/ffe/siteui/acquisition/login/login-the-crown_2-1500x1000.jpg Requested by Host: www.gsams.biz URL: http://www.gsams.biz/e4f5e2f2c2/https:/www.netflix.com/account/ Protocol SPDY Server 92.123.92.113 , European Union, ASN (), Reverse DNS a92-123-92-113.deploy.akamaitechnologies.com Software Apache / Resource Hash baafd74a4cb4dc594b614eeb45c7267bb1af729d9271752460348ece16532d04 Request headers Referer https://www.topbro.com/lightbox/style/css/none.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers date Mon, 29 Jan 2018 08:05:09 GMT last-modified Mon, 24 Oct 2016 20:49:51 GMT server Apache content-md5 5GY/BZWwL7HDlH/B8V64Eg== content-type image/jpeg status 200 cache-control public, max-age=69767691 accept-ranges bytes content-length 86226 expires Wed, 15 Apr 2020 20:00:00 GMT
GET S	200	nf-icon-v1-88.woff assets.nflxext.com/ffe/siteui/fonts/	69 KB 69 KB	25ms 7ms	Font application/octet-stream	92.123.92.113
General Check archive.org Show headers Download Go to Full URL https://assets.nflxext.com/ffe/siteui/fonts/nf-icon-v1-88.woff Requested by Host: www.gsams.biz URL: http://www.gsams.biz/e4f5e2f2c2/https:/www.netflix.com/account/ Protocol SPDY Server 92.123.92.113 , European Union, ASN (), Reverse DNS a92-123-92-113.deploy.akamaitechnologies.com Software Apache / Resource Hash ba892f7903e737d06c952be4ed3266746ed5e1090377fbc5d2ac975626c4533a Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Referer https://www.topbro.com/lightbox/style/css/none.css Origin http://www.gsams.biz Response headers date Mon, 29 Jan 2018 08:05:09 GMT content-encoding gzip last-modified Fri, 27 Jan 2017 22:53:52 GMT server Apache content-md5 ezBCotj2o1GiKPEVK1YDAg== status 200 vary Accept-Encoding content-type text/plain access-control-allow-origin * cache-control public, max-age=69767691 accept-ranges bytes expires Wed, 15 Apr 2020 20:00:00 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| netflix function| hasClass function| addClass function| removeClass function| mainFunc function| createFragment function| insertErrorMsg function| signUp

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.gsams.biz/	1969-12-31 23:59:59	Name: PHPSESSID Value: e94aaf2997ed1130f5fb0c027ccd47aa

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.nflxext.com
www.gsams.biz
www.topbro.com
185.38.44.163
192.185.28.103
92.123.92.113
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece
5e08dd7e9e469c5027f50a3875fa26512779e2b6a98dd3b77fa39abf410cf904
ba892f7903e737d06c952be4ed3266746ed5e1090377fbc5d2ac975626c4533a
baafd74a4cb4dc594b614eeb45c7267bb1af729d9271752460348ece16532d04
cbfe57949f2537ec2299454820d67da7f3794f14e2fec93fcd372a23ce155f9f
e801505cd25e8a04ff7946f43818a1ab2b4f259696d618fbf2bf92a462bd5226