www.thefinalinterview.org Open in urlscan Pro
2606:4700:3031::681b:94d8 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/0e1ea0f11e85965/login.php
Effective URL:
https://www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/0e1ea0f11e85965/login.php
Submission: On October 07 via api (October 7th 2020, 2:40:14 am UTC) from QA

Summary HTTP 12 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 12 HTTP transactions. The main IP is 2606:4700:3031::681b:94d8, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.thefinalinterview.org.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on August 3rd 2020. Valid for: a year.

This is the only time www.thefinalinterview.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

	IP Address		AS Autonomous System
1 13	2606:4700:303... 2606:4700:3031::681b:94d8		13335 (CLOUDFLAR...) (CLOUDFLARENET)
12	1

13 2606:4700:3031::681b:94d8 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

www.thefinalinterview.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	thefinalinterview.org 1 redirects www.thefinalinterview.org	552 KB
12	1

	Domain	Requested by
13	www.thefinalinterview.org	1 redirects www.thefinalinterview.org
12	1

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-08-03` - `2021-08-03`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/0e1ea0f11e85965/login.php
Frame ID: 641604D44BE7EB95D07FF7D20EED3284
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/0e1ea0f11e85965/login.php HTTP 301
https://www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/0e1ea0f11e85965/login.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<script[^>]* src=[^>]+fontawesome(?:\.js)?/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

12
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

551 kB
Transfer

1522 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/0e1ea0f11e85965/login.php HTTP 301
https://www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/0e1ea0f11e85965/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request login.php Show response www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/0e1ea0f11e85965/ Redirect Chain http://www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/0e1ea0f11e85965/login.php https://www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/0e1ea0f11e85965/login.php	3 KB 1 KB	654ms 638ms	Document text/html	2606:4700:3031::681b:94d8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/0e1ea0f11e85965/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::681b:94d8 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `8396a31c62a97abba05db0324bcbde12a7b039d7669f342dd3d7c8846955d3e5` Request headers :method GET :authority www.thefinalinterview.org :scheme https :path /wa-ad/wa/ES3ER8NX/0e1ea0f11e85965/login.php pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 date Wed, 07 Oct 2020 02:39:56 GMT content-type text/html; charset=UTF-8 set-cookie __cfduid=d87ef01037688ad09f91265a3cb4806f41602038395; expires=Fri, 06-Nov-20 02:39:55 GMT; path=/; domain=.thefinalinterview.org; HttpOnly; SameSite=Lax; Secure PHPSESSID=3b295ebacb5871167e519f8d403c1465; path=/ expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate pragma no-cache cf-cache-status DYNAMIC cf-request-id 05a28709ee0000c2b32b0da200000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602038396"}],"group":"cf-nel","max_age":604800} nel {"report_to":"cf-nel","max_age":604800} server cloudflare cf-ray 5de4412319f3c2b3-FRA content-encoding br Redirect headers Date Wed, 07 Oct 2020 02:39:55 GMT Transfer-Encoding chunked Connection keep-alive Cache-Control max-age=3600 Expires Wed, 07 Oct 2020 03:39:55 GMT Location https://www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/0e1ea0f11e85965/login.php cf-request-id 05a28709cf0000d6fddb139200000001 Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602038395"}],"group":"cf-nel","max_age":604800} NEL {"report_to":"cf-nel","max_age":604800} Vary Accept-Encoding Server cloudflare CF-RAY 5de44122e97ad6fd-FRA
GET H2	200	bootstrap.min.css www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/assets/css/	152 KB 20 KB	17ms 15ms	Stylesheet text/css	2606:4700:3031::681b:94d8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/assets/css/bootstrap.min.css Requested by Host: www.thefinalinterview.org URL: https://www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/0e1ea0f11e85965/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::681b:94d8 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36` Request headers Referer https://www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/0e1ea0f11e85965/login.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 07 Oct 2020 02:39:56 GMT content-encoding br cf-cache-status HIT last-modified Wed, 13 Feb 2019 12:01:40 GMT server cloudflare age 5170 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602038396"}],"group":"cf-nel","max_age":604800} content-type text/css status 200 cache-control max-age=14400 nel {"report_to":"cf-nel","max_age":604800} cf-ray 5de441271d8dc2b3-FRA cf-request-id 05a2870c720000c2b32b0ea200000001
GET H2	200	helpers.css www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/assets/css/	41 KB 3 KB	14ms 12ms	Stylesheet text/css	2606:4700:3031::681b:94d8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/assets/css/helpers.css Requested by Host: www.thefinalinterview.org URL: https://www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/0e1ea0f11e85965/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::681b:94d8 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `f839760d1621714efedeb3eb08b25e619812dcc33d77aceb0daf405ac727a765` Request headers Referer https://www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/0e1ea0f11e85965/login.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 07 Oct 2020 02:39:56 GMT content-encoding br cf-cache-status HIT last-modified Tue, 27 Nov 2018 04:16:08 GMT server cloudflare age 5170 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602038396"}],"group":"cf-nel","max_age":604800} content-type text/css status 200 cache-control max-age=14400 nel {"report_to":"cf-nel","max_age":604800} cf-ray 5de441271d8fc2b3-FRA cf-request-id 05a2870c720000c2b32b0eb200000001
GET H2	200	fonts.css www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/assets/css/	4 KB 544 B	12ms 10ms	Stylesheet text/css	2606:4700:3031::681b:94d8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/assets/css/fonts.css Requested by Host: www.thefinalinterview.org URL: https://www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/0e1ea0f11e85965/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::681b:94d8 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `213e1c07e15eea7f20b56e8dab08ce45429188b20c55cd91d45c84cdda5c0635` Request headers Referer https://www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/0e1ea0f11e85965/login.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 07 Oct 2020 02:39:56 GMT content-encoding br cf-cache-status HIT last-modified Mon, 04 Nov 2019 02:14:52 GMT server cloudflare age 5170 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602038396"}],"group":"cf-nel","max_age":604800} content-type text/css status 200 cache-control max-age=14400 nel {"report_to":"cf-nel","max_age":604800} cf-ray 5de441271d91c2b3-FRA cf-request-id 05a2870c720000c2b32b0ec200000001
GET H2	200	main.css www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/assets/css/	7 KB 2 KB	13ms 11ms	Stylesheet text/css	2606:4700:3031::681b:94d8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/assets/css/main.css Requested by Host: www.thefinalinterview.org URL: https://www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/0e1ea0f11e85965/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::681b:94d8 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `12b149321ee22338ec4eea71aa7cd7e26f6a6523bb4fabb41a1cdddc70cb6bbe` Request headers Referer https://www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/0e1ea0f11e85965/login.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 07 Oct 2020 02:39:56 GMT content-encoding br cf-cache-status HIT last-modified Wed, 18 Dec 2019 08:42:48 GMT server cloudflare age 5170 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602038396"}],"group":"cf-nel","max_age":604800} content-type text/css status 200 cache-control max-age=14400 nel {"report_to":"cf-nel","max_age":604800} cf-ray 5de441271d93c2b3-FRA cf-request-id 05a2870c730000c2b32b0ed200000001
GET H2	200	fbbb.png www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/assets/images/	1 KB 2 KB	13ms 12ms	Image image/png	2606:4700:3031::681b:94d8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/assets/images/fbbb.png Requested by Host: www.thefinalinterview.org URL: https://www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/0e1ea0f11e85965/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::681b:94d8 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece` Request headers Referer https://www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/0e1ea0f11e85965/login.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 07 Oct 2020 02:39:56 GMT cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 5170 status 200 content-length 1455 cf-request-id 05a2870c730000c2b32b0f3200000001 last-modified Sun, 10 Nov 2019 06:18:40 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602038396"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=14400 accept-ranges bytes cf-ray 5de441271d99c2b3-FRA
GET H2	200	jquery.min.js Show response www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/assets/js/	86 KB 30 KB	20ms 18ms	Script application/javascript	2606:4700:3031::681b:94d8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/assets/js/jquery.min.js Requested by Host: www.thefinalinterview.org URL: https://www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/0e1ea0f11e85965/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::681b:94d8 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `2b381363dda049f2d49a59037b228bc865d51ffb977c8f5c3547d5c28de48e3a` Request headers Referer https://www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/0e1ea0f11e85965/login.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 07 Oct 2020 02:39:56 GMT content-encoding br cf-cache-status HIT last-modified Thu, 12 Sep 2019 00:52:54 GMT server cloudflare age 5170 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602038396"}],"group":"cf-nel","max_age":604800} content-type application/javascript status 200 cache-control max-age=14400 nel {"report_to":"cf-nel","max_age":604800} cf-ray 5de441271d94c2b3-FRA cf-request-id 05a2870c730000c2b32b0ee200000001
GET H2	200	popper.min.js Show response www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/assets/js/	20 KB 7 KB	14ms 12ms	Script application/javascript	2606:4700:3031::681b:94d8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/assets/js/popper.min.js Requested by Host: www.thefinalinterview.org URL: https://www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/0e1ea0f11e85965/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::681b:94d8 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `315ac5479007d2e864a4b51f505fd0785ebbbe931a6b511467fa49504a082c58` Request headers Referer https://www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/0e1ea0f11e85965/login.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 07 Oct 2020 02:39:56 GMT content-encoding br cf-cache-status HIT last-modified Mon, 26 Nov 2018 00:02:46 GMT server cloudflare age 5170 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602038396"}],"group":"cf-nel","max_age":604800} content-type application/javascript status 200 cache-control max-age=14400 nel {"report_to":"cf-nel","max_age":604800} cf-ray 5de441271d95c2b3-FRA cf-request-id 05a2870c730000c2b32b0ef200000001
GET H2	200	bootstrap.min.js Show response www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/assets/js/	59 KB 15 KB	15ms 14ms	Script application/javascript	2606:4700:3031::681b:94d8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/assets/js/bootstrap.min.js Requested by Host: www.thefinalinterview.org URL: https://www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/0e1ea0f11e85965/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::681b:94d8 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `82d61b3c9de12f428310a8cecaab7470e03af0c32a834c5908a31f71ad5c844f` Request headers Referer https://www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/0e1ea0f11e85965/login.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 07 Oct 2020 02:39:56 GMT content-encoding br cf-cache-status HIT last-modified Mon, 16 Dec 2019 08:50:34 GMT server cloudflare age 5170 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602038396"}],"group":"cf-nel","max_age":604800} content-type application/javascript status 200 cache-control max-age=14400 nel {"report_to":"cf-nel","max_age":604800} cf-ray 5de441271d96c2b3-FRA cf-request-id 05a2870c730000c2b32b0f0200000001
GET H2	200	fontawesome.min.js Show response www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/assets/js/	1 MB 360 KB	54ms 52ms	Script application/javascript	2606:4700:3031::681b:94d8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/assets/js/fontawesome.min.js Requested by Host: www.thefinalinterview.org URL: https://www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/0e1ea0f11e85965/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::681b:94d8 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `21bd54c766f0a1385f24f0b9a074e83881d82288d9d31bab0e3076721121f52e` Request headers Referer https://www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/0e1ea0f11e85965/login.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 07 Oct 2020 02:39:56 GMT content-encoding br cf-cache-status HIT last-modified Mon, 26 Nov 2018 03:03:18 GMT server cloudflare age 5170 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602038396"}],"group":"cf-nel","max_age":604800} content-type application/javascript status 200 cache-control max-age=14400 nel {"report_to":"cf-nel","max_age":604800} cf-ray 5de441271d97c2b3-FRA cf-request-id 05a2870c730000c2b32b0f1200000001
GET H2	200	main.js Show response www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/assets/js/	2 KB 723 B	94ms 93ms	Script application/javascript	2606:4700:3031::681b:94d8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/assets/js/main.js Requested by Host: www.thefinalinterview.org URL: https://www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/0e1ea0f11e85965/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::681b:94d8 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `0200fa6affd967fa950e7449835152bf7340ef007326b6290f5e3926c5419fb4` Request headers Referer https://www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/0e1ea0f11e85965/login.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 07 Oct 2020 02:39:56 GMT content-encoding br cf-cache-status HIT last-modified Mon, 16 Dec 2019 08:56:58 GMT server cloudflare age 5170 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602038396"}],"group":"cf-nel","max_age":604800} content-type application/javascript status 200 cache-control max-age=14400 nel {"report_to":"cf-nel","max_age":604800} cf-ray 5de441271d98c2b3-FRA cf-request-id 05a2870c730000c2b32b0f2200000001
GET H2	200	img.jpg www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/assets/images/	111 KB 111 KB	12ms 12ms	Image image/jpeg	2606:4700:3031::681b:94d8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/assets/images/img.jpg Requested by Host: www.thefinalinterview.org URL: https://www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/assets/css/main.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::681b:94d8 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `9e38b47984313a8d5c00883986e98e5f4729fad0a40011d1563f314447a33000` Request headers Referer https://www.thefinalinterview.org/wa-ad/wa/ES3ER8NX/assets/css/main.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 07 Oct 2020 02:39:56 GMT cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 5169 status 200 cf-int-pingora-origin-digest {"ext_ip":"162.158.92.24","ext_port":64680,"upstream_rtt":129,"upstream_reused":false,"cipher":"ECDHE-RSA-AES256-GCM-SHA384","tls_version":"TLSv1.2","cert_digest":"fNz7PullBm+7HudqUaHzsdCX9XbOOLXoDzS35pqTAHs","http_version":1} content-length 113270 cf-request-id 05a2870c8c0000c2b32b0f4200000001 last-modified Sun, 10 Nov 2019 03:40:06 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602038396"}],"group":"cf-nel","max_age":604800} content-type image/jpeg cache-control max-age=14400 accept-ranges bytes cf-ray 5de441274dbfc2b3-FRA

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes function| $ function| jQuery function| Popper object| bootstrap object| ___FONT_AWESOME___ object| FontAwesomeConfig object| FontAwesome boolean| isShift string| seperator string| dash function| cc_date function| date_of_birth

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.thefinalinterview.org/	1969-12-31 23:59:59	Name: PHPSESSID Value: 3b295ebacb5871167e519f8d403c1465
			.thefinalinterview.org/	1970-01-19 13:43:50	Name: __cfduid Value: d87ef01037688ad09f91265a3cb4806f41602038395

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.thefinalinterview.org
2606:4700:3031::681b:94d8
0200fa6affd967fa950e7449835152bf7340ef007326b6290f5e3926c5419fb4
12b149321ee22338ec4eea71aa7cd7e26f6a6523bb4fabb41a1cdddc70cb6bbe
213e1c07e15eea7f20b56e8dab08ce45429188b20c55cd91d45c84cdda5c0635
21bd54c766f0a1385f24f0b9a074e83881d82288d9d31bab0e3076721121f52e
2b381363dda049f2d49a59037b228bc865d51ffb977c8f5c3547d5c28de48e3a
315ac5479007d2e864a4b51f505fd0785ebbbe931a6b511467fa49504a082c58
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece
60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36
82d61b3c9de12f428310a8cecaab7470e03af0c32a834c5908a31f71ad5c844f
8396a31c62a97abba05db0324bcbde12a7b039d7669f342dd3d7c8846955d3e5
9e38b47984313a8d5c00883986e98e5f4729fad0a40011d1563f314447a33000
f839760d1621714efedeb3eb08b25e619812dcc33d77aceb0daf405ac727a765