demirsoft.com Open in urlscan Pro
92.42.33.44 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.bing.com/ck/a?!&&p=af1a84c1bda7afb2JmltdHM9MTcxNDM0ODgwMCZpZ3VpZD0zYzEzYTZiOC1iNThhLTZhNmUtMDQzYy1iMmQ2Yj...
Effective URL:
https://demirsoft.com/Netlfix/page_settings/login.php?home-US-userID987647864812334345484351818468-Email-3362662664184...
Submission: On April 30 via manual (April 30th 2024, 10:42:52 am UTC) from KW — Scanned from DE

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 3 countries across 4 domains to perform 10 HTTP transactions. The main IP is 92.42.33.44, located in Turkey and belongs to EUROTA-ASN EUROTA INTERNET SERVICES LTD, TR. The main domain is demirsoft.com.
TLS certificate: Issued by TrustSafe TLS RSA SubCA R1 on March 5th 2024. Valid for: a year.

This is the only time demirsoft.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	2a02:26f0:350... 2a02:26f0:3500:1b::1724:a39d	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3 3	204.16.1.151 204.16.1.151	262706 (Ultranet ...) (Ultranet Telecomunicacoes Ltda)
2 10	92.42.33.44 92.42.33.44	49467 (EUROTA-AS...) (EUROTA-ASN EUROTA INTERNET SERVICES LTD)
1	2a00:86c0:209... 2a00:86c0:2090::1	40027 (NETFLIX-ASN) (NETFLIX-ASN)
10	3

1 2a02:26f0:3500:1b::1724:a39d (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

www.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 204.16.1.151 (United States) 3 redirects

ASN262706 (Ultranet Telecomunicacoes Ltda, BR)
PTR: plesk02.braslink.com

fast-cut.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 92.42.33.44 (Turkey) 2 redirects

ASN49467 (EUROTA-ASN EUROTA INTERNET SERVICES LTD, TR)
PTR: static-92-42-33-44.inetmar.net

demirsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:86c0:2090::1 (United States)

ASN40027 (NETFLIX-ASN, US)

assets.nflxext.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	demirsoft.com 2 redirects demirsoft.com	261 KB
3	fast-cut.com 3 redirects fast-cut.com	686 B
1	nflxext.com assets.nflxext.com — Cisco Umbrella Rank: 5898	72 KB
1	bing.com www.bing.com — Cisco Umbrella Rank: 52	2 KB
10	4

	Domain	Requested by
10	demirsoft.com	2 redirects www.bing.com demirsoft.com
3	fast-cut.com	3 redirects
1	assets.nflxext.com	demirsoft.com
1	www.bing.com
10	4

This site contains no links.

Subject Issuer	Validity	Valid
r.bing.com Microsoft Azure ECC TLS Issuing CA 05	`2023-10-18` - `2024-06-27`	8 months	crt.sh
demirsoft.com TrustSafe TLS RSA SubCA R1	`2024-03-05` - `2025-03-05`	a year	crt.sh
*.1.nflxso.net DigiCert Secure Site ECC CA-1	`2024-04-19` - `2024-05-25`	a month	crt.sh

This page contains 1 frames:

Primary Page: https://demirsoft.com/Netlfix/page_settings/login.php?home-US-userID987647864812334345484351818468-Email-33626626641848798409874987049909840684980546840078965484/-second
Frame ID: 9501A9C818E355D0A9ABA38D3E5F1749
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Netflix

Page URL History Show full URLs

http://www.bing.com/ck/a?!&&p=af1a84c1bda7afb2JmltdHM9MTcxNDM0ODgwMCZpZ3VpZD0zYzEzYTZiOC1iNThhLT... HTTP 307
https://www.bing.com/ck/a?!&&p=af1a84c1bda7afb2JmltdHM9MTcxNDM0ODgwMCZpZ3VpZD0zYzEzYTZiOC1iNThhLT... Page URL
https://fast-cut.com/quem-somos/ HTTP 302
https://fast-cut.com/quem-somos/821e36f32d20823de8b8522d2e6aa7d8 HTTP 301
https://fast-cut.com/quem-somos/821e36f32d20823de8b8522d2e6aa7d8/ HTTP 302
https://demirsoft.com/Netlfix/page_settings HTTP 301
https://demirsoft.com/Netlfix/page_settings/ HTTP 302
https://demirsoft.com/Netlfix/page_settings/login.php?home-US-userID987647864812334345484351818468... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Modernizr (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

10
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

3
IPs

3
Countries

335 kB
Transfer

613 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.bing.com/ck/a?!&&p=af1a84c1bda7afb2JmltdHM9MTcxNDM0ODgwMCZpZ3VpZD0zYzEzYTZiOC1iNThhLTZhNmUtMDQzYy1iMmQ2YjRhMTZiYjQmaW5zaWQ9NTQ1NA&ptn=3&ver=2&hsh=3&fclid=3c13a6b8-b58a-6a6e-043c-b2d6b4a16bb4&u=a1aHR0cHM6Ly9mYXN0LWN1dC5jb20vcXVlbS1zb21vcy8&ntb=1 HTTP 307
https://www.bing.com/ck/a?!&&p=af1a84c1bda7afb2JmltdHM9MTcxNDM0ODgwMCZpZ3VpZD0zYzEzYTZiOC1iNThhLTZhNmUtMDQzYy1iMmQ2YjRhMTZiYjQmaW5zaWQ9NTQ1NA&ptn=3&ver=2&hsh=3&fclid=3c13a6b8-b58a-6a6e-043c-b2d6b4a16bb4&u=a1aHR0cHM6Ly9mYXN0LWN1dC5jb20vcXVlbS1zb21vcy8&ntb=1 Page URL
https://fast-cut.com/quem-somos/ HTTP 302
https://fast-cut.com/quem-somos/821e36f32d20823de8b8522d2e6aa7d8 HTTP 301
https://fast-cut.com/quem-somos/821e36f32d20823de8b8522d2e6aa7d8/ HTTP 302
https://demirsoft.com/Netlfix/page_settings HTTP 301
https://demirsoft.com/Netlfix/page_settings/ HTTP 302
https://demirsoft.com/Netlfix/page_settings/login.php?home-US-userID987647864812334345484351818468-Email-33626626641848798409874987049909840684980546840078965484/-second Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://www.bing.com/ck/a?!&&p=af1a84c1bda7afb2JmltdHM9MTcxNDM0ODgwMCZpZ3VpZD0zYzEzYTZiOC1iNThhLTZhNmUtMDQzYy1iMmQ2YjRhMTZiYjQmaW5zaWQ9NTQ1NA&ptn=3&ver=2&hsh=3&fclid=3c13a6b8-b58a-6a6e-043c-b2d6b4a16bb4&u=a1aHR0cHM6Ly9mYXN0LWN1dC5jb20vcXVlbS1zb21vcy8&ntb=1 HTTP 307
https://www.bing.com/ck/a?!&&p=af1a84c1bda7afb2JmltdHM9MTcxNDM0ODgwMCZpZ3VpZD0zYzEzYTZiOC1iNThhLTZhNmUtMDQzYy1iMmQ2YjRhMTZiYjQmaW5zaWQ9NTQ1NA&ptn=3&ver=2&hsh=3&fclid=3c13a6b8-b58a-6a6e-043c-b2d6b4a16bb4&u=a1aHR0cHM6Ly9mYXN0LWN1dC5jb20vcXVlbS1zb21vcy8&ntb=1

10 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	a Show response www.bing.com/ck/ Redirect Chain http://www.bing.com/ck/a?!&&p=af1a84c1bda7afb2JmltdHM9MTcxNDM0ODgwMCZpZ3VpZD0zYzEzYTZiOC1iNThhLTZhNmUtMDQzYy1iMmQ2YjRhMTZiYjQmaW5zaWQ9NTQ1NA&ptn=3&ver=2&hsh=3&fclid=3c13a6b8-b58a-6a6e-043c-b2d6b4a1... https://www.bing.com/ck/a?!&&p=af1a84c1bda7afb2JmltdHM9MTcxNDM0ODgwMCZpZ3VpZD0zYzEzYTZiOC1iNThhLTZhNmUtMDQzYy1iMmQ2YjRhMTZiYjQmaW5zaWQ9NTQ1NA&ptn=3&ver=2&hsh=3&fclid=3c13a6b8-b58a-6a6e-043c-b2d6b4a...	2 KB 2 KB	82ms 41ms	Document text/html	2a02:26f0:3500:1b::1724:a39d AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://www.bing.com/ck/a?!&&p=af1a84c1bda7afb2JmltdHM9MTcxNDM0ODgwMCZpZ3VpZD0zYzEzYTZiOC1iNThhLTZhNmUtMDQzYy1iMmQ2YjRhMTZiYjQmaW5zaWQ9NTQ1NA&ptn=3&ver=2&hsh=3&fclid=3c13a6b8-b58a-6a6e-043c-b2d6b4a16bb4&u=a1aHR0cHM6Ly9mYXN0LWN1dC5jb20vcXVlbS1zb21vcy8&ntb=1 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:1b::1724:a39d Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash `75185ff60671fff25c858e15fdcfb000c7ec9259a1420fa73bf66739e2a4de2a` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version access-control-allow-origin * alt-svc h3=":443"; ma=93600 cache-control no-cache, must-revalidate content-encoding gzip content-length 1183 content-type text/html; charset=UTF-8 date Tue, 30 Apr 2024 10:42:46 GMT expires Fri, 01 Jan 1990 00:00:00 GMT pragma no-cache vary Accept-Encoding x-cdn-traceid 0.9da12417.1714473766.6646246f x-msedge-ref Ref A: 25889F29C78C4A4E95B6D47D25D72193 Ref B: DUS30EDGE0316 Ref C: 2024-04-30T10:42:46Z Redirect headers Cross-Origin-Resource-Policy Cross-Origin Location https://www.bing.com/ck/a?!&&p=af1a84c1bda7afb2JmltdHM9MTcxNDM0ODgwMCZpZ3VpZD0zYzEzYTZiOC1iNThhLTZhNmUtMDQzYy1iMmQ2YjRhMTZiYjQmaW5zaWQ9NTQ1NA&ptn=3&ver=2&hsh=3&fclid=3c13a6b8-b58a-6a6e-043c-b2d6b4a16bb4&u=a1aHR0cHM6Ly9mYXN0LWN1dC5jb20vcXVlbS1zb21vcy8&ntb=1 Non-Authoritative-Reason HSTS
GET H2	200	Primary Request login.php Show response demirsoft.com/Netlfix/page_settings/ Redirect Chain https://fast-cut.com/quem-somos/ https://fast-cut.com/quem-somos/821e36f32d20823de8b8522d2e6aa7d8 https://fast-cut.com/quem-somos/821e36f32d20823de8b8522d2e6aa7d8/ https://demirsoft.com/Netlfix/page_settings https://demirsoft.com/Netlfix/page_settings/ https://demirsoft.com/Netlfix/page_settings/login.php?home-US-userID987647864812334345484351818468-Email-33626626641848798409874987049909840684980546840078965484/-second	8 KB 3 KB	72ms 72ms	Document text/html	92.42.33.44 EUROTA-ASN EUROTA...
General Check archive.org Show headers Download Go to Full URL https://demirsoft.com/Netlfix/page_settings/login.php?home-US-userID987647864812334345484351818468-Email-33626626641848798409874987049909840684980546840078965484/-second Requested by Host: www.bing.com URL: https://www.bing.com/ck/a?!&&p=af1a84c1bda7afb2JmltdHM9MTcxNDM0ODgwMCZpZ3VpZD0zYzEzYTZiOC1iNThhLTZhNmUtMDQzYy1iMmQ2YjRhMTZiYjQmaW5zaWQ9NTQ1NA&ptn=3&ver=2&hsh=3&fclid=3c13a6b8-b58a-6a6e-043c-b2d6b4a16bb4&u=a1aHR0cHM6Ly9mYXN0LWN1dC5jb20vcXVlbS1zb21vcy8&ntb=1 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 92.42.33.44 , Turkey, ASN49467 (EUROTA-ASN EUROTA INTERNET SERVICES LTD, TR), Reverse DNS static-92-42-33-44.inetmar.net Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `d6a3c82a135de1e82d59f2547e4c83f31c52a23334c1e09d084f3750655ed48d` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer https://www.bing.com/ck/a?!&&p=af1a84c1bda7afb2JmltdHM9MTcxNDM0ODgwMCZpZ3VpZD0zYzEzYTZiOC1iNThhLTZhNmUtMDQzYy1iMmQ2YjRhMTZiYjQmaW5zaWQ9NTQ1NA&ptn=3&ver=2&hsh=3&fclid=3c13a6b8-b58a-6a6e-043c-b2d6b4a16bb4&u=a1aHR0cHM6Ly9mYXN0LWN1dC5jb20vcXVlbS1zb21vcy8&ntb=1 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers cache-control no-store, no-cache, must-revalidate content-encoding br content-length 2695 content-type text/html; charset=UTF-8 date Tue, 30 Apr 2024 10:42:47 GMT expires Thu, 19 Nov 1981 08:52:00 GMT pragma no-cache server Microsoft-IIS/10.0 vary Accept-Encoding x-powered-by ASP.NET x-powered-by-plesk PleskWin Redirect headers content-length 0 content-type text/html; charset=UTF-8 date Tue, 30 Apr 2024 10:42:47 GMT location login.php?home-US-userID987647864812334345484351818468-Email-33626626641848798409874987049909840684980546840078965484/-second server Microsoft-IIS/10.0 x-powered-by ASP.NET x-powered-by-plesk PleskWin
GET H2	200	none.css demirsoft.com/Netlfix/page_settings/files/css/	145 KB 36 KB	235ms 235ms	Stylesheet text/css	92.42.33.44 EUROTA-ASN EUROTA...
General Check archive.org Show headers Download Go to Full URL https://demirsoft.com/Netlfix/page_settings/files/css/none.css Requested by Host: demirsoft.com URL: https://demirsoft.com/Netlfix/page_settings/login.php?home-US-userID987647864812334345484351818468-Email-33626626641848798409874987049909840684980546840078965484/-second Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 92.42.33.44 , Turkey, ASN49467 (EUROTA-ASN EUROTA INTERNET SERVICES LTD, TR), Reverse DNS static-92-42-33-44.inetmar.net Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `996606e12517e3bb57e0a5f01fed3d7144e2d07a4d8076717a90285c351fa835` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://demirsoft.com/Netlfix/page_settings/login.php?home-US-userID987647864812334345484351818468-Email-33626626641848798409874987049909840684980546840078965484/-second Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-powered-by-plesk PleskWin date Tue, 30 Apr 2024 10:42:47 GMT content-encoding br last-modified Sat, 27 Apr 2024 05:04:08 GMT server Microsoft-IIS/10.0 etag "05486556098da1:0" x-powered-by ASP.NET vary Accept-Encoding content-type text/css accept-ranges bytes content-length 36660
GET H2	200	none2.css demirsoft.com/Netlfix/page_settings/files/css/	163 KB 43 KB	236ms 236ms	Stylesheet text/css	92.42.33.44 EUROTA-ASN EUROTA...
General Check archive.org Show headers Download Go to Full URL https://demirsoft.com/Netlfix/page_settings/files/css/none2.css Requested by Host: demirsoft.com URL: https://demirsoft.com/Netlfix/page_settings/login.php?home-US-userID987647864812334345484351818468-Email-33626626641848798409874987049909840684980546840078965484/-second Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 92.42.33.44 , Turkey, ASN49467 (EUROTA-ASN EUROTA INTERNET SERVICES LTD, TR), Reverse DNS static-92-42-33-44.inetmar.net Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `00bc064877ab26d7931d8e85ea0f578aa5048f6a443a44043948097d74aa4a31` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://demirsoft.com/Netlfix/page_settings/login.php?home-US-userID987647864812334345484351818468-Email-33626626641848798409874987049909840684980546840078965484/-second Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-powered-by-plesk PleskWin date Tue, 30 Apr 2024 10:42:47 GMT content-encoding br last-modified Sat, 27 Apr 2024 05:04:08 GMT server Microsoft-IIS/10.0 etag "05486556098da1:0" x-powered-by ASP.NET vary Accept-Encoding content-type text/css accept-ranges bytes content-length 43783
GET H2	200	modernizr.min.js Show response demirsoft.com/Netlfix/page_settings/files/js/	4 KB 2 KB	61ms 60ms	Script application/javascript	92.42.33.44 EUROTA-ASN EUROTA...
General Check archive.org Show headers Download Go to Full URL https://demirsoft.com/Netlfix/page_settings/files/js/modernizr.min.js Requested by Host: demirsoft.com URL: https://demirsoft.com/Netlfix/page_settings/login.php?home-US-userID987647864812334345484351818468-Email-33626626641848798409874987049909840684980546840078965484/-second Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 92.42.33.44 , Turkey, ASN49467 (EUROTA-ASN EUROTA INTERNET SERVICES LTD, TR), Reverse DNS static-92-42-33-44.inetmar.net Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `a6c3bff965978df8093c3a29f7071c21d7439a212af41e7b40ce70d94d6bcc44` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://demirsoft.com/Netlfix/page_settings/login.php?home-US-userID987647864812334345484351818468-Email-33626626641848798409874987049909840684980546840078965484/-second Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-powered-by-plesk PleskWin date Tue, 30 Apr 2024 10:42:47 GMT content-encoding br last-modified Sat, 27 Apr 2024 05:04:08 GMT server Microsoft-IIS/10.0 etag "05486556098da1:0" x-powered-by ASP.NET vary Accept-Encoding content-type application/javascript accept-ranges bytes content-length 2030
GET H2	200	jquery.js Show response demirsoft.com/Netlfix/page_settings/files/js/	85 KB 42 KB	233ms 232ms	Script application/javascript	92.42.33.44 EUROTA-ASN EUROTA...
General Check archive.org Show headers Download Go to Full URL https://demirsoft.com/Netlfix/page_settings/files/js/jquery.js Requested by Host: demirsoft.com URL: https://demirsoft.com/Netlfix/page_settings/login.php?home-US-userID987647864812334345484351818468-Email-33626626641848798409874987049909840684980546840078965484/-second Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 92.42.33.44 , Turkey, ASN49467 (EUROTA-ASN EUROTA INTERNET SERVICES LTD, TR), Reverse DNS static-92-42-33-44.inetmar.net Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `8603b20b548270423fb03c2138c16f5f863ead4c48eb0999167df869e2eef8a6` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://demirsoft.com/Netlfix/page_settings/login.php?home-US-userID987647864812334345484351818468-Email-33626626641848798409874987049909840684980546840078965484/-second Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-powered-by-plesk PleskWin date Tue, 30 Apr 2024 10:42:47 GMT content-encoding br last-modified Sat, 27 Apr 2024 05:04:08 GMT server Microsoft-IIS/10.0 etag "05486556098da1:0" x-powered-by ASP.NET vary Accept-Encoding content-type application/javascript accept-ranges bytes content-length 43215
GET H2	200	bg.jpg demirsoft.com/Netlfix/page_settings/files/img/	117 KB 117 KB	63ms 62ms	Image image/jpeg	92.42.33.44 EUROTA-ASN EUROTA...
General Check archive.org Show headers Download Go to Show image Full URL https://demirsoft.com/Netlfix/page_settings/files/img/bg.jpg Requested by Host: demirsoft.com URL: https://demirsoft.com/Netlfix/page_settings/login.php?home-US-userID987647864812334345484351818468-Email-33626626641848798409874987049909840684980546840078965484/-second Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 92.42.33.44 , Turkey, ASN49467 (EUROTA-ASN EUROTA INTERNET SERVICES LTD, TR), Reverse DNS static-92-42-33-44.inetmar.net Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `cde4074549e72df2b148594b13728b01118887d02d99e5e7d67c5d1e54cc6669` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://demirsoft.com/Netlfix/page_settings/login.php?home-US-userID987647864812334345484351818468-Email-33626626641848798409874987049909840684980546840078965484/-second Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-powered-by-plesk PleskWin date Tue, 30 Apr 2024 10:42:47 GMT last-modified Sat, 27 Apr 2024 05:04:08 GMT server Microsoft-IIS/10.0 etag "05486556098da1:0" x-powered-by ASP.NET content-type image/jpeg accept-ranges bytes content-length 120105
GET H2	200	logo.svg demirsoft.com/Netlfix/page_settings/files/img/	864 B 917 B	62ms 61ms	Image image/svg+xml	92.42.33.44 EUROTA-ASN EUROTA...
General Check archive.org Show headers Download Go to Show image Full URL https://demirsoft.com/Netlfix/page_settings/files/img/logo.svg Requested by Host: demirsoft.com URL: https://demirsoft.com/Netlfix/page_settings/login.php?home-US-userID987647864812334345484351818468-Email-33626626641848798409874987049909840684980546840078965484/-second Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 92.42.33.44 , Turkey, ASN49467 (EUROTA-ASN EUROTA INTERNET SERVICES LTD, TR), Reverse DNS static-92-42-33-44.inetmar.net Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `8a421d5798accee1c284865ac05cee792ad3f6bcb3c70ce1dcb954d23e86fdad` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://demirsoft.com/Netlfix/page_settings/login.php?home-US-userID987647864812334345484351818468-Email-33626626641848798409874987049909840684980546840078965484/-second Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-powered-by-plesk PleskWin date Tue, 30 Apr 2024 10:42:47 GMT last-modified Sat, 27 Apr 2024 05:04:08 GMT server Microsoft-IIS/10.0 etag "05486556098da1:0" x-powered-by ASP.NET content-type image/svg+xml accept-ranges bytes content-length 864
GET H/1.1	200 OK	nf-icon-v1-93.woff assets.nflxext.com/ffe/siteui/fonts/	72 KB 72 KB	45ms 7ms	Font font/woff	2a00:86c0:2090::1 NETFLIX-ASN
General Check archive.org Show headers Download Go to Full URL https://assets.nflxext.com/ffe/siteui/fonts/nf-icon-v1-93.woff Requested by Host: demirsoft.com URL: https://demirsoft.com/Netlfix/page_settings/files/css/none.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2a00:86c0:2090::1 , United States, ASN40027 (NETFLIX-ASN, US), Reverse DNS Software nginx / Resource Hash `98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://demirsoft.com/ Origin https://demirsoft.com Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 30 Apr 2024 10:42:48 GMT Last-Modified Mon, 29 Jan 2018 01:50:51 GMT Server nginx Content-MD5 fPYVbMSBJEtaJUNi17c/AA== Content-Type font/woff Access-Control-Allow-Origin * Cache-Control max-age=604801 Connection keep-alive Accept-Ranges bytes Content-Length 73572 Expires Tue, 07 May 2024 10:42:49 GMT
GET H2	200	favicon.ico demirsoft.com/Netlfix/page_settings/files/img/	17 KB 17 KB	60ms 60ms	Other image/x-icon	92.42.33.44 EUROTA-ASN EUROTA...
General Check archive.org Show headers Download Go to Full URL https://demirsoft.com/Netlfix/page_settings/files/img/favicon.ico Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 92.42.33.44 , Turkey, ASN49467 (EUROTA-ASN EUROTA INTERNET SERVICES LTD, TR), Reverse DNS static-92-42-33-44.inetmar.net Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `abe8012eb65c0dc0ac3e87dcc1e60e1908ebd8f12b7c47a5df1856f7a7bb1edd` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://demirsoft.com/Netlfix/page_settings/login.php?home-US-userID987647864812334345484351818468-Email-33626626641848798409874987049909840684980546840078965484/-second Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-powered-by-plesk PleskWin date Tue, 30 Apr 2024 10:42:48 GMT last-modified Sat, 27 Apr 2024 05:04:08 GMT server Microsoft-IIS/10.0 etag "05486556098da1:0" x-powered-by ASP.NET content-type image/x-icon accept-ranges bytes content-length 16958

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			fast-cut.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: alh7bkqhppsmjd6k55n3hi3hce
			demirsoft.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 2fihg1g7avo0j8k5t2hla2knuv

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://demirsoft.com/Netlfix/page_settings/login.php?home-US-userID987647864812334345484351818468-Email-33626626641848798409874987049909840684980546840078965484/-second Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.nflxext.com
demirsoft.com
fast-cut.com
www.bing.com
204.16.1.151
2a00:86c0:2090::1
2a02:26f0:3500:1b::1724:a39d
92.42.33.44
00bc064877ab26d7931d8e85ea0f578aa5048f6a443a44043948097d74aa4a31
75185ff60671fff25c858e15fdcfb000c7ec9259a1420fa73bf66739e2a4de2a
8603b20b548270423fb03c2138c16f5f863ead4c48eb0999167df869e2eef8a6
8a421d5798accee1c284865ac05cee792ad3f6bcb3c70ce1dcb954d23e86fdad
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d
996606e12517e3bb57e0a5f01fed3d7144e2d07a4d8076717a90285c351fa835
a6c3bff965978df8093c3a29f7071c21d7439a212af41e7b40ce70d94d6bcc44
abe8012eb65c0dc0ac3e87dcc1e60e1908ebd8f12b7c47a5df1856f7a7bb1edd
cde4074549e72df2b148594b13728b01118887d02d99e5e7d67c5d1e54cc6669
d6a3c82a135de1e82d59f2547e4c83f31c52a23334c1e09d084f3750655ed48d

demirsoft.com Open in urlscan Pro 92.42.33.44 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

10 Requests

100 %HTTPS

50 %IPv6

4 Domains

4 Subdomains

3 IPs

3 Countries

335 kBTransfer

613 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

2 Cookies

1 Console Messages

Indicators

demirsoft.com Open in urlscan Pro
92.42.33.44 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

3
IPs

3
Countries

335 kB
Transfer

613 kB
Size

2
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!