dfdsgsdfhg.com Open in urlscan Pro
2606:4700:3030::6815:47eb Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://dfdsgsdfhg.com/jp
Effective URL:
https://dfdsgsdfhg.com/jp/login
Submission Tags: phishing netflix Search All
Submission: On January 31 via api (January 31st 2021, 11:19:33 am UTC) from JP

Summary HTTP 13 Redirects Links 9 Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 4 domains to perform 13 HTTP transactions. The main IP is 2606:4700:3030::6815:47eb, located in United States and belongs to CLOUDFLARENET, US. The main domain is dfdsgsdfhg.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on January 31st 2021. Valid for: a year.

This is the only time dfdsgsdfhg.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

	IP Address	AS Autonomous System
2 9	2606:4700:303... 2606:4700:3030::6815:47eb	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2a00:86c0:209... 2a00:86c0:2090::1	40027 (NETFLIX-ASN) (NETFLIX-ASN)
1	2a00:1450:400... 2a00:1450:4001:824::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:827::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80e::2004	15169 (GOOGLE) (GOOGLE)
13	5

9 2606:4700:3030::6815:47eb (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

dfdsgsdfhg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:86c0:2090::1 (United Kingdom)

ASN40027 (NETFLIX-ASN, US)

assets.nflxext.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:824::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	dfdsgsdfhg.com 2 redirects dfdsgsdfhg.com	297 KB
3	nflxext.com assets.nflxext.com	416 KB
2	google.com www.google.com	773 B
1	gstatic.com www.gstatic.com	130 KB
13	4

	Domain	Requested by
9	dfdsgsdfhg.com	2 redirects dfdsgsdfhg.com
3	assets.nflxext.com	dfdsgsdfhg.com
2	www.google.com	dfdsgsdfhg.com www.gstatic.com
1	www.gstatic.com	www.google.com
13	4

This site contains links to these domains. Also see Links.

Domain
policies.google.com
help.netflix.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-01-31` - `2022-01-30`	a year	crt.sh
*.1.nflxso.net DigiCert SHA2 Secure Server CA	`2021-01-23` - `2021-02-23`	a month	crt.sh
www.google.com GTS CA 1O1	`2021-01-05` - `2021-03-30`	3 months	crt.sh
*.gstatic.com GTS CA 1O1	`2021-01-05` - `2021-03-30`	3 months	crt.sh
*.google.com GTS CA 1O1	`2021-01-05` - `2021-03-30`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://dfdsgsdfhg.com/jp/login
Frame ID: 139B67B18C508690F7CD778550ED762C
Requests: 12 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/enterprise/anchor?ar=1&k=6Lf8hrcUAAAAAIpQAFW2VFjtiYnThOjZOA5xvLyR&co=aHR0cHM6Ly9kZmRzZ3NkZmhnLmNvbTo0NDM.&hl=en&v=-nejAZ5my6jV0Fbx9re8ChMK&size=invisible&cb=hce7k0pyduil
Frame ID: FD68E084474A2F893F48CBDB355E2E78
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://dfdsgsdfhg.com/jp HTTP 301
https://dfdsgsdfhg.com/jp/ HTTP 302
https://dfdsgsdfhg.com/jp/login Page URL

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

13
Requests

100 %
HTTPS

100 %
IPv6

4
Domains

4
Subdomains

5
IPs

3
Countries

842 kB
Transfer

1992 kB
Size

3
Cookies

9 Outgoing links

These are links going to different origins than the main page.

URL: https://policies.google.com/privacy
Title: プライバシーポリシー

Search URL Search Domain Scan URL

URL: https://policies.google.com/terms
Title: 利用規約

Search URL Search Domain Scan URL

URL: https://help.netflix.com/support/412
Title: よくあるご質問

Search URL Search Domain Scan URL

URL: https://help.netflix.com/
Title: ヘルプセンター

Search URL Search Domain Scan URL

URL: https://help.netflix.com/legal/termsofuse
Title: 利用規約

Search URL Search Domain Scan URL

URL: https://help.netflix.com/legal/privacy
Title: プライバシー

Search URL Search Domain Scan URL

URL: https://help.netflix.com/legal/privacy#cookies
Title: Cookieの設定

Search URL Search Domain Scan URL

URL: https://help.netflix.com/legal/corpinfo
Title: Netflix企業情報

Search URL Search Domain Scan URL

URL: https://help.netflix.com/legal/jacommercialtransaction
Title: 特定商取引法に基づく表示

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://dfdsgsdfhg.com/jp HTTP 301
https://dfdsgsdfhg.com/jp/ HTTP 302
https://dfdsgsdfhg.com/jp/login Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request login Show response
dfdsgsdfhg.com/jp/
Redirect Chain

https://dfdsgsdfhg.com/jp
https://dfdsgsdfhg.com/jp/
https://dfdsgsdfhg.com/jp/login

243 KB
37 KB

2135ms
2134ms

Document
text/html

2606:4700:3030::6815:47eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dfdsgsdfhg.com/jp/login
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::6815:47eb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 0942e2f00e8beb32a1024324de0dd6c6ed36a7184e0dafb0888920b2f80be7ba

Request headers

:method: GET
:authority: dfdsgsdfhg.com
:scheme: https
:path: /jp/login
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: __cfduid=da48ff969457c85f0f11e2b1750d10f641612091946; mercar:sid=s%3A471a30ed-77f3-47dc-9698-32638134056e.8QJdsN2zEWCDqHaW3fIU0j0IX50afXJnvoUYkVVX3aY
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 31 Jan 2021 11:19:09 GMT
content-type: text/html; charset=utf-8
x-powered-by: Express
cf-cache-status: DYNAMIC
cf-request-id: 07f9c411550000061ca83db000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Q45cPFcqpCaqYJrVrKHPxdadBL5kqehPfqw2NSDhbALePhwkwKegJzTqUAfTLnFvT8qIibnRKNKIVybjmdPyLOpk0SGhrUrPduge8ecFGBKxpE8uEnnVWkme5Q%3D%3D"}]}
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 61a3092eef7a061c-FRA
content-encoding: br

Redirect headers

date: Sun, 31 Jan 2021 11:19:07 GMT
content-type: text/html; charset=utf-8
x-powered-by: Express
location: /jp/login
vary: Accept
cf-cache-status: DYNAMIC
cf-request-id: 07f9c40fdd0000061c8dac3000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=g57PH2DcuGz%2BBAi4TrO1AeOvNKGku3llCY93eYVqU2rQm51PGos3cv2avXwwG2%2FwyDo4GMr5narDinKFIRyXkBBRReQYqGhnE%2FwGlrt4vfk9l9gmI7x44hClYQ%3D%3D"}]}
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 61a3092c987e061c-FRA

GET
H2 200 bootstrap.js Show response
dfdsgsdfhg.com/jp/ 9 KB
4 KB 486ms
485ms Script
application/javascript 2606:4700:3030::6815:47eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dfdsgsdfhg.com/jp/bootstrap.js
Requested by: Host: dfdsgsdfhg.com
URL: https://dfdsgsdfhg.com/jp/login
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::6815:47eb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 2143c594d7870b719f176b8d42afd32e44ef388a839ae8294563cfb33598f02c

Request headers

Referer: https://dfdsgsdfhg.com/jp/login
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 31 Jan 2021 11:19:09 GMT
content-encoding: br
etag: W/"2410-1775794aa88"
cf-cache-status: MISS
last-modified: Sun, 31 Jan 2021 08:34:56 GMT
server: cloudflare
x-powered-by: Express
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=3FBCS2QL5nlfR4rGcwg84hXdfGPWTojDSjKpWvKRhpqZOU5d%2BWY9S%2FcJ1CHoMHD%2F5Np04QG%2FX30B63jGn%2BfSt%2BWD0a8b%2F8dwhFQclVCh%2FAv9oxLRC1%2Fg5H%2FQRA%3D%3D"}]}
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=14400
nel: {"report_to":"cf-nel","max_age":604800}
cf-ray: 61a3093c5a9a061c-FRA
cf-request-id: 07f9c419b30000061cf5a4b000000001

GET
H2 200 loginControllerClient.js Show response
dfdsgsdfhg.com/jp/ 851 KB
234 KB 2007ms
2006ms Script
application/javascript 2606:4700:3030::6815:47eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dfdsgsdfhg.com/jp/loginControllerClient.js
Requested by: Host: dfdsgsdfhg.com
URL: https://dfdsgsdfhg.com/jp/login
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::6815:47eb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: a6898940973923d8c5c6df507b106834784b2207da844b3c7d5c779c0de64f2f

Request headers

Referer: https://dfdsgsdfhg.com/jp/login
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 31 Jan 2021 11:19:11 GMT
content-encoding: br
etag: W/"d4a1f-1775794aa8d"
cf-cache-status: MISS
last-modified: Sun, 31 Jan 2021 08:34:56 GMT
server: cloudflare
x-powered-by: Express
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=2ShMNxVTFGxcRl5j%2B%2FpoZjZ7WEibu6Off%2BjhCfb8KtUFjlVBMRBZ7rYqDWfLymeszDHeOGCaGSR3l5rJZk%2F2AW0LkEfWV%2F5UcOXQpmz66Ds0DCf7dx9VUKSO0g%3D%3D"}]}
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=14400
nel: {"report_to":"cf-nel","max_age":604800}
cf-ray: 61a3093c5a9d061c-FRA
cf-request-id: 07f9c419b30000061cfc05a000000001

GET
H2 200 error-page.css
dfdsgsdfhg.com/jp/ 11 KB
2 KB 522ms
521ms Stylesheet
text/css 2606:4700:3030::6815:47eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dfdsgsdfhg.com/jp/error-page.css
Requested by: Host: dfdsgsdfhg.com
URL: https://dfdsgsdfhg.com/jp/login
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::6815:47eb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: d9bac1aefff045998fd064ed279defcd96c37a53ee0ee3816d1ebab19c1ff739

Request headers

Referer: https://dfdsgsdfhg.com/jp/login
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 31 Jan 2021 11:19:10 GMT
content-encoding: br
etag: W/"2d14-1775794aa88"
cf-cache-status: MISS
last-modified: Sun, 31 Jan 2021 08:34:56 GMT
server: cloudflare
x-powered-by: Express
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=VfI1C6IGzp2k4%2BAMFCehYJKbgJcQhmuRZ1PlTDLHtEvRm7wC8Ktv5gFkQ%2FfLxY2LR8x40ubJ9D%2BshlDfKyCVyc2TC5elr4A6OYSU%2BTKCR4Nw9SHhzKNIkk7WLA%3D%3D"}]}
content-type: text/css; charset=UTF-8
cache-control: public, max-age=14400
nel: {"report_to":"cf-nel","max_age":604800}
cf-ray: 61a3093c5a9e061c-FRA
cf-request-id: 07f9c419b40000061ca39cc000000001

GET
H2 200 login.css
dfdsgsdfhg.com/jp/ 131 KB
18 KB 1179ms
1179ms Stylesheet
text/css 2606:4700:3030::6815:47eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dfdsgsdfhg.com/jp/login.css
Requested by: Host: dfdsgsdfhg.com
URL: https://dfdsgsdfhg.com/jp/login
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::6815:47eb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 6602cddb83ec3ccfe1ab70ebb54df782a0bb02698a1f536dd7703555cbdd2dab

Request headers

Referer: https://dfdsgsdfhg.com/jp/login
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 31 Jan 2021 11:19:10 GMT
content-encoding: br
etag: W/"20d91-1775794aa89"
cf-cache-status: MISS
last-modified: Sun, 31 Jan 2021 08:34:56 GMT
server: cloudflare
x-powered-by: Express
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=jiHMFnsF40hqQ4KRZI492If1hjIhxVnOqiFnrvuDHdqkgGslI%2F3CTUl00LxmukNB%2Fb2N7FjNNMLLZ62m9MTrBXOnAs83a%2Bp%2BRTN8k%2Bovg%2FtOyx%2BMRjJUB2pBRw%3D%3D"}]}
content-type: text/css; charset=UTF-8
cache-control: public, max-age=14400
nel: {"report_to":"cf-nel","max_age":604800}
cf-ray: 61a3093c5a9f061c-FRA
cf-request-id: 07f9c419b30000061c9706c000000001

GET
H/1.1 200
OK JP-ja-20210125-popsignuptwoweeks-perspective_alpha_website_large.jpg
assets.nflxext.com/ffe/siteui/vlv3/757ab38f-5d08-40bc-b3eb-eaba63ed8203/346b6add-f5fd-44bb-a085-f3a86b7ea5d8/ 342 KB
342 KB 122ms
102ms Image
image/jpeg 2a00:86c0:2090::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.nflxext.com/ffe/siteui/vlv3/757ab38f-5d08-40bc-b3eb-eaba63ed8203/346b6add-f5fd-44bb-a085-f3a86b7ea5d8/JP-ja-20210125-popsignuptwoweeks-perspective_alpha_website_large.jpg
Requested by: Host: dfdsgsdfhg.com
URL: https://dfdsgsdfhg.com/jp/login
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:86c0:2090::1 , United Kingdom, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 47179276a8589cf15812d7a1423699dac89efa8fad16defc7e076b464dbd5cec

Request headers

Referer: https://dfdsgsdfhg.com/jp/login
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 31 Jan 2021 11:19:10 GMT
Last-Modified: Wed, 27 Jan 2021 14:07:43 GMT
Server: nginx
Content-MD5: 5p2TDgHk6f85o6FnA6T9Kg==
Content-Type: image/jpeg
Cache-Control: public, max-age=12724
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 350280
Expires: Sun, 31 Jan 2021 14:51:14 GMT

GET
H/1.1 200
OK FB-f-Logo__blue_57.png
assets.nflxext.com/ffe/siteui/login/images/ 1 KB
2 KB 30ms
11ms Image
image/png 2a00:86c0:2090::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.nflxext.com/ffe/siteui/login/images/FB-f-Logo__blue_57.png
Requested by: Host: dfdsgsdfhg.com
URL: https://dfdsgsdfhg.com/jp/login
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:86c0:2090::1 , United Kingdom, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece

Request headers

Referer: https://dfdsgsdfhg.com/jp/login
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 31 Jan 2021 11:19:10 GMT
Last-Modified: Thu, 30 Jun 2016 17:48:49 GMT
Server: nginx
Content-MD5: ozykfvEQtuPsUIa4d2QH0w==
Content-Type: image/png
Cache-Control: public, max-age=12690
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1455
Expires: Tue, 25 Aug 2020 12:33:32 GMT

GET
H/1.1 200
OK nf-icon-v1-93.woff
assets.nflxext.com/ffe/siteui/fonts/ 72 KB
72 KB 32ms
8ms Font
application/octet-stream 2a00:86c0:2090::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.nflxext.com/ffe/siteui/fonts/nf-icon-v1-93.woff
Requested by: Host: dfdsgsdfhg.com
URL: https://dfdsgsdfhg.com/jp/login.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:86c0:2090::1 , United Kingdom, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d

Request headers

Origin: https://dfdsgsdfhg.com
Referer: https://dfdsgsdfhg.com/jp/login.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 31 Jan 2021 11:19:10 GMT
Content-Encoding: gzip
Last-Modified: Mon, 29 Jan 2018 01:50:51 GMT
Server: nginx
Content-MD5: fPYVbMSBJEtaJUNi17c/AA==
Content-Type: text/plain
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=8000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 73566
Expires: Wed, 26 Aug 2020 06:48:41 GMT

GET
H2 200 enterprise.js Show response
www.google.com/recaptcha/ 974 B
773 B 29ms
29ms Script
text/javascript 2a00:1450:4001:824::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/enterprise.js?render=6Lf8hrcUAAAAAIpQAFW2VFjtiYnThOjZOA5xvLyR

Requested by

Host: dfdsgsdfhg.com
URL: https://dfdsgsdfhg.com/jp/loginControllerClient.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

78617867422f062cbfd8c50b52feb0f9018d09492c7f18577a5466a1038d71e1

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://dfdsgsdfhg.com/jp/login
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 31 Jan 2021 11:19:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-security-policy: frame-ancestors 'self'
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 614
x-xss-protection: 1; mode=block
expires: Sun, 31 Jan 2021 11:19:12 GMT

POST
H2 200 log Show response
dfdsgsdfhg.com/personalization/ 2 B
485 B 198ms
197ms XHR
text/plain 2606:4700:3030::6815:47eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dfdsgsdfhg.com/personalization/log
Requested by: Host: dfdsgsdfhg.com
URL: https://dfdsgsdfhg.com/jp/loginControllerClient.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::6815:47eb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Accept: */*
Referer: https://dfdsgsdfhg.com/jp/login
X-Netflix.ichnaea.request.type: UiRequest
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json

Response headers

date: Sun, 31 Jan 2021 11:19:12 GMT
etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
cf-cache-status: DYNAMIC
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=w4gyw%2F7GE08J2tzXRYXaiEencCRywl3hj5d74ifYx%2F18qxoRrdfcBW%2FquTv%2FUOy21QRkwtPR0XKr6swNdpm5QKyzJ87W52hJACtCa7c2yh66nVhDTCEqKjtNbw%3D%3D"}]}
content-type: text/plain; charset=utf-8
cf-ray: 61a3094d0d96061c-FRA
content-length: 2
cf-request-id: 07f9c424250000061ca503c000000001

GET
H2 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/-nejAZ5my6jV0Fbx9re8ChMK/ 331 KB
130 KB 25ms
6ms Script
text/javascript 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/-nejAZ5my6jV0Fbx9re8ChMK/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/enterprise.js?render=6Lf8hrcUAAAAAIpQAFW2VFjtiYnThOjZOA5xvLyR

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ded038181a2e72755fc4c0d57ec9e45725629888a038328e238ab07cdb8e8e11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://dfdsgsdfhg.com
Referer: https://dfdsgsdfhg.com/jp/login
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 31 Jan 2021 10:20:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3541
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 132160
x-xss-protection: 0
last-modified: Mon, 25 Jan 2021 05:07:21 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 31 Jan 2022 10:20:11 GMT

GET
H3-Q050 200 anchor
www.google.com/recaptcha/enterprise/ Frame FD68 0
0 44ms
30ms Document
text/html 2a00:1450:4001:80e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/enterprise/anchor?ar=1&k=6Lf8hrcUAAAAAIpQAFW2VFjtiYnThOjZOA5xvLyR&co=aHR0cHM6Ly9kZmRzZ3NkZmhnLmNvbTo0NDM.&hl=en&v=-nejAZ5my6jV0Fbx9re8ChMK&size=invisible&cb=hce7k0pyduil

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/-nejAZ5my6jV0Fbx9re8ChMK/recaptcha__en.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-ZgRJvHx9mOkxQabgiM0w5w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/enterprise/anchor?ar=1&k=6Lf8hrcUAAAAAIpQAFW2VFjtiYnThOjZOA5xvLyR&co=aHR0cHM6Ly9kZmRzZ3NkZmhnLmNvbTo0NDM.&hl=en&v=-nejAZ5my6jV0Fbx9re8ChMK&size=invisible&cb=hce7k0pyduil
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://dfdsgsdfhg.com/jp/login
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://dfdsgsdfhg.com/jp/login

Response headers

content-security-policy: script-src 'report-sample' 'nonce-ZgRJvHx9mOkxQabgiM0w5w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
content-encoding: gzip
date: Sun, 31 Jan 2021 11:19:12 GMT
expires: Sun, 31 Jan 2021 11:19:12 GMT
cache-control: private, max-age=0
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 1054
server: GSE
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 cl2 Show response
dfdsgsdfhg.com/personalization/ 2 B
507 B 377ms
376ms XHR
text/plain 2606:4700:3030::6815:47eb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dfdsgsdfhg.com/personalization/cl2
Requested by: Host: dfdsgsdfhg.com
URL: https://dfdsgsdfhg.com/jp/loginControllerClient.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::6815:47eb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer: https://dfdsgsdfhg.com/jp/login
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
X-Netflix.Client.Request.Name: ui/cl
Content-Type: application/json

Response headers

date: Sun, 31 Jan 2021 11:19:17 GMT
etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
cf-cache-status: DYNAMIC
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=56zN2haags2%2B3M9QzGwUdMJWNdYXvMGqjR8rUBzeABPkcxWnTBvwynYKV1gwBYHggqf3Hg%2FhQcuD4Wnt%2BbbVgAmNr%2FqawIiBCvd20TrERtFIC6v5nlr3NXLK7w%3D%3D"}]}
content-type: text/plain; charset=utf-8
cf-ray: 61a3096bbcbf061c-FRA
content-length: 2
cf-request-id: 07f9c437520000061cf592b000000001

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

25 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.dfdsgsdfhg.com/	1969-12-31 23:59:59	Name: cL Value: 1612091952036%7C161209195221738562%7C161209195274049706%7C%7C4%7Cnull
dfdsgsdfhg.com/	1969-12-31 23:59:59	Name: mercar:sid Value: s%3A471a30ed-77f3-47dc-9698-32638134056e.8QJdsN2zEWCDqHaW3fIU0j0IX50afXJnvoUYkVVX3aY
.dfdsgsdfhg.com/	1970-01-19 16:31:23	Name: __cfduid Value: da48ff969457c85f0f11e2b1750d10f641612091946

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.nflxext.com
dfdsgsdfhg.com
www.google.com
www.gstatic.com
2606:4700:3030::6815:47eb
2a00:1450:4001:80e::2004
2a00:1450:4001:824::2004
2a00:1450:4001:827::2003
2a00:86c0:2090::1
0942e2f00e8beb32a1024324de0dd6c6ed36a7184e0dafb0888920b2f80be7ba
2143c594d7870b719f176b8d42afd32e44ef388a839ae8294563cfb33598f02c
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece
47179276a8589cf15812d7a1423699dac89efa8fad16defc7e076b464dbd5cec
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
6602cddb83ec3ccfe1ab70ebb54df782a0bb02698a1f536dd7703555cbdd2dab
78617867422f062cbfd8c50b52feb0f9018d09492c7f18577a5466a1038d71e1
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d
a6898940973923d8c5c6df507b106834784b2207da844b3c7d5c779c0de64f2f
d9bac1aefff045998fd064ed279defcd96c37a53ee0ee3816d1ebab19c1ff739
ded038181a2e72755fc4c0d57ec9e45725629888a038328e238ab07cdb8e8e11

dfdsgsdfhg.com Open in urlscan Pro 2606:4700:3030::6815:47eb Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

100 %IPv6

4 Domains

4 Subdomains

5 IPs

3 Countries

842 kBTransfer

1992 kBSize

3 Cookies

9 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

25 JavaScript Global Variables

3 Cookies

Indicators

dfdsgsdfhg.com Open in urlscan Pro
2606:4700:3030::6815:47eb Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

100 %
IPv6

4
Domains

4
Subdomains

5
IPs

3
Countries

842 kB
Transfer

1992 kB
Size

3
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!