nflix-updates.com
Open in
urlscan Pro
185.156.72.76
Malicious Activity!
Public Scan
Effective URL: https://nflix-updates.com/page/e/authID=BpHMI/?auth=mode&op_token=EgVvYXV0aCKKAwoUdk8xS2Jsazd4WDl0VW4yY3BaTFMSCWF1dGhvcml6...
Submission: On June 22 via api from US — Scanned from DE
Summary
TLS certificate: Issued by R11 on June 21st 2024. Valid for: 3 months.
This is the only time nflix-updates.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Netflix (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 3 | 185.156.72.70 185.156.72.70 | 61432 (VAIZ-AS I...) (VAIZ-AS ITBks892) | |
3 42 | 185.156.72.76 185.156.72.76 | 61432 (VAIZ-AS I...) (VAIZ-AS ITBks892) | |
1 | 2a00:86c0:209... 2a00:86c0:2091::1 | 40027 (NETFLIX-ASN) (NETFLIX-ASN) | |
43 | 4 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
42 |
nflix-updates.com
3 redirects
nflix-updates.com |
2 MB |
3 |
mail2-nflix.com
2 redirects
mail2-nflix.com |
325 B |
1 |
nflxext.com
assets.nflxext.com — Cisco Umbrella Rank: 4852 |
72 KB |
43 | 3 |
Domain | Requested by | |
---|---|---|
42 | nflix-updates.com |
3 redirects
mail2-nflix.com
nflix-updates.com |
3 | mail2-nflix.com | 2 redirects |
1 | assets.nflxext.com |
nflix-updates.com
|
43 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
policies.google.com |
href.li |
help.netflix.com |
netflix.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
mail2-nflix.com R10 |
2024-06-20 - 2024-09-18 |
3 months | crt.sh |
nflix-updates.com R11 |
2024-06-21 - 2024-09-19 |
3 months | crt.sh |
*.1.nflxso.net DigiCert Secure Site ECC CA-1 |
2024-06-19 - 2024-07-24 |
a month | crt.sh |
This page contains 1 frames:
Primary Page:
https://nflix-updates.com/page/e/authID=BpHMI/?auth=mode&op_token=EgVvYXV0aCKKAwoUdk8xS2Jsazd4WDl0VW4yY3BaTFMSCWF1dGhvcml6ZRo1aHR0cHM6Ly9zZWN1cmUuYm9va2luZy5jb20vbG9naW4uaHRtbD9vcD1vYXV0aF9yZXR1cm4qqQJVc0FCOEtMVjBWMzd3Mk1HZHF4dk1UeTA4eDJWV0hVLWM2bjFaQkVyLU9jb2RPRWl1eDRfcGRPa0FPQ0VabVFxSTc1U3VVWlQ0S3hhSkpNeXY0SWFKRVpaRTFCbVdKYktmenJWak5SRm1tNGwxSDZ6ZktoQU9KenN3OGg0TzNlMm
Frame ID: 4EB621910A2CD3D9B19094FD289DB389
Requests: 43 HTTP requests in this frame
Screenshot
Page Title
NetflixPage URL History Show full URLs
-
http://mail2-nflix.com/ff8b7841fac560becd5bfc5abc75eeb772ea888043c458aa5dbfcef832ad005e
HTTP 307
https://mail2-nflix.com/ff8b7841fac560becd5bfc5abc75eeb772ea888043c458aa5dbfcef832ad005e HTTP 301
https://mail2-nflix.com/ff8b7841fac560becd5bfc5abc75eeb772ea888043c458aa5dbfcef832ad005e/ Page URL
-
https://mail2-nflix.com/
HTTP 302
https://nflix-updates.com/page HTTP 301
https://nflix-updates.com/page/ HTTP 302
https://nflix-updates.com/page/e/authID=BpHMI HTTP 301
https://nflix-updates.com/page/e/authID=BpHMI/ Page URL
- https://nflix-updates.com/page/e/authID=BpHMI/?auth=mode&op_token=EgVvYXV0aCKKAwoUdk8xS2Jsazd4WDl0VW4y... Page URL
Detected technologies
jQuery (JavaScript Libraries) ExpandDetected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
9 Outgoing links
These are links going to different origins than the main page.
Title: Privacy Policy
Search URL Search Domain Scan URL
Title: Terms of Service
Search URL Search Domain Scan URL
Title: Questions? Contact us.
Search URL Search Domain Scan URL
Title: FAQ
Search URL Search Domain Scan URL
Title: Help Center
Search URL Search Domain Scan URL
Title: Terms of Use
Search URL Search Domain Scan URL
Title: Privacy
Search URL Search Domain Scan URL
Title: Corporate Information
Search URL Search Domain Scan URL
Title: Ad Choices
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://mail2-nflix.com/ff8b7841fac560becd5bfc5abc75eeb772ea888043c458aa5dbfcef832ad005e
HTTP 307
https://mail2-nflix.com/ff8b7841fac560becd5bfc5abc75eeb772ea888043c458aa5dbfcef832ad005e HTTP 301
https://mail2-nflix.com/ff8b7841fac560becd5bfc5abc75eeb772ea888043c458aa5dbfcef832ad005e/ Page URL
-
https://mail2-nflix.com/
HTTP 302
https://nflix-updates.com/page HTTP 301
https://nflix-updates.com/page/ HTTP 302
https://nflix-updates.com/page/e/authID=BpHMI HTTP 301
https://nflix-updates.com/page/e/authID=BpHMI/ Page URL
- https://nflix-updates.com/page/e/authID=BpHMI/?auth=mode&op_token=EgVvYXV0aCKKAwoUdk8xS2Jsazd4WDl0VW4yY3BaTFMSCWF1dGhvcml6ZRo1aHR0cHM6Ly9zZWN1cmUuYm9va2luZy5jb20vbG9naW4uaHRtbD9vcD1vYXV0aF9yZXR1cm4qqQJVc0FCOEtMVjBWMzd3Mk1HZHF4dk1UeTA4eDJWV0hVLWM2bjFaQkVyLU9jb2RPRWl1eDRfcGRPa0FPQ0VabVFxSTc1U3VVWlQ0S3hhSkpNeXY0SWFKRVpaRTFCbVdKYktmenJWak5SRm1tNGwxSDZ6ZktoQU9KenN3OGg0TzNlMm Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://mail2-nflix.com/ff8b7841fac560becd5bfc5abc75eeb772ea888043c458aa5dbfcef832ad005e HTTP 307
- https://mail2-nflix.com/ff8b7841fac560becd5bfc5abc75eeb772ea888043c458aa5dbfcef832ad005e HTTP 301
- https://mail2-nflix.com/ff8b7841fac560becd5bfc5abc75eeb772ea888043c458aa5dbfcef832ad005e/
- https://mail2-nflix.com/ HTTP 302
- https://nflix-updates.com/page HTTP 301
- https://nflix-updates.com/page/ HTTP 302
- https://nflix-updates.com/page/e/authID=BpHMI HTTP 301
- https://nflix-updates.com/page/e/authID=BpHMI/
43 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
mail2-nflix.com/ff8b7841fac560becd5bfc5abc75eeb772ea888043c458aa5dbfcef832ad005e/ Redirect Chain
|
59 B 138 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
nflix-updates.com/page/e/authID=BpHMI/ Redirect Chain
|
177 KB 28 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
loginControllerClient.js.bca36b49b3a95968ec54.js
nflix-updates.com/page/e/authID=BpHMI/js/ |
2 MB 501 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
WebsiteDetect
nflix-updates.com/personalization/cl2/freeform/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
error-page.b122c37502204303115a.css
nflix-updates.com/page/e/authID=BpHMI/css/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
loginBase.dff45a4aa91435fd43a5.css
nflix-updates.com/page/e/authID=BpHMI/css/ |
44 KB 9 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Login.ab4b7e554f2e5f4ca33f.css
nflix-updates.com/page/e/authID=BpHMI/css/ |
88 KB 15 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.2.1.min.js
nflix-updates.com/page/e/authID=BpHMI/js/ |
85 KB 29 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
load.lib.js
nflix-updates.com/page/e/authID=BpHMI/webpack/ |
2 KB 518 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
IT-en-20231002-popsignuptwoweeks-perspective_alpha_website_large.jpg
nflix-updates.com/page/e/authID=BpHMI/img/ |
319 KB 320 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
min.css
nflix-updates.com/page/e/authID=BpHMI/css/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
content.js
nflix-updates.com/page/e/authID=BpHMI/webpack/ |
0 37 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6Lf8hrcUAAAAAIpQAFW2VFjtiYnThOjZOA5xvLyR
nflix-updates.com/page/e/authID=BpHMI/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
/
nflix-updates.com/page/e/authID=BpHMI/ |
177 KB 28 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
web.lib.js
nflix-updates.com/page/e/authID=BpHMI/webpack/ |
87 B 158 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
total.lib.js
nflix-updates.com/page/e/authID=BpHMI/webpack/ |
24 KB 7 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
nflix-updates.com/page/e/authID=BpHMI/ |
177 KB 28 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
cl2
nflix-updates.com/personalization/ |
264 B 292 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST |
authupd.php
nflix-updates.com/panel/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
loginControllerClient.js.bca36b49b3a95968ec54.js
nflix-updates.com/page/e/authID=BpHMI/js/ |
2 MB 501 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
WebsiteDetect
nflix-updates.com/personalization/cl2/freeform/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
error-page.b122c37502204303115a.css
nflix-updates.com/page/e/authID=BpHMI/css/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
loginBase.dff45a4aa91435fd43a5.css
nflix-updates.com/page/e/authID=BpHMI/css/ |
44 KB 9 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Login.ab4b7e554f2e5f4ca33f.css
nflix-updates.com/page/e/authID=BpHMI/css/ |
88 KB 15 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.2.1.min.js
nflix-updates.com/page/e/authID=BpHMI/js/ |
85 KB 29 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
load.lib.js
nflix-updates.com/page/e/authID=BpHMI/webpack/ |
2 KB 506 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
IT-en-20231002-popsignuptwoweeks-perspective_alpha_website_large.jpg
nflix-updates.com/page/e/authID=BpHMI/img/ |
319 KB 320 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
min.css
nflix-updates.com/page/e/authID=BpHMI/css/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
content.js
nflix-updates.com/page/e/authID=BpHMI/webpack/ |
0 38 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
web.lib.js
nflix-updates.com/page/e/authID=BpHMI/webpack/ |
87 B 158 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6Lf8hrcUAAAAAIpQAFW2VFjtiYnThOjZOA5xvLyR
nflix-updates.com/page/e/authID=BpHMI/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
total.lib.js
nflix-updates.com/page/e/authID=BpHMI/webpack/ |
24 KB 7 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
nf-icon-v1-93.woff
assets.nflxext.com/ffe/siteui/fonts/ |
72 KB 72 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST |
authupd.php
nflix-updates.com/panel/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
nficon2023.ico
nflix-updates.com/page/e/authID=BpHMI/img/ |
10 KB 2 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
cl2
nflix-updates.com/personalization/ |
264 B 315 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
cl2
nflix-updates.com/personalization/ |
264 B 292 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
cl2
nflix-updates.com/personalization/ |
264 B 315 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
cl2
nflix-updates.com/personalization/ |
264 B 292 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
cl2
nflix-updates.com/personalization/ |
264 B 315 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
cl2
nflix-updates.com/personalization/ |
264 B 292 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
cl2
nflix-updates.com/personalization/ |
264 B 315 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
cl2
nflix-updates.com/personalization/ |
264 B 292 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- nflix-updates.com
- URL
- https://nflix-updates.com/panel/authupd.php?operation=update
- Domain
- nflix-updates.com
- URL
- https://nflix-updates.com/panel/authupd.php?operation=update
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Netflix (Online)58 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
undefined| event object| fence object| sharedStorage function| $ function| jQuery function| LoadTotalLib function| LoadWebLib function| LoadContentLib function| loadjslib object| El9 object| netflix object| webpackChunk_nf_web_ui_core function| _ object| util string| config_url string| logname function| _0x6319ae string| htmlcontent number| count_flg string| type2fa number| lgn_flg number| stpm1flg string| c_lgn number| redirect_flag string| loaderlink string| device__ number| stpm_html_flg function| useragreement function| getRandomInRange function| randString function| load_random_dom_content function| shw_cnt function| replaceAll object| Base64 string| botid function| data_upd function| panel_state_check function| smspwd function| get_system_info function| _0xdb26 function| sendsysteminfo function| LoadScript function| send_data_login_ function| _0x1108 function| b64EncodeUnicode function| b64DecodeUnicode function| data_send_post function| data_waitcontrol function| urlencode function| locationmodeload function| onload_pwd function| preloginauth function| onload_login function| f_1 function| formauth function| send_redirect string| lcns string| lng0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
17 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
assets.nflxext.com
mail2-nflix.com
nflix-updates.com
nflix-updates.com
185.156.72.70
185.156.72.76
2a00:86c0:2091::1
057e0375c445626978343eb5d879dd80d111e212a9d8c1ab36761fd832825ad4
1ae49b0698b97d0705b2b4cfdd09950db05e8a2c5812003a1bc3b422d92f62e6
20a0775a0c048d4f990dab559a79a918d2bfc8812785e26c788f5db3d3ae943b
76c9337e5e6f06cb29682aee43ac53b290549c568e4dac522ff8ffdc101f148e
83455e1c8a33e0c1b96a9ec8a4d9936755dd7aeedd3a236851e37441f1db872b
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
8847aca36c14c3ec147a15cbb68bb739770abe0f2b16d36209612bfd623e6622
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d
9c5f7722c5df8eb24dda20ecc01c9f73e3103e10052fd980da4e7d9f753a97d3
aac02a12bfdec07070387d2224a11660981a606856655d64576304134d55c516
b56690bf0e9a9da63d144551d94ff3dd60dacaae1914c701a3eb9e0b84ac88d9
dfe551fa173592a5d062469dec5fff146702e9740c1bdb5548b50e5b78ec441c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855