billing.account.confirm.netflx.login.netflix-watch.com Open in urlscan Pro
139.99.100.63 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://billing.account.confirm.netflx.login.netflix-watch.com/Files/Login.php
Submission: On March 04 via automatic, source phishtank (March 4th 2018, 3:31:37 pm UTC)

Summary HTTP 11 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 11 HTTP transactions. The main IP is 139.99.100.63, located in Singapore, Singapore and belongs to OVH, FR. The main domain is billing.account.confirm.netflx.login.netflix-watch.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on March 4th 2018. Valid for: 3 months.

This is the only time billing.account.confirm.netflx.login.netflix-watch.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

	IP Address		AS Autonomous System
11	139.99.100.63 139.99.100.63		16276 (OVH) (OVH)
11	1

11 139.99.100.63 (Singapore, Singapore)

ASN16276 (OVH, FR)
PTR: 63.ip-139-99-100.eu

billing.account.confirm.netflx.login.netflix-watch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	netflix-watch.com billing.account.confirm.netflx.login.netflix-watch.com	637 KB
11	1

	Domain	Requested by
11	billing.account.confirm.netflx.login.netflix-watch.com	billing.account.confirm.netflx.login.netflix-watch.com
11	1

This site contains no links.

Subject Issuer	Validity	Valid
billing.account.confirm.netflx.login.netflix-watch.com Let's Encrypt Authority X3	`2018-03-04` - `2018-06-02`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://billing.account.confirm.netflx.login.netflix-watch.com/Files/Login.php
Frame ID: (ACDB9A94470B5C46C09C0C3B8C447AF)
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

UNIX (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Unix/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Hammer.js (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

env /^Hammer$/i

Modernizr (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

env /^Modernizr$/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

env /^jQuery$/i

Page Statistics

11
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

637 kB
Transfer

634 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Login.php Show response billing.account.confirm.netflx.login.netflix-watch.com/Files/	5 KB 6 KB	790ms 213ms	Document text/html	139.99.100.63 OVH
General Check archive.org Show headers Download Go to Full URL https://billing.account.confirm.netflx.login.netflix-watch.com/Files/Login.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 139.99.100.63 Singapore, Singapore, ASN16276 (OVH, FR), Reverse DNS 63.ip-139-99-100.eu Software Apache/2.4.29 (Unix) OpenSSL/1.0.1e-fips / PHP/5.6.30 Resource Hash `1d334f7430d2a0411812112de841d40dc662c6c79ff4a4d61020379e0cf91b01` Request headers Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Connection keep-alive Accept-Encoding gzip, deflate Host billing.account.confirm.netflx.login.netflix-watch.com Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sun, 04 Mar 2018 15:31:25 GMT Server Apache/2.4.29 (Unix) OpenSSL/1.0.1e-fips Connection Keep-Alive X-Powered-By PHP/5.6.30 Transfer-Encoding chunked Keep-Alive timeout=5, max=100 Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	css1.css billing.account.confirm.netflx.login.netflix-watch.com/Files/Style/	35 KB 36 KB	193ms 191ms	Stylesheet text/css	139.99.100.63 OVH
General Check archive.org Show headers Download Go to Full URL https://billing.account.confirm.netflx.login.netflix-watch.com/Files/Style/css1.css Requested by Host: billing.account.confirm.netflx.login.netflix-watch.com URL: https://billing.account.confirm.netflx.login.netflix-watch.com/Files/Login.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 139.99.100.63 Singapore, Singapore, ASN16276 (OVH, FR), Reverse DNS 63.ip-139-99-100.eu Software Apache/2.4.29 (Unix) OpenSSL/1.0.1e-fips / Resource Hash `89ff8c8b376e5733e05dfe32a6c6c834f2a04b93b0165cee16d2032a47b15b9c` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host billing.account.confirm.netflx.login.netflix-watch.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept text/css,/;q=0.1 Referer https://billing.account.confirm.netflx.login.netflix-watch.com/Files/Login.php Connection keep-alive Cache-Control no-cache Referer https://billing.account.confirm.netflx.login.netflix-watch.com/Files/Login.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sun, 04 Mar 2018 15:31:25 GMT Last-Modified Sun, 04 Mar 2018 03:48:22 GMT Server Apache/2.4.29 (Unix) OpenSSL/1.0.1e-fips ETag "8d76-5668e14b28a34" Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 36214
GET H/1.1	200 OK	css2.css billing.account.confirm.netflx.login.netflix-watch.com/Files/Style/	43 B 343 B	574ms 191ms	Stylesheet text/css	139.99.100.63 OVH
General Check archive.org Show headers Download Go to Full URL https://billing.account.confirm.netflx.login.netflix-watch.com/Files/Style/css2.css Requested by Host: billing.account.confirm.netflx.login.netflix-watch.com URL: https://billing.account.confirm.netflx.login.netflix-watch.com/Files/Login.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 139.99.100.63 Singapore, Singapore, ASN16276 (OVH, FR), Reverse DNS 63.ip-139-99-100.eu Software Apache/2.4.29 (Unix) OpenSSL/1.0.1e-fips / Resource Hash `9665c87b7234ca799f8f388d0d691b3587327e68bac389e265abd54cd784bfdd` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host billing.account.confirm.netflx.login.netflix-watch.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept text/css,/;q=0.1 Referer https://billing.account.confirm.netflx.login.netflix-watch.com/Files/Login.php Connection keep-alive Cache-Control no-cache Referer https://billing.account.confirm.netflx.login.netflix-watch.com/Files/Login.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sun, 04 Mar 2018 15:31:25 GMT Last-Modified Sun, 04 Mar 2018 03:48:22 GMT Server Apache/2.4.29 (Unix) OpenSSL/1.0.1e-fips ETag "2b-5668e14b2b52c" Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 43
GET H/1.1	200 OK	css3.css billing.account.confirm.netflx.login.netflix-watch.com/Files/Style/	10 KB 11 KB	575ms 190ms	Stylesheet text/css	139.99.100.63 OVH
General Check archive.org Show headers Download Go to Full URL https://billing.account.confirm.netflx.login.netflix-watch.com/Files/Style/css3.css Requested by Host: billing.account.confirm.netflx.login.netflix-watch.com URL: https://billing.account.confirm.netflx.login.netflix-watch.com/Files/Login.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 139.99.100.63 Singapore, Singapore, ASN16276 (OVH, FR), Reverse DNS 63.ip-139-99-100.eu Software Apache/2.4.29 (Unix) OpenSSL/1.0.1e-fips / Resource Hash `d7d01e005fc69e932089df3497391f2c5ebef0d9e944038e5b81e0812a15e4c6` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host billing.account.confirm.netflx.login.netflix-watch.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept text/css,/;q=0.1 Referer https://billing.account.confirm.netflx.login.netflix-watch.com/Files/Login.php Connection keep-alive Cache-Control no-cache Referer https://billing.account.confirm.netflx.login.netflix-watch.com/Files/Login.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sun, 04 Mar 2018 15:31:25 GMT Last-Modified Sun, 04 Mar 2018 03:48:23 GMT Server Apache/2.4.29 (Unix) OpenSSL/1.0.1e-fips ETag "29ea-5668e14c143c3" Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 10730
GET H/1.1	200 OK	question_mark.png billing.account.confirm.netflx.login.netflix-watch.com/Files/Images/	564 B 867 B	573ms 191ms	Image image/png	139.99.100.63 OVH
General Check archive.org Show headers Download Go to Show image Full URL https://billing.account.confirm.netflx.login.netflix-watch.com/Files/Images/question_mark.png Requested by Host: billing.account.confirm.netflx.login.netflix-watch.com URL: https://billing.account.confirm.netflx.login.netflix-watch.com/Files/Login.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 139.99.100.63 Singapore, Singapore, ASN16276 (OVH, FR), Reverse DNS 63.ip-139-99-100.eu Software Apache/2.4.29 (Unix) OpenSSL/1.0.1e-fips / Resource Hash `973576ba6483c6c75d1d55339c1cac5d742abef700ede0903341ab222a2ee7c2` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host billing.account.confirm.netflx.login.netflix-watch.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* https://billing.account.confirm.netflx.login.netflix-watch.com/Files/Login.php Connection keep-alive Cache-Control no-cache Referer https://billing.account.confirm.netflx.login.netflix-watch.com/Files/Login.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sun, 04 Mar 2018 15:31:26 GMT Last-Modified Sun, 04 Mar 2018 03:48:00 GMT Server Apache/2.4.29 (Unix) OpenSSL/1.0.1e-fips ETag "234-5668e13688157" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 564
GET H/1.1	200 OK	icon_lock_12x15_yellow.png billing.account.confirm.netflx.login.netflix-watch.com/Files/Images/	1 KB 1 KB	574ms 191ms	Image image/png	139.99.100.63 OVH
General Check archive.org Show headers Download Go to Show image Full URL https://billing.account.confirm.netflx.login.netflix-watch.com/Files/Images/icon_lock_12x15_yellow.png Requested by Host: billing.account.confirm.netflx.login.netflix-watch.com URL: https://billing.account.confirm.netflx.login.netflix-watch.com/Files/Login.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 139.99.100.63 Singapore, Singapore, ASN16276 (OVH, FR), Reverse DNS 63.ip-139-99-100.eu Software Apache/2.4.29 (Unix) OpenSSL/1.0.1e-fips / Resource Hash `c31e5ae9166763db7211b4719f4b8cbe34e7b15c0c4fa510e9f60510d94fb1ce` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host billing.account.confirm.netflx.login.netflix-watch.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* https://billing.account.confirm.netflx.login.netflix-watch.com/Files/Login.php Connection keep-alive Cache-Control no-cache Referer https://billing.account.confirm.netflx.login.netflix-watch.com/Files/Login.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sun, 04 Mar 2018 15:31:26 GMT Last-Modified Sun, 04 Mar 2018 03:47:49 GMT Server Apache/2.4.29 (Unix) OpenSSL/1.0.1e-fips ETag "46d-5668e12c7014e" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 1133
GET H/1.1	200 OK	js1.js Show response billing.account.confirm.netflx.login.netflix-watch.com/Files/Style/	368 KB 369 KB	191ms 191ms	Script application/javascript	139.99.100.63 OVH
General Check archive.org Show headers Download Go to Full URL https://billing.account.confirm.netflx.login.netflix-watch.com/Files/Style/js1.js Requested by Host: billing.account.confirm.netflx.login.netflix-watch.com URL: https://billing.account.confirm.netflx.login.netflix-watch.com/Files/Login.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 139.99.100.63 Singapore, Singapore, ASN16276 (OVH, FR), Reverse DNS 63.ip-139-99-100.eu Software Apache/2.4.29 (Unix) OpenSSL/1.0.1e-fips / Resource Hash `3c6174161d4269e3ebc614a3f2359ce16cc200b49aca1d218d14c185b6d4079b` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host billing.account.confirm.netflx.login.netflix-watch.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept / Referer https://billing.account.confirm.netflx.login.netflix-watch.com/Files/Login.php Connection keep-alive Cache-Control no-cache Referer https://billing.account.confirm.netflx.login.netflix-watch.com/Files/Login.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sun, 04 Mar 2018 15:31:25 GMT Last-Modified Sun, 04 Mar 2018 03:48:25 GMT Server Apache/2.4.29 (Unix) OpenSSL/1.0.1e-fips ETag "5c1f9-5668e14ded620" Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 377337
GET H/1.1	200 OK	js2.js Show response billing.account.confirm.netflx.login.netflix-watch.com/Files/Style/	25 KB 25 KB	192ms 191ms	Script application/javascript	139.99.100.63 OVH
General Check archive.org Show headers Download Go to Full URL https://billing.account.confirm.netflx.login.netflix-watch.com/Files/Style/js2.js Requested by Host: billing.account.confirm.netflx.login.netflix-watch.com URL: https://billing.account.confirm.netflx.login.netflix-watch.com/Files/Login.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 139.99.100.63 Singapore, Singapore, ASN16276 (OVH, FR), Reverse DNS 63.ip-139-99-100.eu Software Apache/2.4.29 (Unix) OpenSSL/1.0.1e-fips / Resource Hash `ab37de7856c1f7e9f272ac206947a3301d1281849bb529fa5aa01d2338c2f51e` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host billing.account.confirm.netflx.login.netflix-watch.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept / Referer https://billing.account.confirm.netflx.login.netflix-watch.com/Files/Login.php Connection keep-alive Cache-Control no-cache Referer https://billing.account.confirm.netflx.login.netflix-watch.com/Files/Login.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sun, 04 Mar 2018 15:31:25 GMT Last-Modified Sun, 04 Mar 2018 03:48:25 GMT Server Apache/2.4.29 (Unix) OpenSSL/1.0.1e-fips ETag "63e0-5668e14e2c9da" Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 25568
GET H/1.1	200 OK	js3.js Show response billing.account.confirm.netflx.login.netflix-watch.com/Files/Style/	100 KB 101 KB	192ms 191ms	Script application/javascript	139.99.100.63 OVH
General Check archive.org Show headers Download Go to Full URL https://billing.account.confirm.netflx.login.netflix-watch.com/Files/Style/js3.js Requested by Host: billing.account.confirm.netflx.login.netflix-watch.com URL: https://billing.account.confirm.netflx.login.netflix-watch.com/Files/Login.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 139.99.100.63 Singapore, Singapore, ASN16276 (OVH, FR), Reverse DNS 63.ip-139-99-100.eu Software Apache/2.4.29 (Unix) OpenSSL/1.0.1e-fips / Resource Hash `7c7c559bbf66e9223fb4988f54f6ffc4ca1cc62fd826fc00bbd8d48615d90dd1` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host billing.account.confirm.netflx.login.netflix-watch.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept / Referer https://billing.account.confirm.netflx.login.netflix-watch.com/Files/Login.php Connection keep-alive Cache-Control no-cache Referer https://billing.account.confirm.netflx.login.netflix-watch.com/Files/Login.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sun, 04 Mar 2018 15:31:25 GMT Last-Modified Sun, 04 Mar 2018 03:48:26 GMT Server Apache/2.4.29 (Unix) OpenSSL/1.0.1e-fips ETag "190c8-5668e14f0db71" Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 102600
GET H/1.1	200 OK	logo-shadow2x.png billing.account.confirm.netflx.login.netflix-watch.com/Files/Images/	3 KB 4 KB	572ms 191ms	Image image/png	139.99.100.63 OVH
General Check archive.org Show headers Download Go to Show image Full URL https://billing.account.confirm.netflx.login.netflix-watch.com/Files/Images/logo-shadow2x.png Requested by Host: billing.account.confirm.netflx.login.netflix-watch.com URL: https://billing.account.confirm.netflx.login.netflix-watch.com/Files/Login.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 139.99.100.63 Singapore, Singapore, ASN16276 (OVH, FR), Reverse DNS 63.ip-139-99-100.eu Software Apache/2.4.29 (Unix) OpenSSL/1.0.1e-fips / Resource Hash `ce5ea4082631428eafcff63b01c85d0a3065eb81baa023128fc022f74ae2220d` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host billing.account.confirm.netflx.login.netflix-watch.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* https://billing.account.confirm.netflx.login.netflix-watch.com/Files/Style/css1.css Connection keep-alive Cache-Control no-cache Referer https://billing.account.confirm.netflx.login.netflix-watch.com/Files/Style/css1.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sun, 04 Mar 2018 15:31:26 GMT Last-Modified Sun, 04 Mar 2018 03:47:54 GMT Server Apache/2.4.29 (Unix) OpenSSL/1.0.1e-fips ETag "dd9-5668e13105eaf" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 3545
GET H/1.1	200 OK	login_lifestyle_tall_close_crop.jpg billing.account.confirm.netflx.login.netflix-watch.com/Files/Images/	84 KB 85 KB	374ms 191ms	Image image/jpeg	139.99.100.63 OVH
General Check archive.org Show headers Download Go to Show image Full URL https://billing.account.confirm.netflx.login.netflix-watch.com/Files/Images/login_lifestyle_tall_close_crop.jpg Requested by Host: billing.account.confirm.netflx.login.netflix-watch.com URL: https://billing.account.confirm.netflx.login.netflix-watch.com/Files/Login.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 139.99.100.63 Singapore, Singapore, ASN16276 (OVH, FR), Reverse DNS 63.ip-139-99-100.eu Software Apache/2.4.29 (Unix) OpenSSL/1.0.1e-fips / Resource Hash `baafd74a4cb4dc594b614eeb45c7267bb1af729d9271752460348ece16532d04` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host billing.account.confirm.netflx.login.netflix-watch.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* https://billing.account.confirm.netflx.login.netflix-watch.com/Files/Style/css3.css Connection keep-alive Cache-Control no-cache Referer https://billing.account.confirm.netflx.login.netflix-watch.com/Files/Style/css3.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sun, 04 Mar 2018 15:31:26 GMT Last-Modified Sun, 04 Mar 2018 03:47:52 GMT Server Apache/2.4.29 (Unix) OpenSSL/1.0.1e-fips ETag "150d2-5668e12f30ad2" Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=96 Content-Length 86226

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

20 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| beacon undefined| page object| html5 object| Modernizr function| yepnope function| $ function| jQuery function| Hammer object| netflix string| click string| interactType function| interactWith function| swallowEvent object| DebugConsole function| dbg object| jQuery110204240372566267947 object| PluginDetect function| Detector function| silverlightLoaded function| silverlightError

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

billing.account.confirm.netflx.login.netflix-watch.com
139.99.100.63
1d334f7430d2a0411812112de841d40dc662c6c79ff4a4d61020379e0cf91b01
3c6174161d4269e3ebc614a3f2359ce16cc200b49aca1d218d14c185b6d4079b
7c7c559bbf66e9223fb4988f54f6ffc4ca1cc62fd826fc00bbd8d48615d90dd1
89ff8c8b376e5733e05dfe32a6c6c834f2a04b93b0165cee16d2032a47b15b9c
9665c87b7234ca799f8f388d0d691b3587327e68bac389e265abd54cd784bfdd
973576ba6483c6c75d1d55339c1cac5d742abef700ede0903341ab222a2ee7c2
ab37de7856c1f7e9f272ac206947a3301d1281849bb529fa5aa01d2338c2f51e
baafd74a4cb4dc594b614eeb45c7267bb1af729d9271752460348ece16532d04
c31e5ae9166763db7211b4719f4b8cbe34e7b15c0c4fa510e9f60510d94fb1ce
ce5ea4082631428eafcff63b01c85d0a3065eb81baa023128fc022f74ae2220d
d7d01e005fc69e932089df3497391f2c5ebef0d9e944038e5b81e0812a15e4c6