www.netflix.bnbpromociones.com
Open in
urlscan Pro
167.114.157.48
Malicious Activity!
Public Scan
Submission: On October 30 via automatic, source certstream-suspicious
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on October 30th 2018. Valid for: 3 months.
This is the only time www.netflix.bnbpromociones.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Netflix (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
6 | 167.114.157.48 167.114.157.48 | 16276 (OVH) (OVH) | |
6 | 2a02:26f0:6c0... 2a02:26f0:6c00:297::33c4 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
2 | 2a01:578:3::3... 2a01:578:3::364c:63bc | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
15 | 4 |
ASN16276 (OVH, FR)
PTR: net03usa.nethostingsac.com
www.netflix.bnbpromociones.com |
ASN20940 (AKAMAI-ASN1, US)
codex.nflxext.com | |
assets.nflxext.com | |
ae.nflximg.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
bnbpromociones.com
www.netflix.bnbpromociones.com |
34 KB |
5 |
nflxext.com
codex.nflxext.com assets.nflxext.com |
462 KB |
2 |
netflix.com
www.netflix.com Failed |
2 KB |
1 |
nflximg.net
ae.nflximg.net |
|
15 | 4 |
Domain | Requested by | |
---|---|---|
6 | www.netflix.bnbpromociones.com |
www.netflix.bnbpromociones.com
codex.nflxext.com |
3 | codex.nflxext.com |
www.netflix.bnbpromociones.com
|
2 | assets.nflxext.com |
www.netflix.bnbpromociones.com
|
2 | www.netflix.com |
www.netflix.bnbpromociones.com
codex.nflxext.com |
1 | ae.nflximg.net |
codex.nflxext.com
|
15 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.netflix.com |
help.netflix.com |
media.netflix.com |
ir.netflix.com |
jobs.netflix.com |
fast.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
netflix.bnbpromociones.com cPanel, Inc. Certification Authority |
2018-10-30 - 2019-01-28 |
3 months | crt.sh |
assets.nflxext.com DigiCert SHA2 Secure Server CA |
2018-03-09 - 2020-03-09 |
2 years | crt.sh |
www.netflix.com DigiCert SHA2 Secure Server CA |
2018-02-07 - 2020-02-07 |
2 years | crt.sh |
This page contains 2 frames:
Primary Page:
https://www.netflix.bnbpromociones.com/
Frame ID: 81CE475BBFB8BA5F432A9C731D30F0C9
Requests: 14 HTTP requests in this frame
Frame:
https://ae.nflximg.net/monet/scripts/adtech_iframe_target_04.html?data=%7B%22is_member%22%3A%22anonymous%22%2C%22membership_status%22%3A%22NON_REGISTERED_MEMBER%22%2C%22session%22%3A%22n%2Fa%22%2C%22country%22%3A%22PE%22%2C%22referrer%22%3A%22nmLanding%22%2C%22source%22%3A%22%22%2C%22fbaId%22%3A%22e256974e-6c1b-4eb9-9748-c61e2ed6892c%22%7D
Frame ID: 4EB2FF1A0715541720C1F09B759C476F
Requests: 1 HTTP requests in this frame
15 Outgoing links
These are links going to different origins than the main page.
Title: Iniciar sesión
Search URL Search Domain Scan URL
Title: Preguntas frecuentes
Search URL Search Domain Scan URL
Title: Centro de ayuda
Search URL Search Domain Scan URL
Title: Cuenta
Search URL Search Domain Scan URL
Title: Prensa
Search URL Search Domain Scan URL
Title: Relaciones con inversionistas
Search URL Search Domain Scan URL
Title: Empleo
Search URL Search Domain Scan URL
Title: Formas de ver
Search URL Search Domain Scan URL
Title: Términos de uso
Search URL Search Domain Scan URL
Title: Privacidad
Search URL Search Domain Scan URL
Title: Preferencias de cookies
Search URL Search Domain Scan URL
Title: Información corporativa
Search URL Search Domain Scan URL
Title: Contáctanos
Search URL Search Domain Scan URL
Title: Prueba de velocidad
Search URL Search Domain Scan URL
Title: Avisos legales
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
www.netflix.bnbpromociones.com/ |
71 KB 28 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
none
codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-nmhp-js-v0df333bf/js/js/bootstrap.js,common%7Cbootstrap.js/1/85236/bck/true/ |
14 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
none
codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-nmhp-js-v0df333bf/js/js/signup%7Chome%7Clite%7Cclient.js/1/85236/l/true/ |
56 KB 17 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
WebsiteDetect
www.netflix.com/ichnaea/cl2/freeform/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
none
codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-shakti-css-v0df333bf/css/css/less%7Cpages%7Chome%7Cconcord.less/2/0z0O030H080G0T0W0P0I0N0V0_/none/true/ |
111 KB 17 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
PE-es-20180917-popsignuptwoweeks-perspective_alpha_website_large.jpg
assets.nflxext.com/ffe/siteui/vlv3/b09c7d01-44a8-4786-93e6-90c9bc7a4c0a/f7036626-d789-4561-8ed5-941f3f983fa1/ |
350 KB 351 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
asset_cancelanytime_withdevice.png
www.netflix.bnbpromociones.com/assets.nflxext.com/ffe/siteui/acquisition/home/thisIsNetflix/modules/ |
1 KB 1 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
asset_TV_UI.png
www.netflix.bnbpromociones.com/assets.nflxext.com/ffe/siteui/acquisition/home/thisIsNetflix/modules/ |
1 KB 1 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
asset_mobile_tablet_UI_2.png
www.netflix.bnbpromociones.com/assets.nflxext.com/ffe/siteui/acquisition/home/thisIsNetflix/modules/ |
1 KB 1 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
asset_website_UI.png
www.netflix.bnbpromociones.com/assets.nflxext.com/ffe/siteui/acquisition/home/thisIsNetflix/modules/ |
1 KB 1 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
nf-icon-v1-93.woff
assets.nflxext.com/ffe/siteui/fonts/ |
72 KB 72 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
WebsiteTTI
www.netflix.bnbpromociones.com/ichnaea/cl2/freeform/ |
1 KB 1 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
adtech_iframe_target_04.html
ae.nflximg.net/monet/scripts/ Frame 4EB2 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H/1.1 |
cl2
www.netflix.com/ichnaea/ |
0 964 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
cl2
www.netflix.com/ichnaea/ |
0 1 KB |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- www.netflix.com
- URL
- https://www.netflix.com/ichnaea/cl2/freeform/WebsiteDetect?source=wwwhead&fetchType=css&modalView=nmLanding
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Netflix (Online)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| netflix object| Codex object| C object| global object| process object| __core-js_shared__0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ae.nflximg.net
assets.nflxext.com
codex.nflxext.com
www.netflix.bnbpromociones.com
www.netflix.com
www.netflix.com
167.114.157.48
2a01:578:3::364c:63bc
2a02:26f0:6c00:297::33c4
440cc27903d9e36897d008725186ff70f95fc40411e8631df89974400666b889
5cf4b6bb0bd57c0d682885188644b73997f0d1c820c6c854bb326ca42b8dc283
6b7668defd13192df758a074832315a8d565374c2778ecac8e5a3c25124c705a
70c65bd0e084398a87baa298c1fafa52afff402096cb350d563d309565c07e83
7504dda4b7c78da86ae534d3ddb6dd21e332c6f405ea19d056178a639e37c4e8
7ad8c8c2d47662b3de7b09f5c789b09cbe453c66f7fa6fde6c9c7ab6c77bc3d1
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855