soipsychpersconca.cf
Open in
urlscan Pro
2606:4700:3035::681f:5dab
Malicious Activity!
Public Scan
Submission Tags: @jcybersec_
Submission: On July 20 via api from GB
Summary
This is the only time soipsychpersconca.cf was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Netflix (Online)Live information
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
11 | 2606:4700:303... 2606:4700:3035::681f:5dab | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2a00:86c0:209... 2a00:86c0:2091::1 | 40027 (NETFLIX-ASN) (NETFLIX-ASN) | |
3 3 | 2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3 | 32934 (FACEBOOK) (FACEBOOK) | |
3 | 2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de | 32934 (FACEBOOK) (FACEBOOK) | |
1 | 2a01:578:3::3... 2a01:578:3::3433:d00d | 16509 (AMAZON-02) (AMAZON-02) | |
17 | 4 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
soipsychpersconca.cf
soipsychpersconca.cf |
363 KB |
6 |
facebook.com
3 redirects
staticxx.facebook.com www.facebook.com |
739 B |
2 |
nflxext.com
assets.nflxext.com |
157 KB |
1 |
netflix.com
www.netflix.com |
1 KB |
17 | 4 |
Domain | Requested by | |
---|---|---|
11 | soipsychpersconca.cf |
soipsychpersconca.cf
|
3 | www.facebook.com |
soipsychpersconca.cf
|
3 | staticxx.facebook.com | 3 redirects |
2 | assets.nflxext.com |
soipsychpersconca.cf
|
1 | www.netflix.com |
soipsychpersconca.cf
|
17 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.netflix.com |
help.netflix.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.1.nflxso.net DigiCert SHA2 Secure Server CA |
2020-07-02 - 2020-08-04 |
a month | crt.sh |
*.facebook.com DigiCert SHA2 High Assurance Server CA |
2020-05-14 - 2020-08-05 |
3 months | crt.sh |
www.netflix.com DigiCert SHA2 Secure Server CA |
2020-01-13 - 2022-01-13 |
2 years | crt.sh |
This page contains 5 frames:
Primary Page:
http://soipsychpersconca.cf/WldyNXVVS3g=/index.php
Frame ID: 0106C3368F2F939BE0FF98875C333219
Requests: 13 HTTP requests in this frame
Frame:
http://soipsychpersconca.cf/WldyNXVVS3g=/Netflix_files/xaOI6zd9HW9.html
Frame ID: 750D0A32B3D3C1F9B6990DB855D0B3DA
Requests: 1 HTTP requests in this frame
Frame:
https://www.facebook.com/connect/xd_arbiter/r/xaOI6zd9HW9.js?version=42
Frame ID: C11A70E48FE454CCF5C2AE229D89F197
Requests: 1 HTTP requests in this frame
Frame:
https://www.facebook.com/connect/xd_arbiter/r/xaOI6zd9HW9.js?version=42
Frame ID: DB79DB0CC302EC686F6208C99395F4FA
Requests: 1 HTTP requests in this frame
Frame:
https://www.facebook.com/connect/ping?client_id=163114453728333&domain=soipsychpersconca.cf&origin=1&redirect_uri=http%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter%2Fr%2FxaOI6zd9HW9.js%3Fversion%3D42%23cb%3Df485bca4cae568%26domain%3Dsoipsychpersconca.cf%26origin%3Dhttp%253A%252F%252Fsoipsychpersconca.cf%252Ff39d4cb59e8b50c%26relation%3Dparent&response_type=token%2Csigned_request%2Ccode&sdk=joey&version=v2.9
Frame ID: C00A4C816726CA462B4C32FFD07853C2
Requests: 1 HTTP requests in this frame
Screenshot
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- url /\.php(?:$|\?)/i
CloudFlare (CDN) Expand
Detected patterns
- headers server /^cloudflare$/i
Page Statistics
5 Outgoing links
These are links going to different origins than the main page.
Title: Netflix
Search URL Search Domain Scan URL
Title: Forgot your email or password?
Search URL Search Domain Scan URL
Title: Gift Card Terms
Search URL Search Domain Scan URL
Title: Terms of Use
Search URL Search Domain Scan URL
Title: Privacy Statement
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 11- http://staticxx.facebook.com/connect/xd_arbiter/r/xaOI6zd9HW9.js?version=42 HTTP 302
- https://staticxx.facebook.com/connect/xd_arbiter/r/xaOI6zd9HW9.js?version=42 HTTP 302
- https://www.facebook.com/connect/xd_arbiter/r/xaOI6zd9HW9.js?version=42
- https://staticxx.facebook.com/connect/xd_arbiter/r/xaOI6zd9HW9.js?version=42 HTTP 302
- https://www.facebook.com/connect/xd_arbiter/r/xaOI6zd9HW9.js?version=42
17 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
Cookie set
index.php
soipsychpersconca.cf/WldyNXVVS3g=/ |
240 KB 67 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
none.js
soipsychpersconca.cf/WldyNXVVS3g=/Netflix_files/ |
24 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
none_002.js
soipsychpersconca.cf/WldyNXVVS3g=/Netflix_files/ |
655 KB 191 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
WebsiteDetect.asc
soipsychpersconca.cf/WldyNXVVS3g=/Netflix_files/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sdk.js
soipsychpersconca.cf/WldyNXVVS3g=/Netflix_files/ |
213 KB 64 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
none.css
soipsychpersconca.cf/WldyNXVVS3g=/Netflix_files/ |
101 KB 17 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
FB-f-Logo__blue_57.png
soipsychpersconca.cf/WldyNXVVS3g=/Netflix_files/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
WebsiteDetect
soipsychpersconca.cf/ichnaea/cl2/freeform/ |
282 B 726 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
WebsiteScreen
soipsychpersconca.cf/ichnaea/cl2/freeform/ |
282 B 726 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login-the-crown_2-1500x1000.jpg
assets.nflxext.com/ffe/siteui/acquisition/login/ |
84 KB 85 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
nf-icon-v1-93.woff
assets.nflxext.com/ffe/siteui/fonts/ |
72 KB 72 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Cookie set
xaOI6zd9HW9.html
soipsychpersconca.cf/WldyNXVVS3g=/Netflix_files/ Frame 750D |
42 KB 14 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
xaOI6zd9HW9.js
www.facebook.com/connect/xd_arbiter/r/ Frame C11A Redirect Chain
|
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
xaOI6zd9HW9.js
www.facebook.com/connect/xd_arbiter/r/ Frame DB79 Redirect Chain
|
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ping
www.facebook.com/connect/ Frame C00A |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
log
soipsychpersconca.cf/ichnaea/ |
282 B 726 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
cl2
www.netflix.com/ichnaea/ |
0 1 KB |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Netflix (Online)11 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| FB object| netflix object| Codex object| C object| global object| process object| __core-js_shared__ object| util function| jQuery object| jQuery111105374031688691447 function| fbAsyncInit1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.soipsychpersconca.cf/ | Name: __cfduid Value: d398a5eedd59c5efb4a6cd1f104d357ef1595209807 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
assets.nflxext.com
soipsychpersconca.cf
staticxx.facebook.com
www.facebook.com
www.netflix.com
2606:4700:3035::681f:5dab
2a00:86c0:2091::1
2a01:578:3::3433:d00d
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
029bd18cc547f1e733302ff47b60b38c0c6d461c883c5fef546b3596602dfdef
36d6338e657cdef8022ef6782c4a709216a661166abaf141cd55e9286d774fda
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece
601553a598f6c89f43b5f373d84fdf182db3af0acd6df215f9e4f62ee6c4dcb6
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d
abfe0e1b195380596a8d28abb2d472cc1cc670ac7f8a9582ca45bf3fb1b0950f
baafd74a4cb4dc594b614eeb45c7267bb1af729d9271752460348ece16532d04
d69b388d3d3c136484970f6ee5e1ebb2dfe51fbd4af2ea731d8de40cfce3816e
d9013ca6d10e27a1c53881852fd9bc126a0f92eb0392f7138acae4bf8947e2f3
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fcd7a4fca77e29944f03fe97482f3da077c7f16ff4778b365c442221714a7141