ntflxseguranca.com
Open in
urlscan Pro
107.180.47.13
Malicious Activity!
Public Scan
URL:
http://ntflxseguranca.com/ajuda/71f28a816be3a812703efdaf4f0563dc/?session=6f093ad552d31134db4206b9452d2c60
Submission: On May 29 via automatic, source openphish
Submission: On May 29 via automatic, source openphish
Summary
This website contacted 3 IPs
in 2 countries
across 3 domains to perform 11 HTTP transactions.
The main IP is 107.180.47.13, located in
Scottsdale, United States and
belongs to AS-26496-GO-DADDY-COM-LLC, US.
The main domain is ntflxseguranca.com.
This is the only time ntflxseguranca.com was scanned on urlscan.io!
This is the only time ntflxseguranca.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Netflix (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 7 | 107.180.47.13 107.180.47.13 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC) | |
| 1 | 2a00:1450:400... 2a00:1450:4001:815::200a | 15169 (GOOGLE) (GOOGLE) | |
| 3 | 2a00:1450:400... 2a00:1450:4001:81b::2003 | 15169 (GOOGLE) (GOOGLE) | |
| 11 | 3 |
7
107.180.47.13
(Scottsdale, United States)
ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: ip-107-180-47-13.ip.secureserver.net
ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: ip-107-180-47-13.ip.secureserver.net
| ntflxseguranca.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 7 |
ntflxseguranca.com
ntflxseguranca.com |
366 KB |
| 3 |
gstatic.com
fonts.gstatic.com |
33 KB |
| 1 |
googleapis.com
fonts.googleapis.com |
941 B |
| 11 | 3 |
| Domain | Requested by | |
|---|---|---|
| 7 | ntflxseguranca.com |
ntflxseguranca.com
|
| 3 | fonts.gstatic.com |
ntflxseguranca.com
|
| 1 | fonts.googleapis.com |
ntflxseguranca.com
|
| 11 | 3 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| upload.video.google.com GTS CA 1O1 |
2020-05-05 - 2020-07-28 |
3 months | crt.sh |
| *.gstatic.com GTS CA 1O1 |
2020-05-05 - 2020-07-28 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://ntflxseguranca.com/ajuda/71f28a816be3a812703efdaf4f0563dc/?session=6f093ad552d31134db4206b9452d2c60
Frame ID: DA375664E4B6BF276A8A60158065C257
Requests: 11 HTTP requests in this frame
Screenshot
Detected technologies
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Google Font API
(Font Scripts)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
ntflxseguranca.com/ajuda/71f28a816be3a812703efdaf4f0563dc/ |
3 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
geral.css
ntflxseguranca.com/ajuda/estilos/ |
16 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.js
ntflxseguranca.com/ajuda/javascripts/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.mask.js
ntflxseguranca.com/ajuda/javascripts/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
geral.js
ntflxseguranca.com/ajuda/javascripts/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
css
fonts.googleapis.com/ |
12 KB 941 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logo.png
ntflxseguranca.com/ajuda/imagens/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
background_enter.jpg
ntflxseguranca.com/ajuda/imagens/ |
354 KB 355 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v20/ |
11 KB 11 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ |
11 KB 11 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ |
11 KB 11 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Netflix (Online)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
fonts.gstatic.com
ntflxseguranca.com
107.180.47.13
2a00:1450:4001:815::200a
2a00:1450:4001:81b::2003
0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
8ea5052280c3e6fe48e2cb25f3d96353ed9621d3528c0f23c32b47a6c8297aa1
914fb25975ddb496633e4b53df26233946f8332754ca01f10bbbfac082544d6d
aedb0e12d88580acdff4e05415de915b7291191cf35f5966fe7ce9aa34c1449c
ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e
d1e84d9fcc76d16198e1a0437d161a3b34c606cac4e088d7e3d7e68061ed2618
d2b7c412dd38edb67d6f12575a6b9fd7e232f18d77be0c34b835e1579776dac9