aaccount-netflixse.servehttp.com Open in urlscan Pro
162.0.208.23 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://aaccount-netflixse.servehttp.com/en/Sign.php
Submission: On January 30 via automatic, source openphish (January 30th 2021, 1:30:09 pm UTC)

Summary HTTP 14 Redirects Links 8 Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 14 HTTP transactions. The main IP is 162.0.208.23, located in Canada and belongs to NAMECHEAP-NET, US. The main domain is aaccount-netflixse.servehttp.com.

This is the only time aaccount-netflixse.servehttp.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

	IP Address	AS Autonomous System
2	162.0.208.23 162.0.208.23	22612 (NAMECHEAP...) (NAMECHEAP-NET)
7	2a00:86c0:209... 2a00:86c0:2090::1	40027 (NETFLIX-ASN) (NETFLIX-ASN)
2	2a00:1450:400... 2a00:1450:4001:803::2003	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:80e::2004	15169 (GOOGLE) (GOOGLE)
14	4

2 162.0.208.23 (Canada)

ASN22612 (NAMECHEAP-NET, US)
PTR: server1.anjg.online

aaccount-netflixse.servehttp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:86c0:2090::1 (United Kingdom)

ASN40027 (NETFLIX-ASN, US)

codex.nflxext.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
assets.nflxext.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:803::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80e::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	nflxext.com codex.nflxext.com assets.nflxext.com	673 KB
3	google.com www.google.com	1 KB
2	gstatic.com www.gstatic.com	259 KB
2	servehttp.com aaccount-netflixse.servehttp.com	8 KB
14	4

	Domain	Requested by
4	codex.nflxext.com	aaccount-netflixse.servehttp.com
3	assets.nflxext.com	aaccount-netflixse.servehttp.com codex.nflxext.com
3	www.google.com	aaccount-netflixse.servehttp.com www.gstatic.com
2	www.gstatic.com	aaccount-netflixse.servehttp.com www.google.com
2	aaccount-netflixse.servehttp.com	aaccount-netflixse.servehttp.com
14	5

This site contains links to these domains. Also see Links.

Domain
policies.google.com
help.netflix.com

Subject Issuer	Validity	Valid
*.1.nflxso.net DigiCert SHA2 Secure Server CA	`2021-01-23` - `2021-02-23`	a month	crt.sh
*.gstatic.com GTS CA 1O1	`2021-01-05` - `2021-03-30`	3 months	crt.sh
www.google.com GTS CA 1O1	`2021-01-05` - `2021-03-30`	3 months	crt.sh
*.google.com GTS CA 1O1	`2021-01-05` - `2021-03-30`	3 months	crt.sh

This page contains 3 frames:

Primary Page: http://aaccount-netflixse.servehttp.com/en/Sign.php
Frame ID: C95D889C80110309FD0E56CD3B3A11F8
Requests: 12 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/enterprise/anchor?ar=1&k=6Lf8hrcUAAAAAIpQAFW2VFjtiYnThOjZOA5xvLyR&co=aHR0cHM6Ly93d3cubmV0ZmxpeC5jb206NDQz&hl=en&v=_KUxfxvAoJ4k7SaKyLbja4Mi&size=invisible&cb=inbm00t30zjm
Frame ID: 9B5CF1872CA44D01BD9895B02E7A42E8
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/enterprise/anchor?ar=1&k=6Lf8hrcUAAAAAIpQAFW2VFjtiYnThOjZOA5xvLyR&co=aHR0cDovL2FhY2NvdW50LW5ldGZsaXhzZS5zZXJ2ZWh0dHAuY29tOjgw&hl=en&v=-nejAZ5my6jV0Fbx9re8ChMK&size=invisible&cb=efjcoacakxq2
Frame ID: BB6ADEBCCE865389521028EA0A3A8ED3
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

14
Requests

86 %
HTTPS

75 %
IPv6

4
Domains

5
Subdomains

4
IPs

3
Countries

941 kB
Transfer

2097 kB
Size

0
Cookies

8 Outgoing links

These are links going to different origins than the main page.

URL: https://policies.google.com/privacy
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://policies.google.com/terms
Title: Terms of Service

Search URL Search Domain Scan URL

URL: https://help.netflix.com/support/412
Title: FAQ

Search URL Search Domain Scan URL

URL: https://help.netflix.com/
Title: Help Center

Search URL Search Domain Scan URL

URL: https://help.netflix.com/legal/termsofuse
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://help.netflix.com/legal/privacy
Title: Privacy

Search URL Search Domain Scan URL

URL: https://help.netflix.com/legal/privacy#cookies
Title: Cookie Preferences

Search URL Search Domain Scan URL

URL: https://help.netflix.com/legal/corpinfo
Title: Corporate Information

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Sign.php Show response
aaccount-netflixse.servehttp.com/en/ 43 KB
8 KB 336ms
316ms Document
text/html 162.0.208.23
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: http://aaccount-netflixse.servehttp.com/en/Sign.php
Protocol: HTTP/1.1
Server: 162.0.208.23 , Canada, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: server1.anjg.online
Software: Apache /
Resource Hash: ac9b135987614a1d581a8dfec6eea9f23a0117549c7fd3ccd7d30f9ac3e531c1

Request headers

Host: aaccount-netflixse.servehttp.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 30 Jan 2021 13:29:43 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 7476
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK none Show response
codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-js-v000c1de3/js/js/bootstrap.js,common%7Cbootstrap.js/2/0b4P034k4b4m06474u4O080p004Q4p4K4h4w4n4J4d4v4y0a024L15/bck/true/ 9 KB
4 KB 29ms
7ms Script
application/javascript 2a00:86c0:2090::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-js-v000c1de3/js/js/bootstrap.js,common%7Cbootstrap.js/2/0b4P034k4b4m06474u4O080p004Q4p4K4h4w4n4J4d4v4y0a024L15/bck/true/none

Requested by

Host: aaccount-netflixse.servehttp.com
URL: http://aaccount-netflixse.servehttp.com/en/Sign.php

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2a00:86c0:2090::1 , United Kingdom, ASN40027 (NETFLIX-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

2143c594d7870b719f176b8d42afd32e44ef388a839ae8294563cfb33598f02c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://aaccount-netflixse.servehttp.com/en/Sign.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 30 Jan 2021 13:29:43 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx
Content-Type: application/javascript; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=16070400
req_id: 90a2c96c-05f8-47fc-a8fb-38d1893edf20
Connection: keep-alive
Timing-Allow-Origin: https://www.netflix.com
Content-Length: 3625
Expires: Wed, 04 Aug 2021 08:41:03 GMT

GET
H/1.1 200
OK none Show response
codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-js-v000c1de3/js/js/components%7Clogin%7CloginControllerClient.js/2/0b4P034k4b4m06474u4O080p004Q4p4K4h4w4n4J4d4v4y0a024L15/l/true/ 857 KB
261 KB 462ms
432ms Script
application/javascript 2a00:86c0:2090::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-js-v000c1de3/js/js/components%7Clogin%7CloginControllerClient.js/2/0b4P034k4b4m06474u4O080p004Q4p4K4h4w4n4J4d4v4y0a024L15/l/true/none

Requested by

Host: aaccount-netflixse.servehttp.com
URL: http://aaccount-netflixse.servehttp.com/en/Sign.php

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2a00:86c0:2090::1 , United Kingdom, ASN40027 (NETFLIX-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

6c571484f28c8ebcde471be92147f3c941c3dba7f7237577cf82128a646255da

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://aaccount-netflixse.servehttp.com/en/Sign.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 30 Jan 2021 13:29:43 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx
Transfer-Encoding: chunked
Content-Type: application/javascript; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=16070400
req_id: 069888c1-cd60-496c-9652-d6d76abec3a3
Connection: keep-alive
Timing-Allow-Origin: https://www.netflix.com
Expires: Wed, 04 Aug 2021 13:29:43 GMT

GET
H/1.1 404
Not Found WebsiteDetect
aaccount-netflixse.servehttp.com/personalization/cl2/freeform/ 0
0 160ms
158ms Stylesheet
text/html 162.0.208.23
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: http://aaccount-netflixse.servehttp.com/personalization/cl2/freeform/WebsiteDetect?source=wwwhead&fetchType=css&modalView=login
Requested by: Host: aaccount-netflixse.servehttp.com
URL: http://aaccount-netflixse.servehttp.com/en/Sign.php
Protocol: HTTP/1.1
Server: 162.0.208.23 , Canada, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: server1.anjg.online
Software: Apache /
Resource Hash

Request headers

Referer: http://aaccount-netflixse.servehttp.com/en/Sign.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 30 Jan 2021 13:29:43 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=99
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H2 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/_KUxfxvAoJ4k7SaKyLbja4Mi/ 331 KB
130 KB 28ms
8ms Script
text/javascript 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/_KUxfxvAoJ4k7SaKyLbja4Mi/recaptcha__en.js

Requested by

Host: aaccount-netflixse.servehttp.com
URL: http://aaccount-netflixse.servehttp.com/en/Sign.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2ab2ee6c6698b57f2f3c79839a574a6808197ac57b7fbc6295b1be3ab8a4d279

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: http://aaccount-netflixse.servehttp.com
Referer: http://aaccount-netflixse.servehttp.com/en/Sign.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 29 Jan 2021 03:57:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 120732
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 132786
x-xss-protection: 0
last-modified: Sun, 17 Jan 2021 15:08:17 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 29 Jan 2022 03:57:31 GMT

GET
H/1.1 200
OK none
codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-css-v000c1de3/css/css/less%7Ccore%7Cerror-page.less/1/tEvM3Kru8DJL/none/true/ 11 KB
3 KB 274ms
257ms Stylesheet
text/css 2a00:86c0:2090::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-css-v000c1de3/css/css/less%7Ccore%7Cerror-page.less/1/tEvM3Kru8DJL/none/true/none

Requested by

Host: aaccount-netflixse.servehttp.com
URL: http://aaccount-netflixse.servehttp.com/en/Sign.php

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2a00:86c0:2090::1 , United Kingdom, ASN40027 (NETFLIX-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

d9bac1aefff045998fd064ed279defcd96c37a53ee0ee3816d1ebab19c1ff739

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://aaccount-netflixse.servehttp.com/en/Sign.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 30 Jan 2021 13:29:43 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx
Content-Type: text/css; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=16070400
req_id: 6d1f6fb3-3b80-49d8-90e7-0f08a11aa469
Connection: keep-alive
Timing-Allow-Origin: https://www.netflix.com
Content-Length: 2592
Expires: Wed, 04 Aug 2021 12:17:26 GMT

GET
H/1.1 200
OK none
codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-css-v000c1de3/css/css/less%7Clogin%7CloginBase.less,less%7Cpages%7Clogin%7CLogin.less/1/tEvM3Kru8DJL/none/true/ 131 KB
22 KB 36ms
19ms Stylesheet
text/css 2a00:86c0:2090::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-css-v000c1de3/css/css/less%7Clogin%7CloginBase.less,less%7Cpages%7Clogin%7CLogin.less/1/tEvM3Kru8DJL/none/true/none

Requested by

Host: aaccount-netflixse.servehttp.com
URL: http://aaccount-netflixse.servehttp.com/en/Sign.php

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2a00:86c0:2090::1 , United Kingdom, ASN40027 (NETFLIX-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

6602cddb83ec3ccfe1ab70ebb54df782a0bb02698a1f536dd7703555cbdd2dab

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://aaccount-netflixse.servehttp.com/en/Sign.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 30 Jan 2021 13:29:43 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx
Content-Type: text/css; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=16070400
req_id: 1946f2fb-e959-4bd3-a081-92098ca23c93
Connection: keep-alive
Timing-Allow-Origin: https://www.netflix.com
Content-Length: 21730
Expires: Wed, 04 Aug 2021 12:17:26 GMT

GET
H2 200 enterprise.js Show response
www.google.com/recaptcha/ 974 B
1 KB 35ms
15ms Script
text/javascript 2a00:1450:4001:80e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/enterprise.js?render=6Lf8hrcUAAAAAIpQAFW2VFjtiYnThOjZOA5xvLyR

Requested by

Host: aaccount-netflixse.servehttp.com
URL: http://aaccount-netflixse.servehttp.com/en/Sign.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

78617867422f062cbfd8c50b52feb0f9018d09492c7f18577a5466a1038d71e1

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://aaccount-netflixse.servehttp.com/en/Sign.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 30 Jan 2021 13:29:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-security-policy: frame-ancestors 'self'
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 614
x-xss-protection: 1; mode=block
expires: Sat, 30 Jan 2021 13:29:43 GMT

GET
H/1.1 200
OK ID-en-20210118-popsignuptwoweeks-perspective_alpha_website_large.jpg
assets.nflxext.com/ffe/siteui/vlv3/b6f906ab-4f9f-49b5-a63b-6a3b29c8d04b/7f14d7ff-f430-4878-a9e4-c47c0bf5168d/ 309 KB
310 KB 233ms
210ms Image
image/jpeg 2a00:86c0:2090::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.nflxext.com/ffe/siteui/vlv3/b6f906ab-4f9f-49b5-a63b-6a3b29c8d04b/7f14d7ff-f430-4878-a9e4-c47c0bf5168d/ID-en-20210118-popsignuptwoweeks-perspective_alpha_website_large.jpg
Requested by: Host: aaccount-netflixse.servehttp.com
URL: http://aaccount-netflixse.servehttp.com/en/Sign.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:86c0:2090::1 , United Kingdom, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 1c8290a5ebf40c677187685d6d2ce743facb641489ef75f8790759de7ca74555

Request headers

Referer: http://aaccount-netflixse.servehttp.com/en/Sign.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 30 Jan 2021 13:29:43 GMT
Last-Modified: Wed, 20 Jan 2021 14:10:39 GMT
Server: nginx
Content-MD5: OXF0TayReQu23ufwuNXnNw==
Content-Type: image/jpeg
Cache-Control: public, max-age=8784
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 316746
Expires: Sat, 30 Jan 2021 15:56:07 GMT

GET
H/1.1 200
OK FB-f-Logo__blue_57.png
assets.nflxext.com/ffe/siteui/login/images/ 1 KB
2 KB 58ms
6ms Image
image/png 2a00:86c0:2090::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.nflxext.com/ffe/siteui/login/images/FB-f-Logo__blue_57.png
Requested by: Host: aaccount-netflixse.servehttp.com
URL: http://aaccount-netflixse.servehttp.com/en/Sign.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:86c0:2090::1 , United Kingdom, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece

Request headers

Referer: http://aaccount-netflixse.servehttp.com/en/Sign.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 30 Jan 2021 13:29:43 GMT
Last-Modified: Thu, 30 Jun 2016 17:48:49 GMT
Server: nginx
Content-MD5: ozykfvEQtuPsUIa4d2QH0w==
Content-Type: image/png
Cache-Control: public, max-age=9200
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1455
Expires: Fri, 28 Aug 2020 02:02:41 GMT

GET
H/1.1 200
OK nf-icon-v1-93.woff
assets.nflxext.com/ffe/siteui/fonts/ 72 KB
72 KB 76ms
21ms Font
application/octet-stream 2a00:86c0:2090::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.nflxext.com/ffe/siteui/fonts/nf-icon-v1-93.woff
Requested by: Host: codex.nflxext.com
URL: https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-css-v000c1de3/css/css/less%7Clogin%7CloginBase.less,less%7Cpages%7Clogin%7CLogin.less/1/tEvM3Kru8DJL/none/true/none
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:86c0:2090::1 , United Kingdom, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d

Request headers

Origin: http://aaccount-netflixse.servehttp.com
Referer: https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-css-v000c1de3/css/css/less%7Clogin%7CloginBase.less,less%7Cpages%7Clogin%7CLogin.less/1/tEvM3Kru8DJL/none/true/none
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 30 Jan 2021 13:29:43 GMT
Content-Encoding: gzip
Last-Modified: Mon, 29 Jan 2018 01:50:51 GMT
Server: nginx
Content-MD5: fPYVbMSBJEtaJUNi17c/AA==
Content-Type: text/plain
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=8000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 73566
Expires: Wed, 26 Aug 2020 06:48:41 GMT

GET
H2 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/-nejAZ5my6jV0Fbx9re8ChMK/ 331 KB
129 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/-nejAZ5my6jV0Fbx9re8ChMK/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/enterprise.js?render=6Lf8hrcUAAAAAIpQAFW2VFjtiYnThOjZOA5xvLyR

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ded038181a2e72755fc4c0d57ec9e45725629888a038328e238ab07cdb8e8e11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: http://aaccount-netflixse.servehttp.com
Referer: http://aaccount-netflixse.servehttp.com/en/Sign.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 30 Jan 2021 12:15:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4479
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 132160
x-xss-protection: 0
last-modified: Mon, 25 Jan 2021 05:07:21 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 30 Jan 2022 12:15:08 GMT

GET
H2 200 anchor
www.google.com/recaptcha/enterprise/ Frame 9B5C 0
0 25ms
24ms Document
text/html 2a00:1450:4001:80e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/enterprise/anchor?ar=1&k=6Lf8hrcUAAAAAIpQAFW2VFjtiYnThOjZOA5xvLyR&co=aHR0cHM6Ly93d3cubmV0ZmxpeC5jb206NDQz&hl=en&v=_KUxfxvAoJ4k7SaKyLbja4Mi&size=invisible&cb=inbm00t30zjm

Requested by

Host: aaccount-netflixse.servehttp.com
URL: http://aaccount-netflixse.servehttp.com/en/Sign.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-GpS1cngo9EQvzhJSWfU3xA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/enterprise/anchor?ar=1&k=6Lf8hrcUAAAAAIpQAFW2VFjtiYnThOjZOA5xvLyR&co=aHR0cHM6Ly93d3cubmV0ZmxpeC5jb206NDQz&hl=en&v=_KUxfxvAoJ4k7SaKyLbja4Mi&size=invisible&cb=inbm00t30zjm
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://aaccount-netflixse.servehttp.com/en/Sign.php
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: http://aaccount-netflixse.servehttp.com/en/Sign.php

Response headers

content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Sat, 30 Jan 2021 13:29:47 GMT
content-security-policy: script-src 'report-sample' 'nonce-GpS1cngo9EQvzhJSWfU3xA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 10795
server: GSE
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 anchor
www.google.com/recaptcha/enterprise/ Frame BB6A 0
0 17ms
16ms Document
text/html 2a00:1450:4001:80e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/enterprise/anchor?ar=1&k=6Lf8hrcUAAAAAIpQAFW2VFjtiYnThOjZOA5xvLyR&co=aHR0cDovL2FhY2NvdW50LW5ldGZsaXhzZS5zZXJ2ZWh0dHAuY29tOjgw&hl=en&v=-nejAZ5my6jV0Fbx9re8ChMK&size=invisible&cb=efjcoacakxq2

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/-nejAZ5my6jV0Fbx9re8ChMK/recaptcha__en.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-IGcHjACskEjnpxW1G/b8fg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/enterprise/anchor?ar=1&k=6Lf8hrcUAAAAAIpQAFW2VFjtiYnThOjZOA5xvLyR&co=aHR0cDovL2FhY2NvdW50LW5ldGZsaXhzZS5zZXJ2ZWh0dHAuY29tOjgw&hl=en&v=-nejAZ5my6jV0Fbx9re8ChMK&size=invisible&cb=efjcoacakxq2
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://aaccount-netflixse.servehttp.com/en/Sign.php
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: http://aaccount-netflixse.servehttp.com/en/Sign.php

Response headers

content-security-policy: script-src 'report-sample' 'nonce-IGcHjACskEjnpxW1G/b8fg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
content-encoding: gzip
date: Sat, 30 Jan 2021 13:29:47 GMT
expires: Sat, 30 Jan 2021 13:29:47 GMT
cache-control: private, max-age=0
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 1053
server: GSE
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

25 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aaccount-netflixse.servehttp.com
assets.nflxext.com
codex.nflxext.com
www.google.com
www.gstatic.com
162.0.208.23
2a00:1450:4001:803::2003
2a00:1450:4001:80e::2004
2a00:86c0:2090::1
1c8290a5ebf40c677187685d6d2ce743facb641489ef75f8790759de7ca74555
2143c594d7870b719f176b8d42afd32e44ef388a839ae8294563cfb33598f02c
2ab2ee6c6698b57f2f3c79839a574a6808197ac57b7fbc6295b1be3ab8a4d279
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece
6602cddb83ec3ccfe1ab70ebb54df782a0bb02698a1f536dd7703555cbdd2dab
6c571484f28c8ebcde471be92147f3c941c3dba7f7237577cf82128a646255da
78617867422f062cbfd8c50b52feb0f9018d09492c7f18577a5466a1038d71e1
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d
ac9b135987614a1d581a8dfec6eea9f23a0117549c7fd3ccd7d30f9ac3e531c1
d9bac1aefff045998fd064ed279defcd96c37a53ee0ee3816d1ebab19c1ff739
ded038181a2e72755fc4c0d57ec9e45725629888a038328e238ab07cdb8e8e11

aaccount-netflixse.servehttp.com Open in urlscan Pro 162.0.208.23 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

14 Requests

86 %HTTPS

75 %IPv6

4 Domains

5 Subdomains

4 IPs

3 Countries

941 kBTransfer

2097 kBSize

0 Cookies

8 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

25 JavaScript Global Variables

0 Cookies

Indicators

aaccount-netflixse.servehttp.com Open in urlscan Pro
162.0.208.23 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

86 %
HTTPS

75 %
IPv6

4
Domains

5
Subdomains

4
IPs

3
Countries

941 kB
Transfer

2097 kB
Size

0
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!