ftnt.github.io
Open in
urlscan Pro
185.199.108.153
Malicious Activity!
Public Scan
Effective URL: https://ftnt.github.io/bootcamp_g14_maquetado/
Submission: On September 07 via api from US
Summary
TLS certificate: Issued by DigiCert SHA2 High Assurance Server CA on May 6th 2020. Valid for: 2 years.
This is the only time ftnt.github.io was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Netflix (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 4 | 185.199.108.153 185.199.108.153 | 54113 (FASTLY) (FASTLY) | |
4 | 2a00:86c0:209... 2a00:86c0:2090::1 | 40027 (NETFLIX-ASN) (NETFLIX-ASN) | |
1 | 179.6.123.2 179.6.123.2 | 12252 (America M...) (America Movil Peru S.A.C.) | |
1 | 2606:4700::68... 2606:4700::6810:7aaf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
5 | 2606:4700::68... 2606:4700::6810:7eaf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
14 | 5 |
ASN54113 (FASTLY, US)
PTR: cdn-185-199-108-153.github.com
ftnt.github.io |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
unpkg.com
unpkg.com |
8 KB |
4 |
nflxext.com
assets.nflxext.com |
539 KB |
4 |
github.io
1 redirects
ftnt.github.io |
26 KB |
1 |
nflxso.net
occ-0-1193-116.1.nflxso.net |
257 KB |
14 | 4 |
Domain | Requested by | |
---|---|---|
6 | unpkg.com |
ftnt.github.io
unpkg.com |
4 | assets.nflxext.com |
ftnt.github.io
|
4 | ftnt.github.io |
1 redirects
ftnt.github.io
|
1 | occ-0-1193-116.1.nflxso.net |
ftnt.github.io
|
14 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.netflix.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.github.com DigiCert SHA2 High Assurance Server CA |
2020-05-06 - 2022-04-14 |
2 years | crt.sh |
*.1.nflxso.net DigiCert TLS RSA SHA256 2020 CA1 |
2021-09-03 - 2021-10-08 |
a month | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-07-02 - 2022-07-01 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://ftnt.github.io/bootcamp_g14_maquetado/
Frame ID: 14A288AD89F6F6D4D312A2FEE17B7FD6
Requests: 14 HTTP requests in this frame
Screenshot
Page Title
NetflixPage URL History Show full URLs
-
https://ftnt.github.io/bootcamp_g14_maquetado
HTTP 301
https://ftnt.github.io/bootcamp_g14_maquetado/ Page URL
Detected technologies
Ruby (Programming Languages) ExpandDetected patterns
- url /^https?:\/\/[^/]+\.github\.io\//i
- headers server /^GitHub\.com$/i
Varnish (Cache Tools) Expand
Detected patterns
- headers via /varnish(?: \(Varnish\/([\d.]+)\))?/i
Ruby on Rails (Web Frameworks) Expand
Detected patterns
- url /^https?:\/\/[^/]+\.github\.io\//i
- headers server /^GitHub\.com$/i
GitHub Pages (CDN) Expand
Detected patterns
- url /^https?:\/\/[^/]+\.github\.io\//i
- headers server /^GitHub\.com$/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Iniciar sesion
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://ftnt.github.io/bootcamp_g14_maquetado
HTTP 301
https://ftnt.github.io/bootcamp_g14_maquetado/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
ftnt.github.io/bootcamp_g14_maquetado/ Redirect Chain
|
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
styles.css
ftnt.github.io/bootcamp_g14_maquetado/ |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
R.png
ftnt.github.io/bootcamp_g14_maquetado/asset/img/ |
23 KB 23 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
tv.png
assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/ |
11 KB 11 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mobile-0819.jpg
assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/ |
48 KB 49 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
device-pile.png
assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/ |
134 KB 134 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
AAAABeLa_an51Ptz6LMzNXnM9oDvlKl4yIJQKZJRJ9fVFPpPFK5toVuo-KytXEdqPI64KCph1OKms7nLxtCsXm_CARaR50wx.png
occ-0-1193-116.1.nflxso.net/dnm/api/v6/19OhWN2dO19C9txTON9tvTFtefw/ |
257 KB 257 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ionicons.js
unpkg.com/ionicons@4.5.10-0/dist/ |
830 B 494 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ionicons.esm.js
unpkg.com/ionicons@4.5.10-0/dist/ionicons/ |
265 B 614 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
PE-es-20210823-popsignuptwoweeks-perspective_alpha_website_large.jpg
assets.nflxext.com/ffe/siteui/vlv3/5a27cb25-33a9-4bcc-b441-95fefabcbd37/17ae97e4-b4f9-406c-b277-104342f15cd8/ |
344 KB 344 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
p-8298c877.js
unpkg.com/ionicons@4.5.10-0/dist/ionicons/ |
9 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
p-mmsoqnpp.entry.js
unpkg.com/ionicons@4.5.10-0/dist/ionicons/ |
3 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
p-96c8fdf3.js
unpkg.com/ionicons@4.5.10-0/dist/ionicons/ |
876 B 615 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
md-send.svg
unpkg.com/ionicons@4.5.10-0/dist/ionicons/svg/ |
129 B 242 B |
Fetch
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Netflix (Online)13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| __sc_import_ionicons object| Ionicons0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31556952 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
assets.nflxext.com
ftnt.github.io
occ-0-1193-116.1.nflxso.net
unpkg.com
179.6.123.2
185.199.108.153
2606:4700::6810:7aaf
2606:4700::6810:7eaf
2a00:86c0:2090::1
00480ed606988d8870d095c6ca94303089b007f561f6c689cce63b7415046925
332c6aff81fb5b2a0e794983eb17b38d3981301e8fa26c5ba886c2f1f852823a
4125ae559e0da7328d29f352b1862f324b45bf76382fcc1822783604bc039651
46b0c85d3e060b00c77a3db7375f4b17a4542fe2eb75423ba2d371dbc6a43740
49099022970ab4def0b337fd7306cf556e7257e18b24d0c26ae517911af181e1
492fdebd363e40cbba153a244bcfe2a7f5f7cf20aff0805fe45d5c7e2180b875
5081d6ffa69ffadd985dab5178252591c0a52e66877faff5aa2b5fc03ef494bc
699ac9ad9077ecfe3516c3de359003ac44bec3c49044e4de5dbcb739a479b3cb
81cf64888a7b3f6848b09695b034026d9ad685665b91d54597ecbb6197c6acbb
9cedeb89cfa0165d090b8ba6a628bed74aea14be4f2fba10d0e042397755874d
9d1825e0615847e48f3bdeaa5ef14f4543c84baa63e1b9be378aa120ac151a90
a1a74b6c734f90478bd9888935e8744944e97817910e3cb05d65cd36c5afa203
a35f46ad592ea1a92b8db9030514f46386c9de205849c6155dfeb62b2cb69a6b
b68ea2c7bea397aa11fadb189ce7d83862baebaf03ece643eb5aa9fb5f755056