netflix-premium.live
Open in
urlscan Pro
2606:4700:3032::681c:1037
Malicious Activity!
Public Scan
Submission: On July 21 via api from ES
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on June 9th 2020. Valid for: a year.
This is the only time netflix-premium.live was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Netflix (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
9 | 2606:4700:303... 2606:4700:3032::681c:1037 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 143.204.202.77 143.204.202.77 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 23.111.9.35 23.111.9.35 | 33438 (HIGHWINDS2) (HIGHWINDS2) | |
1 | 2a00:1450:400... 2a00:1450:4001:825::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2001:4de0:ac1... 2001:4de0:ac19::1:b:3a | 20446 (HIGHWINDS3) (HIGHWINDS3) | |
3 | 2606:4700::68... 2606:4700::6810:85e5 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a04:4e42:3::621 2a04:4e42:3::621 | 54113 (FASTLY) (FASTLY) | |
1 | 2a00:1450:400... 2a00:1450:4001:80b::2008 | 15169 (GOOGLE) (GOOGLE) | |
1 | 3.225.87.211 3.225.87.211 | 14618 (AMAZON-AES) (AMAZON-AES) | |
1 | 2a00:1450:400... 2a00:1450:4001:81f::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:815::200e | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:817::2003 | 15169 (GOOGLE) (GOOGLE) | |
24 | 12 |
ASN16509 (AMAZON-02, US)
PTR: server-143-204-202-77.fra53.r.cloudfront.net
cdn.linearicons.com |
ASN15169 (GOOGLE, US)
www.googletagmanager.com |
ASN14618 (AMAZON-AES, US)
PTR: ec2-3-225-87-211.compute-1.amazonaws.com
www.locked2.com |
ASN15169 (GOOGLE, US)
www.google-analytics.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
netflix-premium.live
netflix-premium.live |
577 KB |
3 |
cloudflare.com
cdnjs.cloudflare.com |
15 KB |
2 |
gstatic.com
fonts.gstatic.com |
22 KB |
2 |
google-analytics.com
www.google-analytics.com |
18 KB |
2 |
googleapis.com
fonts.googleapis.com ajax.googleapis.com |
32 KB |
1 |
locked2.com
www.locked2.com |
2 KB |
1 |
googletagmanager.com
www.googletagmanager.com |
34 KB |
1 |
jsdelivr.net
cdn.jsdelivr.net |
2 KB |
1 |
bootstrapcdn.com
stackpath.bootstrapcdn.com |
24 KB |
1 |
fontawesome.com
use.fontawesome.com |
13 KB |
1 |
linearicons.com
cdn.linearicons.com |
2 KB |
24 | 11 |
Domain | Requested by | |
---|---|---|
9 | netflix-premium.live |
netflix-premium.live
cdnjs.cloudflare.com |
3 | cdnjs.cloudflare.com |
netflix-premium.live
|
2 | fonts.gstatic.com |
netflix-premium.live
|
2 | www.google-analytics.com |
www.googletagmanager.com
netflix-premium.live |
1 | ajax.googleapis.com |
netflix-premium.live
|
1 | www.locked2.com |
netflix-premium.live
|
1 | www.googletagmanager.com |
netflix-premium.live
|
1 | cdn.jsdelivr.net |
netflix-premium.live
|
1 | stackpath.bootstrapcdn.com |
netflix-premium.live
|
1 | fonts.googleapis.com |
netflix-premium.live
|
1 | use.fontawesome.com |
netflix-premium.live
|
1 | cdn.linearicons.com |
netflix-premium.live
|
24 | 12 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2020-06-09 - 2021-06-09 |
a year | crt.sh |
cdn.linearicons.com Amazon |
2020-03-20 - 2021-04-20 |
a year | crt.sh |
*.fontawesome.com DigiCert SHA2 Secure Server CA |
2019-10-28 - 2020-12-23 |
a year | crt.sh |
upload.video.google.com GTS CA 1O1 |
2020-06-30 - 2020-09-22 |
3 months | crt.sh |
*.bootstrapcdn.com Sectigo RSA Domain Validation Secure Server CA |
2019-09-14 - 2020-10-13 |
a year | crt.sh |
cloudflare.com Cloudflare Inc ECC CA-3 |
2020-07-04 - 2021-07-04 |
a year | crt.sh |
f3.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3 |
2020-07-08 - 2021-04-17 |
9 months | crt.sh |
*.google-analytics.com GTS CA 1O1 |
2020-06-30 - 2020-09-22 |
3 months | crt.sh |
*.locked2.com Let's Encrypt Authority X3 |
2020-07-03 - 2020-10-01 |
3 months | crt.sh |
*.gstatic.com GTS CA 1O1 |
2020-06-30 - 2020-09-22 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://netflix-premium.live/
Frame ID: 9CB2CD31F1903F98D3EEAC0648C2D8E1
Requests: 24 HTTP requests in this frame
Screenshot
Detected technologies
CloudFlare (CDN) ExpandDetected patterns
- headers server /^cloudflare$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
24 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
netflix-premium.live/ |
7 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon-font.min.css
cdn.linearicons.com/free/1.0.0/ |
7 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.css
use.fontawesome.com/releases/v5.5.0/css/ |
50 KB 13 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
10 KB 889 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/ |
157 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
animate.min.css
cdnjs.cloudflare.com/ajax/libs/animate.css/4.1.0/ |
70 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
magnific-popup.css
cdn.jsdelivr.net/npm/magnific-popup@1.1.0/dist/ |
7 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
netflix-premium.live/css/ |
12 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
85 KB 34 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
load.php
www.locked2.com/cl/ |
4 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
input-icon.png
netflix-premium.live/img/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ |
87 KB 31 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.magnific-popup.min.js
cdnjs.cloudflare.com/ajax/libs/magnific-popup.js/1.1.0/ |
20 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ion.sound.min.js
cdnjs.cloudflare.com/ajax/libs/ion-sound/3.0.7/js/ |
13 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.js
netflix-premium.live/js/ |
8 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
45 KB 18 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
collect
www.google-analytics.com/r/ |
35 B 98 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bg.jpg
netflix-premium.live/img/ |
338 KB 338 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ |
11 KB 11 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v20/ |
11 KB 11 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
button.mp3
netflix-premium.live/audio/ |
24 KB 24 KB |
XHR
audio/mpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
transition-1.mp3
netflix-premium.live/audio/ |
99 KB 100 KB |
XHR
audio/mpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fail.mp3
netflix-premium.live/audio/ |
51 KB 51 KB |
XHR
audio/mpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
transition-2.mp3
netflix-premium.live/audio/ |
54 KB 55 KB |
XHR
audio/mpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Netflix (Online)41 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| gtag object| dataLayer object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga object| gaplugins object| gaGlobal object| gaData string| referrer string| originator string| id string| querystring string| lockerurl undefined| iframecontents undefined| old_display function| optionstoquery function| og_load function| ogEditBody function| ogMakeLocker function| ogSetContents function| og_getScriptURL function| call_locker boolean| ogblock function| $ function| jQuery object| ion number| starting_number number| random function| online_count function| formatAMPM object| human_verification_timer string| $resource_1_name string| $console_message_1 string| $console_message_2 string| $console_message_3 string| $console_message_4 string| $console_message_5 string| $console_message_6 string| $console_message_7 number| $sound_setting4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.netflix-premium.live/ | Name: _gid Value: GA1.2.1450112102.1595303432 |
|
.netflix-premium.live/ | Name: _ga Value: GA1.2.1950388600.1595303432 |
|
.netflix-premium.live/ | Name: _gat_gtag_UA_164175933_10 Value: 1 |
|
.netflix-premium.live/ | Name: __cfduid Value: d0e173559265afc1d191433823412e64d1595303431 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
cdn.jsdelivr.net
cdn.linearicons.com
cdnjs.cloudflare.com
fonts.googleapis.com
fonts.gstatic.com
netflix-premium.live
stackpath.bootstrapcdn.com
use.fontawesome.com
www.google-analytics.com
www.googletagmanager.com
www.locked2.com
143.204.202.77
2001:4de0:ac19::1:b:3a
23.111.9.35
2606:4700:3032::681c:1037
2606:4700::6810:85e5
2a00:1450:4001:80b::2008
2a00:1450:4001:815::200e
2a00:1450:4001:817::2003
2a00:1450:4001:81f::200a
2a00:1450:4001:825::200a
2a04:4e42:3::621
3.225.87.211
0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e
1520e67c06c2b44c67aec9833b5f1c5324c2cc8842d82f7cc3509adc34c95a0a
1b4867b50dbf179d5057c04429594b95b9a1a591452b3c745950fe55a0aed6dc
31ca8fc4bb190118851959f282909af4a8f6e782b69dcfbe00094ffc010878b3
3fddc6d28aba3c13d64cfd4847c333ff48c71d4a5a58bd1a0494ca6ae8ac1bb4
42d8b0d8aa4bba881ed18ef0cd9a3d2aae1747afb633861d7a366086f04e13f2
45d1f5f6cf913746c45dd697b1a8f3b719c02d8b3f678dc7fc2766d54e1aaf6e
494f07065715db5ffd52e02a63933bc3996b5845faa8807cfb26f380903c8372
4b620417ce1339244b71d84252c1bf710d1b64726adb2e4516888516bc87cc94
50e00852cef99080437dde1792e4944ae845e7f5537b3a00987018b344511d56
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
60c9d285e1657f6216af97ec31e55a6e30d9d763b92cf82ad0cec336b2e2a9c5
680af6669abc319f9803f0fa26d443df1b6bc29133d88a8e4bea560ffed7288c
70a0b4c6121da65b94c3729b241027bd38717714eda5414205311a298c278d97
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
9e4cac65c7a5ee0bd0743afefcabdd3e73854e1284ac9ac433813d6231f550f2
a48c5061de1c428c8656e7d560e3a294eadfd54292f5ea8536c2a585cba0607e
c3c498e303ee40286452225eb78f91cddcac0248233cbd904274e25f5853679a
ccb2ee810f406e3dc33e9c674d1168c9929280f00934a7cefdf3489939ab009c
d0f113b63ab1f516eab8a8ca2e1371c74e1211509ed4f90635387cbe7da465ce
ea1a8732a5d354476cd51f0780a8ac2e6de5fdda27790b3ead2d5ae4d2e6c30a
ec3c94a704288dd4a7e77217124f503a5949f382f1ece139e04931709e0919ee
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fd361b57998c76f86335afa28b8a62527d88a8200fb5c428d6f0fff73383e955