greenroof.pl - urlscan.io

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 6 HTTP transactions. The main IP is 91.225.159.20, located in Bielsko-biala, Poland and belongs to MULTIHUNER-, PL. The main domain is greenroof.pl.

This is the only time greenroof.pl was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online) Netflix (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 5	91.225.159.20 91.225.159.20	56449 (MULTIHUNER-) (MULTIHUNER-)
2	2a02:26f0:6c0... 2a02:26f0:6c00:28c::33c4	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
6	2

5 91.225.159.20 (Bielsko-biala, Poland) 1 redirects

ASN56449 (MULTIHUNER-, PL)
PTR: 20.159.225.91.bielskobiala.net.pl

greenroof.pl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:6c00:28c::33c4 (European Union)

ASN20940 (AKAMAI-ASN1, US)

assets.nflxext.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	greenroof.pl 1 redirects greenroof.pl	26 KB
2	nflxext.com assets.nflxext.com	162 KB
6	2

	Domain	Requested by
5	greenroof.pl	1 redirects greenroof.pl
2	assets.nflxext.com
6	2

This site contains no links.

Subject Issuer	Validity	Valid
assets.nflxext.com DigiCert SHA2 Secure Server CA	`2018-03-09` - `2020-03-09`	2 years	crt.sh

This page contains 1 frames:

Primary Page: http://greenroof.pl/administrator/components/com_icebooking/page-update-information/Logiiin/
Frame ID: 7C01AFE56B49A7E40E04CE82217593AD
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://greenroof.pl/administrator/components/com_icebooking/page-update-information/Logiiin HTTP 301
http://greenroof.pl/administrator/components/com_icebooking/page-update-information/Logiiin/ Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

React (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<[^>]+data-react/i

Page Statistics

6
Requests

33 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

188 kB
Transfer

270 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://greenroof.pl/administrator/components/com_icebooking/page-update-information/Logiiin HTTP 301
http://greenroof.pl/administrator/components/com_icebooking/page-update-information/Logiiin/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response greenroof.pl/administrator/components/com_icebooking/page-update-information/Logiiin/ Redirect Chain http://greenroof.pl/administrator/components/com_icebooking/page-update-information/Logiiin http://greenroof.pl/administrator/components/com_icebooking/page-update-information/Logiiin/	5 KB 4 KB	286ms 286ms	Document text/html	91.225.159.20 MULTIHUNER-
General Check archive.org Show headers Download Go to Full URL http://greenroof.pl/administrator/components/com_icebooking/page-update-information/Logiiin/ Protocol HTTP/1.1 Server 91.225.159.20 Bielsko-biala, Poland, ASN56449 (MULTIHUNER-, PL), Reverse DNS 20.159.225.91.bielskobiala.net.pl Software Apache/2 / PHP/5.3.28 Resource Hash `5d81b1d7332509b8f65330b7e9c093030dc30a4f244e88b278c8a1aabfbac966` Request headers Host greenroof.pl Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 X-DevTools-Emulate-Network-Conditions-Client-Id 7C01AFE56B49A7E40E04CE82217593AD Response headers Date Wed, 19 Sep 2018 10:19:09 GMT Server Apache/2 X-Powered-By PHP/5.3.28 Vary Accept-Encoding,User-Agent Content-Encoding gzip Content-Length 3798 Keep-Alive timeout=1, max=99 Connection Keep-Alive Content-Type text/html Redirect headers Date Wed, 19 Sep 2018 10:19:09 GMT Server Apache/2 Location http://greenroof.pl/administrator/components/com_icebooking/page-update-information/Logiiin/ Content-Length 364 Keep-Alive timeout=1, max=100 Connection Keep-Alive Content-Type text/html; charset=iso-8859-1
GET H/1.1	200 OK	hok.js Show response greenroof.pl/administrator/components/com_icebooking/page-update-information/Logiiin/	20 KB 6 KB	51ms 51ms	Script application/javascript	91.225.159.20 MULTIHUNER-
General Check archive.org Show headers Download Go to Full URL http://greenroof.pl/administrator/components/com_icebooking/page-update-information/Logiiin/hok.js Requested by Host: greenroof.pl URL: http://greenroof.pl/administrator/components/com_icebooking/page-update-information/Logiiin/ Protocol HTTP/1.1 Server 91.225.159.20 Bielsko-biala, Poland, ASN56449 (MULTIHUNER-, PL), Reverse DNS 20.159.225.91.bielskobiala.net.pl Software Apache/2 / Resource Hash `847c86ae982abe9180233276125b930b4a1b6f1bd12649b0c07535c1e984def8` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host greenroof.pl User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept / Referer http://greenroof.pl/administrator/components/com_icebooking/page-update-information/Logiiin/ Connection keep-alive Cache-Control no-cache Referer http://greenroof.pl/administrator/components/com_icebooking/page-update-information/Logiiin/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Wed, 19 Sep 2018 10:19:10 GMT Content-Encoding gzip Last-Modified Sun, 15 Jan 2017 06:27:46 GMT Server Apache/2 ETag "16e3344-4f65-5461c2a48dc80" Vary Accept-Encoding,User-Agent Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=1, max=98 Content-Length 6049
GET H/1.1	200 OK	z.css greenroof.pl/administrator/components/com_icebooking/page-update-information/Logiiin/css/	35 KB 7 KB	59ms 58ms	Stylesheet text/css	91.225.159.20 MULTIHUNER-
General Check archive.org Show headers Download Go to Full URL http://greenroof.pl/administrator/components/com_icebooking/page-update-information/Logiiin/css/z.css Requested by Host: greenroof.pl URL: http://greenroof.pl/administrator/components/com_icebooking/page-update-information/Logiiin/ Protocol HTTP/1.1 Server 91.225.159.20 Bielsko-biala, Poland, ASN56449 (MULTIHUNER-, PL), Reverse DNS 20.159.225.91.bielskobiala.net.pl Software Apache/2 / Resource Hash `4abd9472f2e7b527e94d3861e1be1bcb93e7aea5540a8675b68659cd45da427c` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host greenroof.pl User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/css,/;q=0.1 Referer http://greenroof.pl/administrator/components/com_icebooking/page-update-information/Logiiin/ Connection keep-alive Cache-Control no-cache Referer http://greenroof.pl/administrator/components/com_icebooking/page-update-information/Logiiin/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Wed, 19 Sep 2018 10:19:10 GMT Content-Encoding gzip Last-Modified Fri, 20 May 2016 21:48:38 GMT Server Apache/2 ETag "130948c-8d4e-5334d0da57980" Vary Accept-Encoding,User-Agent Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=1, max=97 Content-Length 7263
GET H/1.1	200 OK	a.css greenroof.pl/administrator/components/com_icebooking/page-update-information/Logiiin/css/	49 KB 8 KB	258ms 227ms	Stylesheet text/css	91.225.159.20 MULTIHUNER-
General Check archive.org Show headers Download Go to Full URL http://greenroof.pl/administrator/components/com_icebooking/page-update-information/Logiiin/css/a.css Requested by Host: greenroof.pl URL: http://greenroof.pl/administrator/components/com_icebooking/page-update-information/Logiiin/ Protocol HTTP/1.1 Server 91.225.159.20 Bielsko-biala, Poland, ASN56449 (MULTIHUNER-, PL), Reverse DNS 20.159.225.91.bielskobiala.net.pl Software Apache/2 / Resource Hash `6b3d30d4dafa94f9fd1f01eb48310ec6cc7f297557be11f6a482aaf11473902e` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host greenroof.pl User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/css,/;q=0.1 Referer http://greenroof.pl/administrator/components/com_icebooking/page-update-information/Logiiin/ Connection keep-alive Cache-Control no-cache Referer http://greenroof.pl/administrator/components/com_icebooking/page-update-information/Logiiin/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Wed, 19 Sep 2018 10:19:10 GMT Content-Encoding gzip Last-Modified Sun, 15 Jan 2017 10:52:00 GMT Server Apache/2 ETag "1308009-c2ea-5461fdb41b400" Vary Accept-Encoding,User-Agent Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=1, max=100 Content-Length 8209
GET S	200	login-the-crown_2-1500x1000.jpg assets.nflxext.com/ffe/siteui/acquisition/login/	84 KB 85 KB	7ms 7ms	Image image/jpeg	2a02:26f0:6c00:28c::33c4 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://assets.nflxext.com/ffe/siteui/acquisition/login/login-the-crown_2-1500x1000.jpg Protocol SPDY Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:6c00:28c::33c4 , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Apache / Resource Hash `baafd74a4cb4dc594b614eeb45c7267bb1af729d9271752460348ece16532d04` Request headers Referer http://greenroof.pl/administrator/components/com_icebooking/page-update-information/Logiiin/css/a.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Wed, 19 Sep 2018 10:19:10 GMT last-modified Mon, 24 Oct 2016 20:49:51 GMT server Apache content-md5 5GY/BZWwL7HDlH/B8V64Eg== content-type image/jpeg status 200 cache-control public, max-age=49628450 accept-ranges bytes content-length 86226 expires Wed, 15 Apr 2020 20:00:00 GMT
GET S	200	nf-icon-v1-80.woff assets.nflxext.com/ffe/siteui/fonts/	78 KB 78 KB	7ms 7ms	Font font/woff	2a02:26f0:6c00:28c::33c4 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://assets.nflxext.com/ffe/siteui/fonts/nf-icon-v1-80.woff Protocol SPDY Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:6c00:28c::33c4 , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Apache / Resource Hash `2555364bdd6374d0c273c69322f2f78554c02fe630ee6582eeb2d2c9031d1a9d` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer http://greenroof.pl/administrator/components/com_icebooking/page-update-information/Logiiin/css/z.css Origin http://greenroof.pl Response headers date Wed, 19 Sep 2018 10:19:10 GMT last-modified Thu, 28 Jan 2016 20:46:04 GMT server Apache content-md5 GkWpE2r/FESZk08OjSTsgQ== status 200 content-type font/woff access-control-allow-origin * cache-control public, max-age=49628450 accept-ranges bytes content-length 79392 expires Wed, 15 Apr 2020 20:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online) Netflix (Online)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.nflxext.com
greenroof.pl
2a02:26f0:6c00:28c::33c4
91.225.159.20
2555364bdd6374d0c273c69322f2f78554c02fe630ee6582eeb2d2c9031d1a9d
4abd9472f2e7b527e94d3861e1be1bcb93e7aea5540a8675b68659cd45da427c
5d81b1d7332509b8f65330b7e9c093030dc30a4f244e88b278c8a1aabfbac966
6b3d30d4dafa94f9fd1f01eb48310ec6cc7f297557be11f6a482aaf11473902e
847c86ae982abe9180233276125b930b4a1b6f1bd12649b0c07535c1e984def8
baafd74a4cb4dc594b614eeb45c7267bb1af729d9271752460348ece16532d04

greenroof.pl Open in urlscan Pro 91.225.159.20 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

6 Requests

33 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

188 kBTransfer

270 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

0 Cookies

Indicators

greenroof.pl Open in urlscan Pro
91.225.159.20 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

33 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

188 kB
Transfer

270 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!