www.pamer.edu.pe Open in urlscan Pro
2606:4700:20::6819:1604  Malicious Activity! Public Scan

URL: https://www.pamer.edu.pe/EncuestaDoc/room/logging.php?country.x=en&locale.x=_
Submission: On March 11 via manual from BR

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 10 HTTP transactions. The main IP is 2606:4700:20::6819:1604, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is www.pamer.edu.pe.
TLS certificate: Issued by COMODO ECC Domain Validation Secure S... on March 11th 2019. Valid for: 6 months.
This is the only time www.pamer.edu.pe was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

IP Address AS Autonomous System
7 2606:4700:20:... 13335 (CLOUDFLAR...)
3 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
10 2
Apex Domain
Subdomains
Transfer
7 pamer.edu.pe
www.pamer.edu.pe
89 KB
3 nflxext.com
assets.nflxext.com
348 KB
10 2
Domain Requested by
7 www.pamer.edu.pe www.pamer.edu.pe
3 assets.nflxext.com www.pamer.edu.pe
10 2

This site contains no links.

Subject Issuer Validity Valid
ssl382090.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2
2019-03-11 -
2019-09-17
6 months crt.sh
assets.nflxext.com
DigiCert SHA2 Secure Server CA
2018-03-09 -
2020-03-09
2 years crt.sh

This page contains 1 frames:

Primary Page: https://www.pamer.edu.pe/EncuestaDoc/room/logging.php?country.x=en&locale.x=_
Frame ID: A3683D3679A6B0E2BCD8555E9430B223
Requests: 10 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i

Overall confidence: 100%
Detected patterns
  • headers server /cloudflare/i

Page Statistics

10
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

437 kB
Transfer

700 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request logging.php
www.pamer.edu.pe/EncuestaDoc/room/
61 KB
16 KB
Document
General
Full URL
https://www.pamer.edu.pe/EncuestaDoc/room/logging.php?country.x=en&locale.x=_
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6819:1604 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / PHP/5.5.38
Resource Hash
56051e3c2086f95afa1a7357702399f1979a721a8d350a9f83af5b65c44187a4

Request headers

:method
GET
:authority
www.pamer.edu.pe
:scheme
https
:path
/EncuestaDoc/room/logging.php?country.x=en&locale.x=_
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
200
date
Mon, 11 Mar 2019 23:52:17 GMT
content-type
text/html
set-cookie
__cfduid=dc26af70959ee746983058e0e0be3781c1552348336; expires=Tue, 10-Mar-20 23:52:16 GMT; path=/; domain=.pamer.edu.pe; HttpOnly
x-powered-by
PHP/5.5.38
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
4b6170edde446355-FRA
content-encoding
br
WebsiteDetect.txt
www.pamer.edu.pe/EncuestaDoc/room/login/
0
0
Stylesheet
General
Full URL
https://www.pamer.edu.pe/EncuestaDoc/room/login/WebsiteDetect.txt
Requested by
Host: www.pamer.edu.pe
URL: https://www.pamer.edu.pe/EncuestaDoc/room/logging.php?country.x=en&locale.x=_
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6819:1604 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

:path
/EncuestaDoc/room/login/WebsiteDetect.txt
pragma
no-cache
cookie
__cfduid=dc26af70959ee746983058e0e0be3781c1552348336
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/css,*/*;q=0.1
cache-control
no-cache
:authority
www.pamer.edu.pe
referer
https://www.pamer.edu.pe/EncuestaDoc/room/logging.php?country.x=en&locale.x=_
:scheme
https
:method
GET
Referer
https://www.pamer.edu.pe/EncuestaDoc/room/logging.php?country.x=en&locale.x=_
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
404
date
Mon, 11 Mar 2019 23:52:19 GMT
content-encoding
br
server
cloudflare
cf-ray
4b6170fc5c906355-FRA
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type
text/html
sdk.js
www.pamer.edu.pe/EncuestaDoc/room/login/
194 KB
57 KB
Script
General
Full URL
https://www.pamer.edu.pe/EncuestaDoc/room/login/sdk.js
Requested by
Host: www.pamer.edu.pe
URL: https://www.pamer.edu.pe/EncuestaDoc/room/logging.php?country.x=en&locale.x=_
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6819:1604 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
a138b4e66c63a4446aebb2b8bb2e56912d415eb9cef60a38e6e77a7d580520a5

Request headers

:path
/EncuestaDoc/room/login/sdk.js
pragma
no-cache
cookie
__cfduid=dc26af70959ee746983058e0e0be3781c1552348336
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.pamer.edu.pe
referer
https://www.pamer.edu.pe/EncuestaDoc/room/logging.php?country.x=en&locale.x=_
:scheme
https
:method
GET
Referer
https://www.pamer.edu.pe/EncuestaDoc/room/logging.php?country.x=en&locale.x=_
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 23:52:18 GMT
content-encoding
br
cf-cache-status
UPDATING
last-modified
Sun, 10 Mar 2019 18:53:13 GMT
server
cloudflare
etag
W/"3d600c-3074f-583c1f7ceb840"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=14400
cf-ray
4b6170fc5c926355-FRA
expires
Tue, 12 Mar 2019 03:52:18 GMT
none.css
www.pamer.edu.pe/EncuestaDoc/room/login/
97 KB
14 KB
Stylesheet
General
Full URL
https://www.pamer.edu.pe/EncuestaDoc/room/login/none.css
Requested by
Host: www.pamer.edu.pe
URL: https://www.pamer.edu.pe/EncuestaDoc/room/logging.php?country.x=en&locale.x=_
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6819:1604 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f4d7198a81278e3e68b91177e461f9f5e190fd3658ca88fc780d1a4b5eea9587

Request headers

:path
/EncuestaDoc/room/login/none.css
pragma
no-cache
cookie
__cfduid=dc26af70959ee746983058e0e0be3781c1552348336
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/css,*/*;q=0.1
cache-control
no-cache
:authority
www.pamer.edu.pe
referer
https://www.pamer.edu.pe/EncuestaDoc/room/logging.php?country.x=en&locale.x=_
:scheme
https
:method
GET
Referer
https://www.pamer.edu.pe/EncuestaDoc/room/logging.php?country.x=en&locale.x=_
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 23:52:18 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 11 Mar 2019 17:27:45 GMT
server
cloudflare
etag
W/"3d600b-18358-583d4e3ff0640"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
public, max-age=14400
cf-polished
origSize=99160
cf-bgj
minify
cf-ray
4b6170fc5c916355-FRA
expires
Tue, 12 Mar 2019 03:52:18 GMT
FB-f-Logo__blue_57.png
www.pamer.edu.pe/EncuestaDoc/room/login/
1 KB
2 KB
Image
General
Full URL
https://www.pamer.edu.pe/EncuestaDoc/room/login/FB-f-Logo__blue_57.png
Requested by
Host: www.pamer.edu.pe
URL: https://www.pamer.edu.pe/EncuestaDoc/room/logging.php?country.x=en&locale.x=_
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6819:1604 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece

Request headers

:path
/EncuestaDoc/room/login/FB-f-Logo__blue_57.png
pragma
no-cache
cookie
__cfduid=dc26af70959ee746983058e0e0be3781c1552348336
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
www.pamer.edu.pe
referer
https://www.pamer.edu.pe/EncuestaDoc/room/logging.php?country.x=en&locale.x=_
:scheme
https
:method
GET
Referer
https://www.pamer.edu.pe/EncuestaDoc/room/logging.php?country.x=en&locale.x=_
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 23:52:18 GMT
cf-cache-status
UPDATING
last-modified
Sun, 10 Mar 2019 18:53:13 GMT
server
cloudflare
etag
"3d6008-5af-583c1f7ceb840"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
4b6170fc5c936355-FRA
content-length
1455
expires
Tue, 12 Mar 2019 03:52:18 GMT
WebsiteDetect
www.pamer.edu.pe/ichnaea/cl2/freeform/
2 B
66 B
XHR
General
Full URL
https://www.pamer.edu.pe/ichnaea/cl2/freeform/WebsiteDetect?source=wwwhead&fetchType=js
Requested by
Host: www.pamer.edu.pe
URL: https://www.pamer.edu.pe/EncuestaDoc/room/logging.php?country.x=en&locale.x=_
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6819:1604 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
75a11da44c802486bc6f65640aa48a730f0f684c5c07a42ba3cd1735eb3fb070

Request headers

:path
/ichnaea/cl2/freeform/WebsiteDetect?source=wwwhead&fetchType=js
pragma
no-cache
cookie
__cfduid=dc26af70959ee746983058e0e0be3781c1552348336
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.pamer.edu.pe
referer
https://www.pamer.edu.pe/EncuestaDoc/room/logging.php?country.x=en&locale.x=_
:scheme
https
:method
GET
Referer
https://www.pamer.edu.pe/EncuestaDoc/room/logging.php?country.x=en&locale.x=_
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
404
date
Mon, 11 Mar 2019 23:52:19 GMT
content-encoding
br
server
cloudflare
cf-ray
4b6170ff2dc36355-FRA
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type
text/html
WebsiteScreen
www.pamer.edu.pe/ichnaea/cl2/freeform/
2 B
66 B
XHR
General
Full URL
https://www.pamer.edu.pe/ichnaea/cl2/freeform/WebsiteScreen?source=wwwhead&fetchType=js&winw=1600&winh=1200&screenw=1600&screenh=1200&ratio=1
Requested by
Host: www.pamer.edu.pe
URL: https://www.pamer.edu.pe/EncuestaDoc/room/logging.php?country.x=en&locale.x=_
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6819:1604 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
75a11da44c802486bc6f65640aa48a730f0f684c5c07a42ba3cd1735eb3fb070

Request headers

:path
/ichnaea/cl2/freeform/WebsiteScreen?source=wwwhead&fetchType=js&winw=1600&winh=1200&screenw=1600&screenh=1200&ratio=1
pragma
no-cache
cookie
__cfduid=dc26af70959ee746983058e0e0be3781c1552348336
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.pamer.edu.pe
referer
https://www.pamer.edu.pe/EncuestaDoc/room/logging.php?country.x=en&locale.x=_
:scheme
https
:method
GET
Referer
https://www.pamer.edu.pe/EncuestaDoc/room/logging.php?country.x=en&locale.x=_
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
404
date
Mon, 11 Mar 2019 23:52:19 GMT
content-encoding
br
server
cloudflare
cf-ray
4b6170ff2dc46355-FRA
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type
text/html
login-the-crown_2-1500x1000.jpg
assets.nflxext.com/ffe/siteui/acquisition/login/
84 KB
85 KB
Image
General
Full URL
https://assets.nflxext.com/ffe/siteui/acquisition/login/login-the-crown_2-1500x1000.jpg
Requested by
Host: www.pamer.edu.pe
URL: https://www.pamer.edu.pe/EncuestaDoc/room/logging.php?country.x=en&locale.x=_
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:286::33c4 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
Apache /
Resource Hash
baafd74a4cb4dc594b614eeb45c7267bb1af729d9271752460348ece16532d04

Request headers

Referer
https://www.pamer.edu.pe/EncuestaDoc/room/login/none.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 23:52:19 GMT
last-modified
Mon, 24 Oct 2016 20:49:51 GMT
server
Apache
content-md5
5GY/BZWwL7HDlH/B8V64Eg==
content-type
image/jpeg
status
200
cache-control
public, max-age=34632461
accept-ranges
bytes
content-length
86226
expires
Wed, 15 Apr 2020 20:00:00 GMT
FR-en-20190107-popsignuptwoweeks-perspective_alpha_website_medium.jpg
assets.nflxext.com/ffe/siteui/vlv3/faece66f-91c3-4323-a7ed-e623d8343fca/3e8bfe2e-a0b7-43d9-86dd-316c7b49e7dd/
206 KB
206 KB
Image
General
Full URL
https://assets.nflxext.com/ffe/siteui/vlv3/faece66f-91c3-4323-a7ed-e623d8343fca/3e8bfe2e-a0b7-43d9-86dd-316c7b49e7dd/FR-en-20190107-popsignuptwoweeks-perspective_alpha_website_medium.jpg
Requested by
Host: www.pamer.edu.pe
URL: https://www.pamer.edu.pe/EncuestaDoc/room/logging.php?country.x=en&locale.x=_
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:286::33c4 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
Apache /
Resource Hash
2c391e9bb3f670df366c6be4cd84110081bd7ed4f93cb730574157f0851bd2a4

Request headers

Referer
https://www.pamer.edu.pe/EncuestaDoc/room/login/none.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 11 Mar 2019 23:52:19 GMT
last-modified
Wed, 09 Jan 2019 14:19:59 GMT
server
Apache
content-md5
TlO1QY9r/7FGfkwcOojF/g==
content-type
image/jpeg
status
200
cache-control
public, max-age=34632461
accept-ranges
bytes
content-length
210518
expires
Wed, 15 Apr 2020 20:00:00 GMT
nf-icon-v1-86.woff
assets.nflxext.com/ffe/siteui/fonts/
57 KB
57 KB
Font
General
Full URL
https://assets.nflxext.com/ffe/siteui/fonts/nf-icon-v1-86.woff
Requested by
Host: www.pamer.edu.pe
URL: https://www.pamer.edu.pe/EncuestaDoc/room/logging.php?country.x=en&locale.x=_
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:286::33c4 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
Apache /
Resource Hash
c58f7fa76b1c75c769ed1097053fee521fa60d296515a336421e8e4beae76121

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.pamer.edu.pe/EncuestaDoc/room/login/none.css
Origin
https://www.pamer.edu.pe

Response headers

date
Mon, 11 Mar 2019 23:52:19 GMT
last-modified
Wed, 02 Nov 2016 20:33:27 GMT
server
Apache
content-md5
riowD7d84eKrPQkwjAZqAA==
access-control-allow-origin
*
content-type
font/woff
status
200
cache-control
public, max-age=34632461
accept-ranges
bytes
content-length
58416
expires
Wed, 15 Apr 2020 20:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| w37e40734bb string| k object| FB object| netflix

1 Cookies

Domain/Path Name / Value
.pamer.edu.pe/ Name: __cfduid
Value: dc26af70959ee746983058e0e0be3781c1552348336