urlscan.io logo urlscan.io
SecurityTrails logo

bysardinia.com Open in urlscan Pro
81.88.52.23  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://bysardinia.com/netflixhu/cn.php
Submission: On February 28 via manual from HU — Scanned from IT
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 10 HTTP transactions. The main IP is 81.88.52.23, located in Italy and belongs to REGISTER-AS, IT. The main domain is bysardinia.com.
TLS certificate: Issued by R3 on January 10th 2023. Valid for: 3 months.
This is the only time bysardinia.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

IP Address AS Autonomous System
6 81.88.52.23 39729 (REGISTER-AS)
2 2606:4700::68... 13335 (CLOUDFLAR...)
2 2606:4700::68... 13335 (CLOUDFLAR...)
10 3
Apex Domain
Subdomains		 Transfer
6 bysardinia.com
bysardinia.com
13 KB
2 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 195
166 KB
2 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 339
46 KB
10 3
Domain Requested by
6 bysardinia.com bysardinia.com
2 cdnjs.cloudflare.com bysardinia.com
cdnjs.cloudflare.com
2 cdn.jsdelivr.net bysardinia.com
10 3

This site contains no links.

Subject Issuer Validity Valid
www.bysardinia.com
R3		 2023-01-10 -
2023-04-10		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2022-06-02 -
2023-06-01		 a year crt.sh

This page contains 1 frames:

Primary Page: https://bysardinia.com/netflixhu/cn.php
Frame ID: CA4989E81AE3B6D12BD1976A654E392A
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Document

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
  • //cdn\.jsdelivr\.net/

Page Statistics

10
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

225 kB
Transfer

523 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request cn.php
bysardinia.com/netflixhu/ 		14 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://bysardinia.com/netflixhu/cn.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
81.88.52.23 , Italy, ASN39729 (REGISTER-AS, IT),
Reverse DNS
lhcp3023.webapps.net
Software
Apache / PHP/7.3.33
Resource Hash
31434a6327b7c9109bd0bb82c9232b08ad2a06a0a7a9734f73dd73cc03f632fd

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language
it-IT,it;q=0.9

Response headers

Connection
Keep-Alive
Content-Encoding
gzip
Content-Length
3970
Content-Type
text/html; charset=UTF-8
Date
Tue, 28 Feb 2023 12:09:15 GMT
Keep-Alive
timeout=5, max=150
Server
Apache
Vary
Accept-Encoding
X-Powered-By
PHP/7.3.33
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.2.3/dist/css/ 		190 KB
29 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/bootstrap@5.2.3/dist/css/bootstrap.min.css
Requested by
Host: bysardinia.com
URL: https://bysardinia.com/netflixhu/cn.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5614 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c0bcf7898fdc3b87babca678cd19a8e3ef570e931c80a3afbffcc453738c951a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://bysardinia.com/
Origin
https://bysardinia.com
accept-language
it-IT,it;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 28 Feb 2023 12:09:15 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
531317
x-jsd-version
5.2.3
content-encoding
br
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by
cache-fra-eddf8230122-FRA, cache-jnb7021-JNB
x-jsd-version-type
version
server
cloudflare
etag
W/"2f955-d5HdHzFzoNYsw5wh0q1x/I2tDnI"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=92Hf03z3uee4R7%2BiUcwWAmAXGM%2BgPG8Eo6vgbft5xWKdqyGbZdidyqp%2BFq7bnUuiP7yRqojrcI04gqyiKn7sW8FnpYMG9bb6HeXsc58WCxxj%2BrdoPcV6FaIeK4FEBE4%2BO%2FvUD49qw21deoxshuw%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin
*
cf-ray
7a090cdf183d59b9-MXP
c2.css
bysardinia.com/netflixhu/css/ 		4 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://bysardinia.com/netflixhu/css/c2.css
Requested by
Host: bysardinia.com
URL: https://bysardinia.com/netflixhu/cn.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
81.88.52.23 , Italy, ASN39729 (REGISTER-AS, IT),
Reverse DNS
lhcp3023.webapps.net
Software
Apache /
Resource Hash
91a5dfd7959b779db18696cbf327cba8b8fa1f42c380a31e6b72e35d72a87244

Request headers

accept-language
it-IT,it;q=0.9
Referer
https://bysardinia.com/netflixhu/cn.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date
Tue, 28 Feb 2023 12:09:15 GMT
Content-Encoding
gzip
Last-Modified
Thu, 12 Jan 2023 21:21:49 GMT
Server
Apache
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=10368000
Connection
keep-alive, Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=149
Content-Length
1108
Expires
max-age=A10368000, public
all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/6.2.1/css/ 		100 KB
19 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.2.1/css/all.min.css
Requested by
Host: bysardinia.com
URL: https://bysardinia.com/netflixhu/cn.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6752b9ba151a25703b2e5d17ad9ff42615f8940b591694fa8e42ab1034f476b5
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Referer
Origin
https://bysardinia.com
accept-language
it-IT,it;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 28 Feb 2023 12:09:15 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
7662181
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
18716
last-modified
Tue, 15 Nov 2022 18:04:22 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"6373d4a6-491c"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9kAeE9VbmJzmVhPKS5NOE%2Frb0JkVFNZq4YtJXlq5M2yAhnIH9ghnc7s68jQhorcFm77aI1DzRtiIVP2ejaOZLAgv%2FiFm6gZ0eP3BpThHxVzHuohbvliZmm8wZRhxFYSPPIyls%2BApHBzS5SlrrkVj5AV1"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
7a090cdf2e9359fb-MXP
expires
Sun, 18 Feb 2024 12:09:15 GMT
visa-v3.svg
bysardinia.com/netflixhu/img/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bysardinia.com/netflixhu/img/visa-v3.svg
Requested by
Host: bysardinia.com
URL: https://bysardinia.com/netflixhu/cn.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
81.88.52.23 , Italy, ASN39729 (REGISTER-AS, IT),
Reverse DNS
lhcp3023.webapps.net
Software
Apache /
Resource Hash
d8dc942bdf04e43d4edb17c9d421f9f3a70bd62d5ec2fb502deb91b9b95fc064

Request headers

accept-language
it-IT,it;q=0.9
Referer
https://bysardinia.com/netflixhu/cn.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date
Tue, 28 Feb 2023 12:09:15 GMT
Content-Encoding
gzip
Last-Modified
Thu, 12 Jan 2023 20:45:41 GMT
Server
Apache
Vary
Accept-Encoding
Content-Type
image/svg+xml
Cache-Control
max-age=10368000
Connection
keep-alive, Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=148
Content-Length
686
Expires
max-age=A10368000, public
mastercard-v2.svg
bysardinia.com/netflixhu/img/ 		3 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bysardinia.com/netflixhu/img/mastercard-v2.svg
Requested by
Host: bysardinia.com
URL: https://bysardinia.com/netflixhu/cn.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
81.88.52.23 , Italy, ASN39729 (REGISTER-AS, IT),
Reverse DNS
lhcp3023.webapps.net
Software
Apache /
Resource Hash
9a4620a32974adc5764f26a8070cd432aa32ba8be3167320fd32bcd9cdcaed08

Request headers

accept-language
it-IT,it;q=0.9
Referer
https://bysardinia.com/netflixhu/cn.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date
Tue, 28 Feb 2023 12:09:15 GMT
Content-Encoding
gzip
Last-Modified
Thu, 12 Jan 2023 20:45:41 GMT
Server
Apache
Vary
Accept-Encoding
Content-Type
image/svg+xml
Cache-Control
max-age=10368000
Connection
keep-alive, Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=147
Content-Length
1218
Expires
max-age=A10368000, public
amex-v2.svg
bysardinia.com/netflixhu/img/ 		3 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bysardinia.com/netflixhu/img/amex-v2.svg
Requested by
Host: bysardinia.com
URL: https://bysardinia.com/netflixhu/cn.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
81.88.52.23 , Italy, ASN39729 (REGISTER-AS, IT),
Reverse DNS
lhcp3023.webapps.net
Software
Apache /
Resource Hash
7601455c0af7c3e0d8e64a288249c254b8fc1b257350613a6cdd1e1aaca9a3e4

Request headers

accept-language
it-IT,it;q=0.9
Referer
https://bysardinia.com/netflixhu/cn.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date
Tue, 28 Feb 2023 12:09:15 GMT
Content-Encoding
gzip
Last-Modified
Thu, 12 Jan 2023 20:45:41 GMT
Server
Apache
Vary
Accept-Encoding
Content-Type
image/svg+xml
Cache-Control
max-age=10368000
Connection
keep-alive, Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=150
Content-Length
1267
Expires
max-age=A10368000, public
icon_discover_2x.png
bysardinia.com/netflixhu/img/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bysardinia.com/netflixhu/img/icon_discover_2x.png
Requested by
Host: bysardinia.com
URL: https://bysardinia.com/netflixhu/cn.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
81.88.52.23 , Italy, ASN39729 (REGISTER-AS, IT),
Reverse DNS
lhcp3023.webapps.net
Software
Apache /
Resource Hash
121ffba5babd9c3503fe4790fd656539558cc27e11d8f6d156328c07cac53976

Request headers

accept-language
it-IT,it;q=0.9
Referer
https://bysardinia.com/netflixhu/cn.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date
Tue, 28 Feb 2023 12:09:15 GMT
Last-Modified
Thu, 12 Jan 2023 20:39:43 GMT
Server
Apache
Content-Type
image/png
Cache-Control
max-age=10368000
Connection
keep-alive, Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=150
Content-Length
2570
Expires
max-age=A10368000, public
bootstrap.min.js
cdn.jsdelivr.net/npm/bootstrap@5.2.3/dist/js/ 		59 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/bootstrap@5.2.3/dist/js/bootstrap.min.js
Requested by
Host: bysardinia.com
URL: https://bysardinia.com/netflixhu/cn.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5614 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9bcd4d0f29dc6556ebeeff44eaa0965f0c7f7308ee58394708cce2f698cca1b0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://bysardinia.com/
Origin
https://bysardinia.com
accept-language
it-IT,it;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 28 Feb 2023 12:09:15 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
531329
x-jsd-version
5.2.3
content-encoding
br
x-cache
HIT, MISS
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by
cache-fra-eddf8230041-FRA, cache-jnb7025-JNB
x-jsd-version-type
version
server
cloudflare
etag
W/"ebf4-hH3/iZtbz47kNOOJ4qkQuh26128"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EKGisAcegqgfzV8VQ3x1facNKRvlyabxn9nAyKmuHEbRaOm22UW%2BmDFzmP9FnFtLkvCJVboOfVzpW9Ej33I%2FswDOLMldIdtTVhClS2W4fKeCRnw8f3dAATiPgF%2FAN8uqVmb4CiL0gdWejD9WAvo%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin
*
cf-ray
7a090cdf184059b9-MXP
fa-solid-900.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/6.2.1/webfonts/ 		147 KB
147 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.2.1/webfonts/fa-solid-900.woff2
Requested by
Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.2.1/css/all.min.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
08892835e828657736cc2fc56b6604a5a2517c0126b4d4df14fbba739969c170
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Referer
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.2.1/css/all.min.css
Origin
https://bysardinia.com
accept-language
it-IT,it;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Tue, 28 Feb 2023 12:09:15 GMT
strict-transport-security
max-age=15780000
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
288657
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
150516
last-modified
Tue, 15 Nov 2022 18:04:22 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"6373d4a6-24bf4"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QFuqmzKz3bX5JvT5ZIBhWgAq9rccHAG2LpFkP1yokO0jNEHC3Je5uMd3ulDH6zvZ2yG4FYmhvpa7sTDS%2FgNfJyUK%2BHW55leRd5rD5hRIcKDhjZmUMzLPmd%2FRlGZTv2HiC8tcRROx%2BH16FhxxK7JGydqZ"}],"group":"cf-nel","max_age":604800}
content-type
application/octet-stream; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
7a090cdf7f3159fb-MXP
expires
Sun, 18 Feb 2024 12:09:15 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| formatString function| isInputName function| isInputccnum function| isInputsec function| isInputexp function| validation number| uidEvent object| bootstrap

0 Cookies