prootech4.aba.ae
Open in
urlscan Pro
85.17.26.65
Malicious Activity!
Public Scan
Effective URL: http://prootech4.aba.ae/4df7960053420ef3c794b0d9e61248c2/
Submission: On June 12 via manual from HK
Summary
This is the only time prootech4.aba.ae was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Netflix (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 52.1.156.8 52.1.156.8 | 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com) | |
2 11 | 85.17.26.65 85.17.26.65 | 60781 (LEASEWEB-...) (LEASEWEB-NL-AMS-01 Netherlands) | |
3 | 2a00:86c0:209... 2a00:86c0:2090::1 | 40027 (NETFLIX-ASN) (NETFLIX-ASN - Netflix Streaming Services Inc.) | |
3 | 2a02:26f0:6c0... 2a02:26f0:6c00:297::33c4 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
2 | 2a03:2880:f02... 2a03:2880:f02d:12:face:b00c:0:3 | 32934 (FACEBOOK) (FACEBOOK - Facebook) | |
1 | 2a03:2880:f01... 2a03:2880:f01c:216:face:b00c:0:3 | 32934 (FACEBOOK) (FACEBOOK - Facebook) | |
1 | 2a03:2880:f12... 2a03:2880:f12d:83:face:b00c:0:25de | 32934 (FACEBOOK) (FACEBOOK - Facebook) | |
19 | 6 |
ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-1-156-8.compute-1.amazonaws.com
t.dripemail2.com |
ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)
PTR: mail.aba.ae
samih.aba.ae | |
prootech4.aba.ae |
ASN40027 (NETFLIX-ASN - Netflix Streaming Services Inc., US)
codex.nflxext.com |
ASN32934 (FACEBOOK - Facebook, Inc., US)
connect.facebook.net | |
staticxx.facebook.com |
ASN32934 (FACEBOOK - Facebook, Inc., US)
connect.facebook.net |
ASN32934 (FACEBOOK - Facebook, Inc., US)
www.facebook.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
aba.ae
2 redirects
samih.aba.ae prootech4.aba.ae |
94 KB |
6 |
nflxext.com
codex.nflxext.com assets.nflxext.com |
633 KB |
2 |
facebook.com
staticxx.facebook.com www.facebook.com |
|
2 |
facebook.net
connect.facebook.net |
61 KB |
1 |
dripemail2.com
1 redirects
t.dripemail2.com |
218 B |
19 | 5 |
Domain | Requested by | |
---|---|---|
10 | prootech4.aba.ae |
2 redirects
samih.aba.ae
prootech4.aba.ae codex.nflxext.com |
3 | assets.nflxext.com |
prootech4.aba.ae
|
3 | codex.nflxext.com |
prootech4.aba.ae
|
2 | connect.facebook.net |
prootech4.aba.ae
connect.facebook.net |
1 | www.facebook.com |
connect.facebook.net
|
1 | staticxx.facebook.com |
connect.facebook.net
|
1 | samih.aba.ae | |
1 | t.dripemail2.com | 1 redirects |
19 | 8 |
This site contains links to these domains. Also see Links.
Domain |
---|
help.netflix.com |
www.aba.ae |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.1.nflxso.net DigiCert SHA2 Secure Server CA |
2019-05-08 - 2019-06-25 |
2 months | crt.sh |
1970-01-01 - 1970-01-01 |
a few seconds | crt.sh | |
assets.nflxext.com DigiCert SHA2 Secure Server CA |
2018-03-09 - 2020-03-09 |
2 years | crt.sh |
*.facebook.com DigiCert SHA2 High Assurance Server CA |
2019-04-22 - 2019-07-21 |
3 months | crt.sh |
This page contains 3 frames:
Primary Page:
http://prootech4.aba.ae/4df7960053420ef3c794b0d9e61248c2/
Frame ID: A2A59EE33C5915A9DAC1DC56056C4477
Requests: 17 HTTP requests in this frame
Frame:
https://staticxx.facebook.com/connect/xd_arbiter.php?version=44
Frame ID: 0D4A375EC92F0894AF2D2274FD2C7E33
Requests: 1 HTTP requests in this frame
Frame:
https://www.facebook.com/connect/ping?client_id=163114453728333&domain=prootech4.aba.ae&origin=1&redirect_uri=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter.php%3Fversion%3D44%23cb%3Df2f3715aecad68c%26domain%3Dprootech4.aba.ae%26origin%3Dhttp%253A%252F%252Fprootech4.aba.ae%252Ff39753ec3b8a19%26relation%3Dparent&response_type=token%2Csigned_request&sdk=joey
Frame ID: DCF85E3FDF28284898D6DCBDEE9383D0
Requests: 1 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://t.dripemail2.com/c/eyJhY2NvdW50X2lkIjoiMTQzNTA1NyIsImRlbGl2ZXJ5X2lkIjoiNj%20g1Mzc0ODMwMCIsInV...
HTTP 302
http://samih.aba.ae/?__s=6qn8y1buqzzz1k7ifaap Page URL
-
http://prootech4.aba.ae/
HTTP 302
http://prootech4.aba.ae/4df7960053420ef3c794b0d9e61248c2 HTTP 301
http://prootech4.aba.ae/4df7960053420ef3c794b0d9e61248c2/ Page URL
Detected technologies
Nginx (Web Servers) ExpandDetected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Facebook (Widgets) Expand
Detected patterns
- script /\/\/connect\.facebook\.net\/[^\/]*\/[a-z]*\.js/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- env /^jQuery$/i
Page Statistics
4 Outgoing links
These are links going to different origins than the main page.
Title: Questions? Contact us.
Search URL Search Domain Scan URL
Title: Terms of Use
Search URL Search Domain Scan URL
Title: Privacy Statement
Search URL Search Domain Scan URL
Title: استضافة مجانية
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://t.dripemail2.com/c/eyJhY2NvdW50X2lkIjoiMTQzNTA1NyIsImRlbGl2ZXJ5X2lkIjoiNj%20g1Mzc0ODMwMCIsInVybCI6Imh0dHA6Ly9zYW1paC5hYmEuYWUvP19fcz02cW44eTFidXF6enoxazdpZm%20FhcCM0NCJ9
HTTP 302
http://samih.aba.ae/?__s=6qn8y1buqzzz1k7ifaap Page URL
-
http://prootech4.aba.ae/
HTTP 302
http://prootech4.aba.ae/4df7960053420ef3c794b0d9e61248c2 HTTP 301
http://prootech4.aba.ae/4df7960053420ef3c794b0d9e61248c2/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://t.dripemail2.com/c/eyJhY2NvdW50X2lkIjoiMTQzNTA1NyIsImRlbGl2ZXJ5X2lkIjoiNj%20g1Mzc0ODMwMCIsInVybCI6Imh0dHA6Ly9zYW1paC5hYmEuYWUvP19fcz02cW44eTFidXF6enoxazdpZm%20FhcCM0NCJ9 HTTP 302
- http://samih.aba.ae/?__s=6qn8y1buqzzz1k7ifaap
- http://connect.facebook.net/en_TN/sdk.js HTTP 307
- https://connect.facebook.net/en_TN/sdk.js
19 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
samih.aba.ae/ Redirect Chain
|
2 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
prootech4.aba.ae/4df7960053420ef3c794b0d9e61248c2/ Redirect Chain
|
325 KB 82 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
none
codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-shakti-js-mk-v4f11faf7/js/js/bootstrap.js,common%7Cbootstrap.js/2/4_034v4t4e4x084a4B4Z060u004-4A4o4D4y0e4R4P4N4j4C4r4F19024V/bck/true/ |
9 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
none
codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-shakti-js-mk-v4f11faf7/js/js/components%7Clogin%7CloginControllerClient.js/2/4_034v4t4e4x084a4B4Z060u004-4A4o4D4y0e4R4P4N4j4C4r4F19024V/l/true/ |
704 KB 207 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
WebsiteDetect
prootech4.aba.ae/personalization/cl2/freeform/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
none
codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-shakti-css-v4f11faf7/css/css/less%7Clogin%7CloginBase.less,less%7Cpages%7Clogin%7CLogin.less/2/0C0Q040K090z0J0U0X0R0L0P0W0-/none/true/ |
124 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
TN-en-20190107-popsignuptwoweeks-perspective_alpha_website_large.jpg
assets.nflxext.com/ffe/siteui/vlv3/faece66f-91c3-4323-a7ed-e623d8343fca/9bdf17be-214c-45c0-b0e3-18f6f3bfdc49/ |
327 KB 328 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
FB-f-Logo__blue_57.png
assets.nflxext.com/ffe/siteui/login/images/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
WebsiteDetect
prootech4.aba.ae/personalization/cl2/freeform/ |
4 KB 2 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
WebsiteScreen
prootech4.aba.ae/personalization/cl2/freeform/ |
4 KB 2 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
nf-icon-v1-93.woff
assets.nflxext.com/ffe/siteui/fonts/ |
72 KB 72 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sdk.js
connect.facebook.net/en_TN/ Redirect Chain
|
3 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
log
prootech4.aba.ae/personalization/ |
4 KB 2 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sdk.js
connect.facebook.net/en_US/ |
196 KB 59 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
xd_arbiter.php
staticxx.facebook.com/connect/ Frame 0D4A |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ping
www.facebook.com/connect/ Frame DCF8 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
cl2
prootech4.aba.ae/personalization/ |
4 KB 2 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
cl2
prootech4.aba.ae/personalization/ |
4 KB 2 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
cl2
prootech4.aba.ae/personalization/ |
4 KB 2 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Netflix (Online)13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask object| netflix object| Codex object| C object| global object| process object| util function| jQuery object| jQuery111107985496951810778 function| fbAsyncInit object| FB1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.prootech4.aba.ae/ | Name: cL Value: 1560321376198%7C156032137613149690%7C15603213767452675%7C%7C4%7Cnull |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
assets.nflxext.com
codex.nflxext.com
connect.facebook.net
prootech4.aba.ae
samih.aba.ae
staticxx.facebook.com
t.dripemail2.com
www.facebook.com
2a00:86c0:2090::1
2a02:26f0:6c00:297::33c4
2a03:2880:f01c:216:face:b00c:0:3
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f12d:83:face:b00c:0:25de
52.1.156.8
85.17.26.65
039427134d14b04119c045daf63466e97f9a487d4db0f366a97b564230477df4
0950802a48401c4f341fa0bd26a7377746c6293d8d625fbf78af6688cda72396
2d416c417de8c418e5c8451048704e9aad3d94fbe3ba7cd517e4999d6ed743a5
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece
73fb154c2581c52ba4f55f14aa41534766727395138af7a894cc8e86974d17fa
9716b63ffd417f9970a15e2656074217d22dbe559ffe8babb64770d2134e7cb6
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d
e56a58c3dfacede41da51f47095cecefef99a66da6e9b3dee22150391289c3f4
e927e7c314f7cda8ee4dcff87b18b356084ba56e2dd38b011f2b59804760c042
fa3dc070793642108dc3da9812583f71cb629173a21d335aab7dc53757fda413