unlimited.movies.and.series.netflix.afraplants.ir

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 7 HTTP transactions. The main IP is 45.143.138.186, located in Russian Federation and belongs to GARANT-PARK-INTERNET, RU. The main domain is unlimited.movies.and.series.netflix.afraplants.ir.
TLS certificate: Issued by Let's Encrypt Authority X3 on August 19th 2020. Valid for: 3 months.

This is the only time unlimited.movies.and.series.netflix.afraplants.ir was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 2	209.59.190.120 209.59.190.120	32244 (LIQUIDWEB) (LIQUIDWEB)
1 5	45.143.138.186 45.143.138.186	47196 (GARANT-PA...) (GARANT-PARK-INTERNET)
2	2a00:86c0:209... 2a00:86c0:2090::1	40027 (NETFLIX-ASN) (NETFLIX-ASN)
7	3

2 209.59.190.120 (Lansing, United States) 1 redirects

ASN32244 (LIQUIDWEB, US)
PTR: shark.exacthosting.com

siauburn.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 45.143.138.186 (Russian Federation) 1 redirects

ASN47196 (GARANT-PARK-INTERNET, RU)
PTR: free.example.com

unlimited.movies.and.series.netflix.afraplants.ir	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:86c0:2090::1 (United Kingdom)

ASN40027 (NETFLIX-ASN, US)

assets.nflxext.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	afraplants.ir 1 redirects unlimited.movies.and.series.netflix.afraplants.ir	159 KB
2	nflxext.com assets.nflxext.com	157 KB
2	siauburn.org 1 redirects siauburn.org	879 B
7	3

	Domain	Requested by
5	unlimited.movies.and.series.netflix.afraplants.ir	1 redirects siauburn.org unlimited.movies.and.series.netflix.afraplants.ir
2	assets.nflxext.com	unlimited.movies.and.series.netflix.afraplants.ir
2	siauburn.org	1 redirects
7	3

This site contains no links.

Subject Issuer	Validity	Valid
unlimited.movies.and.series.netflix.afraplants.ir Let's Encrypt Authority X3	`2020-08-19` - `2020-11-17`	3 months	crt.sh
*.1.nflxso.net DigiCert SHA2 Secure Server CA	`2020-08-18` - `2020-09-20`	a month	crt.sh

This page contains 1 frames:

Primary Page: https://unlimited.movies.and.series.netflix.afraplants.ir/3614ea3da5be14732ad9f27645938df7/index.html
Frame ID: 15B59846179024EE0749F53EFA7478B4
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://siauburn.org/read HTTP 301
http://siauburn.org/read/ Page URL
https://unlimited.movies.and.series.netflix.afraplants.ir/ HTTP 302
https://unlimited.movies.and.series.netflix.afraplants.ir/3614ea3da5be14732ad9f27645938df7/index.html Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

7
Requests

86 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

315 kB
Transfer

313 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://siauburn.org/read HTTP 301
http://siauburn.org/read/ Page URL
https://unlimited.movies.and.series.netflix.afraplants.ir/ HTTP 302
https://unlimited.movies.and.series.netflix.afraplants.ir/3614ea3da5be14732ad9f27645938df7/index.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://siauburn.org/read HTTP 301
http://siauburn.org/read/

7 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

/ Show response
siauburn.org/read/
Redirect Chain

http://siauburn.org/read
http://siauburn.org/read/

119 B
532 B

158ms
158ms

Document
text/html

209.59.190.120
LIQUIDWEB

General

Check archive.org

Show headers Download Go to

Full URL

http://siauburn.org/read/

Protocol

HTTP/1.1

Server

209.59.190.120 Lansing, United States, ASN32244 (LIQUIDWEB, US),

Reverse DNS

shark.exacthosting.com

Software

Apache /

Resource Hash

dbda9d34981c19f601a2bb84e3ccea62c9115d83ad0fdf153203817c45bc3df8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Host: siauburn.org
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 20 Aug 2020 02:59:53 GMT
Server: Apache
X-Content-Type-Options: nosniff
Last-Modified: Wed, 19 Aug 2020 06:35:47 GMT
Accept-Ranges: bytes
Cache-Control: max-age=600
Expires: Thu, 20 Aug 2020 03:09:53 GMT
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 131
Keep-Alive: timeout=2, max=499
Connection: Keep-Alive
Content-Type: text/html

Redirect headers

Date: Thu, 20 Aug 2020 02:59:53 GMT
Server: Apache
X-Content-Type-Options: nosniff
Location: http://siauburn.org/read/
Cache-Control: max-age=600
Expires: Thu, 20 Aug 2020 03:09:53 GMT
Content-Length: 233
Keep-Alive: timeout=2, max=500
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1

200
OK

Primary Request index.html Show response
unlimited.movies.and.series.netflix.afraplants.ir/3614ea3da5be14732ad9f27645938df7/
Redirect Chain

https://unlimited.movies.and.series.netflix.afraplants.ir/
https://unlimited.movies.and.series.netflix.afraplants.ir/3614ea3da5be14732ad9f27645938df7/index.html

8 KB
8 KB

93ms
92ms

Document
text/html

45.143.138.186
GARANT-PARK-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: https://unlimited.movies.and.series.netflix.afraplants.ir/3614ea3da5be14732ad9f27645938df7/index.html
Requested by: Host: siauburn.org
URL: http://siauburn.org/read/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 45.143.138.186 , Russian Federation, ASN47196 (GARANT-PARK-INTERNET, RU),
Reverse DNS: free.example.com
Software: Apache/2.4.6 (CentOS) mpm-itk/2.4.7-04 OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 /
Resource Hash: 32d57f85ecd90f59c65e5e923790efbdba3674b4248216b15d23913ce13b3eb4

Request headers

Host: unlimited.movies.and.series.netflix.afraplants.ir
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: document
Referer: http://siauburn.org/read/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: PHPSESSID=us8c93joggt9lr79iht87id9v5
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: http://siauburn.org/read/

Response headers

Date: Thu, 20 Aug 2020 02:59:54 GMT
Server: Apache/2.4.6 (CentOS) mpm-itk/2.4.7-04 OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16
Last-Modified: Thu, 20 Aug 2020 02:59:54 GMT
ETag: W/"1ee6-5ad4650902618"
Accept-Ranges: bytes
Content-Length: 7910
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

Redirect headers

Date: Thu, 20 Aug 2020 02:59:54 GMT
Server: Apache/2.4.6 (CentOS) mpm-itk/2.4.7-04 OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16
X-Powered-By: PHP/5.4.16
Set-Cookie: PHPSESSID=us8c93joggt9lr79iht87id9v5; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
location: 3614ea3da5be14732ad9f27645938df7/index.html
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK guess.css
unlimited.movies.and.series.netflix.afraplants.ir/3614ea3da5be14732ad9f27645938df7/css/ 139 KB
139 KB 93ms
92ms Stylesheet
text/css 45.143.138.186
GARANT-PARK-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: https://unlimited.movies.and.series.netflix.afraplants.ir/3614ea3da5be14732ad9f27645938df7/css/guess.css
Requested by: Host: unlimited.movies.and.series.netflix.afraplants.ir
URL: https://unlimited.movies.and.series.netflix.afraplants.ir/3614ea3da5be14732ad9f27645938df7/index.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 45.143.138.186 , Russian Federation, ASN47196 (GARANT-PARK-INTERNET, RU),
Reverse DNS: free.example.com
Software: Apache/2.4.6 (CentOS) mpm-itk/2.4.7-04 OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 /
Resource Hash: 52ef3b0073a43c365ca963e45964b582aadd37045e6313a14219b90aacf0cc98

Request headers

Referer: https://unlimited.movies.and.series.netflix.afraplants.ir/3614ea3da5be14732ad9f27645938df7/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 20 Aug 2020 02:59:54 GMT
Last-Modified: Thu, 20 Aug 2020 02:59:54 GMT
Server: Apache/2.4.6 (CentOS) mpm-itk/2.4.7-04 OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16
ETag: W/"22ac3-5ad46508fad00"
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 142019

GET
H/1.1 200
OK logomic.jpg
unlimited.movies.and.series.netflix.afraplants.ir/3614ea3da5be14732ad9f27645938df7/img/ 9 KB
9 KB 283ms
94ms Image
image/jpeg 45.143.138.186
GARANT-PARK-INTERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://unlimited.movies.and.series.netflix.afraplants.ir/3614ea3da5be14732ad9f27645938df7/img/logomic.jpg
Requested by: Host: unlimited.movies.and.series.netflix.afraplants.ir
URL: https://unlimited.movies.and.series.netflix.afraplants.ir/3614ea3da5be14732ad9f27645938df7/index.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 45.143.138.186 , Russian Federation, ASN47196 (GARANT-PARK-INTERNET, RU),
Reverse DNS: free.example.com
Software: Apache/2.4.6 (CentOS) mpm-itk/2.4.7-04 OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 /
Resource Hash: d3b4d13c5822dcf06ffa622fcccb0082142dbb58b36de37a6de362fc4008fa99

Request headers

Referer: https://unlimited.movies.and.series.netflix.afraplants.ir/3614ea3da5be14732ad9f27645938df7/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 20 Aug 2020 02:59:54 GMT
Last-Modified: Thu, 20 Aug 2020 02:59:54 GMT
Server: Apache/2.4.6 (CentOS) mpm-itk/2.4.7-04 OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16
ETag: W/"2315-5ad4650901e48"
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 8981

GET
H/1.1 200
OK FB-f-Logo__blue_57.png
unlimited.movies.and.series.netflix.afraplants.ir/3614ea3da5be14732ad9f27645938df7/img/ 1 KB
2 KB 92ms
92ms Image
image/png 45.143.138.186
GARANT-PARK-INTERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://unlimited.movies.and.series.netflix.afraplants.ir/3614ea3da5be14732ad9f27645938df7/img/FB-f-Logo__blue_57.png
Requested by: Host: unlimited.movies.and.series.netflix.afraplants.ir
URL: https://unlimited.movies.and.series.netflix.afraplants.ir/3614ea3da5be14732ad9f27645938df7/index.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 45.143.138.186 , Russian Federation, ASN47196 (GARANT-PARK-INTERNET, RU),
Reverse DNS: free.example.com
Software: Apache/2.4.6 (CentOS) mpm-itk/2.4.7-04 OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 /
Resource Hash: 3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece

Request headers

Referer: https://unlimited.movies.and.series.netflix.afraplants.ir/3614ea3da5be14732ad9f27645938df7/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 20 Aug 2020 02:59:54 GMT
Last-Modified: Thu, 20 Aug 2020 02:59:54 GMT
Server: Apache/2.4.6 (CentOS) mpm-itk/2.4.7-04 OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16
ETag: W/"5af-5ad4650900ea8"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 1455

GET
H/1.1 200
OK login-the-crown_2-1500x1000.jpg
assets.nflxext.com/ffe/siteui/acquisition/login/ 84 KB
85 KB 24ms
5ms Image
image/jpeg 2a00:86c0:2090::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.nflxext.com/ffe/siteui/acquisition/login/login-the-crown_2-1500x1000.jpg
Requested by: Host: unlimited.movies.and.series.netflix.afraplants.ir
URL: https://unlimited.movies.and.series.netflix.afraplants.ir/3614ea3da5be14732ad9f27645938df7/css/guess.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:86c0:2090::1 , United Kingdom, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: baafd74a4cb4dc594b614eeb45c7267bb1af729d9271752460348ece16532d04

Request headers

Referer: https://unlimited.movies.and.series.netflix.afraplants.ir/3614ea3da5be14732ad9f27645938df7/css/guess.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 20 Aug 2020 02:59:54 GMT
Last-Modified: Mon, 24 Oct 2016 20:49:51 GMT
Server: nginx
Content-MD5: 5GY/BZWwL7HDlH/B8V64Eg==
Content-Type: image/jpeg
Cache-Control: public, max-age=11439
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 86226
Expires: Wed, 22 Jul 2020 04:38:06 GMT

GET
H/1.1 200
OK nf-icon-v1-93.woff
assets.nflxext.com/ffe/siteui/fonts/ 72 KB
72 KB 19ms
5ms Font
application/octet-stream 2a00:86c0:2090::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.nflxext.com/ffe/siteui/fonts/nf-icon-v1-93.woff
Requested by: Host: unlimited.movies.and.series.netflix.afraplants.ir
URL: https://unlimited.movies.and.series.netflix.afraplants.ir/3614ea3da5be14732ad9f27645938df7/css/guess.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:86c0:2090::1 , United Kingdom, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Origin: https://unlimited.movies.and.series.netflix.afraplants.ir
Referer: https://unlimited.movies.and.series.netflix.afraplants.ir/3614ea3da5be14732ad9f27645938df7/css/guess.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 20 Aug 2020 02:59:54 GMT
Content-Encoding: gzip
Last-Modified: Mon, 29 Jan 2018 01:50:51 GMT
Server: nginx
Content-MD5: fPYVbMSBJEtaJUNi17c/AA==
Content-Type: text/plain
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=12535
Connection: keep-alive
Content-Length: 73566
Expires: Wed, 01 Jul 2020 01:38:45 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			unlimited.movies.and.series.netflix.afraplants.ir/	1969-12-31 23:59:59	Name: PHPSESSID Value: us8c93joggt9lr79iht87id9v5

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.nflxext.com
siauburn.org
unlimited.movies.and.series.netflix.afraplants.ir
209.59.190.120
2a00:86c0:2090::1
45.143.138.186
32d57f85ecd90f59c65e5e923790efbdba3674b4248216b15d23913ce13b3eb4
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece
52ef3b0073a43c365ca963e45964b582aadd37045e6313a14219b90aacf0cc98
baafd74a4cb4dc594b614eeb45c7267bb1af729d9271752460348ece16532d04
d3b4d13c5822dcf06ffa622fcccb0082142dbb58b36de37a6de362fc4008fa99
dbda9d34981c19f601a2bb84e3ccea62c9115d83ad0fdf153203817c45bc3df8

unlimited.movies.and.series.netflix.afraplants.ir Open in urlscan Pro 45.143.138.186 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

7 Requests

86 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

315 kBTransfer

313 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

1 Cookies

Security Headers

Indicators

unlimited.movies.and.series.netflix.afraplants.ir Open in urlscan Pro
45.143.138.186 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

86 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

315 kB
Transfer

313 kB
Size

1
Cookies

7 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!