www.www-netflix-ramazan-com.tk
Open in
urlscan Pro
35.204.221.123
Malicious Activity!
Public Scan
Effective URL: https://www.www-netflix-ramazan-com.tk/home.html
Submission: On May 06 via automatic, source certstream-suspicious
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on May 6th 2019. Valid for: 3 months.
This is the only time www.www-netflix-ramazan-com.tk was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Netflix (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
9 | 35.204.221.123 35.204.221.123 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
6 | 2a02:26f0:6c0... 2a02:26f0:6c00:286::33c4 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
6 | 2a02:26f0:6c0... 2a02:26f0:6c00:297::33c4 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 | 2a00:1450:400... 2a00:1450:4001:824::2008 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
2 | 2a00:1450:400... 2a00:1450:4001:81f::200e | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 2a01:578:3::3... 2a01:578:3::369a:c92b | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
1 | 2a01:578:3::3... 2a01:578:3::36ab:bb3c | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
26 | 7 |
ASN15169 (GOOGLE - Google LLC, US)
PTR: 123.221.204.35.bc.googleusercontent.com
www.www-netflix-ramazan-com.tk |
ASN20940 (AKAMAI-ASN1, US)
codex.nflxext.com | |
assets.nflxext.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
nflxext.com
codex.nflxext.com assets.nflxext.com |
1 MB |
9 |
www-netflix-ramazan-com.tk
www.www-netflix-ramazan-com.tk |
89 KB |
2 |
netflix.com
www.netflix.com |
1 KB |
2 |
google-analytics.com
www.google-analytics.com |
18 KB |
1 |
googletagmanager.com
www.googletagmanager.com |
24 KB |
26 | 5 |
Domain | Requested by | |
---|---|---|
9 | www.www-netflix-ramazan-com.tk |
www.www-netflix-ramazan-com.tk
codex.nflxext.com |
7 | assets.nflxext.com |
www.www-netflix-ramazan-com.tk
|
5 | codex.nflxext.com |
www.www-netflix-ramazan-com.tk
|
2 | www.netflix.com |
codex.nflxext.com
|
2 | www.google-analytics.com |
www.googletagmanager.com
www.www-netflix-ramazan-com.tk |
1 | www.googletagmanager.com |
www.www-netflix-ramazan-com.tk
|
26 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
help.netflix.com |
media.netflix.com |
ir.netflix.com |
jobs.netflix.com |
fast.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
www-netflix-ramazan-com.tk Let's Encrypt Authority X3 |
2019-05-06 - 2019-08-04 |
3 months | crt.sh |
assets.nflxext.com DigiCert SHA2 Secure Server CA |
2018-03-09 - 2020-03-09 |
2 years | crt.sh |
*.google-analytics.com Google Internet Authority G3 |
2019-04-16 - 2019-07-09 |
3 months | crt.sh |
www.netflix.com DigiCert SHA2 Secure Server CA |
2018-02-07 - 2020-02-07 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.www-netflix-ramazan-com.tk/home.html
Frame ID: 81C1654429856AB6E6345CB016480CC5
Requests: 26 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- https://www.www-netflix-ramazan-com.tk/ Page URL
- https://www.www-netflix-ramazan-com.tk/home.html Page URL
Detected technologies
Nginx (Web Servers) ExpandDetected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Google Analytics (Analytics) Expand
Detected patterns
- script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
- env /^gaGlobal$/i
Google Tag Manager (Tag Managers) Expand
Detected patterns
- env /^google_tag_manager$/i
Page Statistics
11 Outgoing links
These are links going to different origins than the main page.
Title: SSS
Search URL Search Domain Scan URL
Title: Yardım Merkezi
Search URL Search Domain Scan URL
Title: Medya Merkezi
Search URL Search Domain Scan URL
Title: Yatırımcı İlişkileri
Search URL Search Domain Scan URL
Title: İş İmkanları
Search URL Search Domain Scan URL
Title: Privacy
Search URL Search Domain Scan URL
Title: Cookie Preferences
Search URL Search Domain Scan URL
Title: Corporate Information
Search URL Search Domain Scan URL
Title: Contact Us
Search URL Search Domain Scan URL
Title: Speed Test
Search URL Search Domain Scan URL
Title: Legal Notices
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://www.www-netflix-ramazan-com.tk/ Page URL
- https://www.www-netflix-ramazan-com.tk/home.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
26 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
www.www-netflix-ramazan-com.tk/ |
54 B 223 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
home.html
www.www-netflix-ramazan-com.tk/ |
83 KB 84 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
none
codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-nmhp-js-mk-vcc258fbf/js/js/bootstrap.js,common%7Cbootstrap.js/1/6247/bck/true/ |
8 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
none
codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-nmhp-js-mk-vcc258fbf/js/js/signup%7Chome%7Clite%7Cclient.js/1/6247/l/true/ |
50 KB 16 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
WebsiteDetect
www.www-netflix-ramazan-com.tk/ichnaea/cl2/freeform/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
none
codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-shakti-css-vcc258fbf/css/css/less%7Cpages%7Chome%7Cconcord.less/2/0M0B0P040J090I0U0X0Q0K0V0O0W0-/none/true/ |
118 KB 18 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
%3Cdiv%20class=
www.www-netflix-ramazan-com.tk/ |
808 B 808 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
TR-tr-20181217-popsignuptwoweeks-perspective_alpha_website_large.jpg
assets.nflxext.com/ffe/siteui/vlv3/e53708fd-6532-4b37-ab01-f4eb722d48e0/add14170-3c70-4de8-a74a-9c756dd81996/ |
320 KB 321 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
asset_cancelanytime_withdevice.png
assets.nflxext.com/ffe/siteui/acquisition/home/thisIsNetflix/modules/ |
169 KB 170 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
asset_TV_UI.png
assets.nflxext.com/ffe/siteui/acquisition/home/thisIsNetflix/modules/ |
242 KB 243 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
asset_mobile_tablet_UI_2.png
assets.nflxext.com/ffe/siteui/acquisition/home/thisIsNetflix/modules/ |
119 KB 120 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
asset_website_UI.png
assets.nflxext.com/ffe/siteui/acquisition/home/thisIsNetflix/modules/ |
170 KB 171 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
63 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
WebsiteDetect
www.www-netflix-ramazan-com.tk/ichnaea/cl2/freeform/ |
808 B 943 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
WebsiteScreen
www.www-netflix-ramazan-com.tk/ichnaea/cl2/freeform/ |
808 B 943 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
chevron-right-whitespace.png
assets.nflxext.com/ffe/siteui/acquisition/home/ |
216 B 404 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
nf-icon-v1-93.woff
assets.nflxext.com/ffe/siteui/fonts/ |
72 KB 72 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
none
codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-shakti-js-mk-vcc258fbf/js/js/signup%7Csimplicity%7CsimpleSignupClient.js/2/4Y044t4r4c4v09484z4X070t014Z4y4l4B4w0e4P4N4L4h4A4p4D4j4i18034T/l/true/ |
1 MB 331 KB |
XHR
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
none
codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-shakti-css-vcc258fbf/css/css/less%7Cpages%7Csignup%7Csimplicity%7Csimplicity.less/2/0M0B0P040J090I0U0X0Q0K0V0O0W0-/none/true/ |
181 KB 30 KB |
XHR
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
43 KB 17 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
collect
www.google-analytics.com/r/ |
35 B 200 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
DebugEvent
www.www-netflix-ramazan-com.tk/ichnaea/cl2/freeform/ |
808 B 808 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
DebugEvent
www.www-netflix-ramazan-com.tk/ichnaea/cl2/freeform/ |
808 B 808 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
WebsiteTTI
www.www-netflix-ramazan-com.tk/ichnaea/cl2/freeform/ |
808 B 943 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H/1.1 |
cl2
www.netflix.com/ichnaea/ |
0 0 |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
cl2
www.netflix.com/ichnaea/ |
0 1 KB |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Netflix (Online)18 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask object| netflix object| Codex object| C object| global object| process object| __core-js_shared__ function| gtag object| dataLayer object| google_tag_manager string| GoogleAnalyticsObject function| ga object| google_tag_data object| gaplugins object| gaGlobal object| gaData3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.www-netflix-ramazan-com.tk/ | Name: _gat_gtag_UA_124578797_1 Value: 1 |
|
.www-netflix-ramazan-com.tk/ | Name: _gid Value: GA1.2.253652359.1557132297 |
|
.www-netflix-ramazan-com.tk/ | Name: _ga Value: GA1.2.277021270.1557132297 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
assets.nflxext.com
codex.nflxext.com
www.google-analytics.com
www.googletagmanager.com
www.netflix.com
www.www-netflix-ramazan-com.tk
2a00:1450:4001:81f::200e
2a00:1450:4001:824::2008
2a01:578:3::369a:c92b
2a01:578:3::36ab:bb3c
2a02:26f0:6c00:286::33c4
2a02:26f0:6c00:297::33c4
35.204.221.123
0adcd95cf8a8f3232795836e0dbde8e0e7b0dcee2971c376ab7b319c5dadf582
103646e75938c72c1e14b79899b6a6ae8050f255a35fefadae283e55b2b48127
3e552578c7d450b023f2cd9d28f830be4335c3acc6c4ab6dadda0769f09e5f22
55bc0f00df3c8622dc3ea9146aadf47791ea0730f1a98f452f4843366bc894b9
5a9079fa63154b87971c2eb2a202672a40d2d0192f6ba852f01d08addf1ee0f4
69777a3550f263f66dc14ee79be954266903f23d1f964403466032e2685d5d19
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8971fb91af5d973717554bbf6bfb4dfe5bf5c85b1cc9e4eb083a59a1cebfe308
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d
b78b3875bc9277985c6586569c4591a91aabc27af305d06b9d419e2748d384e9
b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187
b9d7e6505b46bf3772d0ad898a205ccb3a0db87ab036a5cf1771f6703e8075b5
b9ecde78710ff948ee864ea2f346d0ed3f7822814533feee546deb590ad12048
be0c75126a4bb40dd631660d823a978ded2b8103e2119c3020707300a9b969e8
d0a1d3ab0e60382d7cd4c92eea1d6381b9b71b5c403a95877d67fff18ac6779d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f051d66387452b3573c64dfd6185e99f2901b2634aa62ceccba81cb16495ad3f
f91f9b912721d13e879269b58530a681c52ad1c33efc31903e61bf1e94f14ff1
fcb40d090bcfa2ef6b71c945cc84cb6c339b8b5b053df9e7d759961257dd9b8d