netflixgpt-a308e.firebaseapp.com

Summary

This website contacted 4 IPs in 1 countries across 3 domains to perform 6 HTTP transactions. The main IP is 2620:0:890::100, located in United States and belongs to FASTLY, US. The main domain is netflixgpt-a308e.firebaseapp.com.
TLS certificate: Issued by GTS CA 1D4 on March 21st 2024. Valid for: 3 months.

This is the only time netflixgpt-a308e.firebaseapp.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

	IP Address	AS Autonomous System
3	2620:0:890::100 2620:0:890::100	54113 (FASTLY) (FASTLY)
1	2600:9000:20a... 2600:9000:20a0:2800:12:94b3:c380:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2a00:86c0:209... 2a00:86c0:2091::1	40027 (NETFLIX-ASN) (NETFLIX-ASN)
1	199.36.158.100 199.36.158.100	54113 (FASTLY) (FASTLY)
6	4

3 2620:0:890::100 (United States)

ASN54113 (FASTLY, US)

netflixgpt-a308e.firebaseapp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20a0:2800:12:94b3:c380:93a1 (United States)

ASN16509 (AMAZON-02, US)

images.ctfassets.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:86c0:2091::1 (United States)

ASN40027 (NETFLIX-ASN, US)

assets.nflxext.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.36.158.100 (United States)

ASN54113 (FASTLY, US)

netflixgpt-a308e.firebaseapp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	firebaseapp.com netflixgpt-a308e.firebaseapp.com	61 KB
1	nflxext.com assets.nflxext.com — Cisco Umbrella Rank: 5629	107 KB
1	ctfassets.net images.ctfassets.net — Cisco Umbrella Rank: 3656	19 KB
6	3

	Domain	Requested by
4	netflixgpt-a308e.firebaseapp.com	netflixgpt-a308e.firebaseapp.com
1	assets.nflxext.com
1	images.ctfassets.net
6	3

This site contains no links.

Subject Issuer	Validity	Valid
firebaseapp.com GTS CA 1D4	`2024-03-21` - `2024-06-19`	3 months	crt.sh
images.ctfassets.net Amazon RSA 2048 M02	`2023-12-19` - `2025-01-16`	a year	crt.sh
*.1.nflxso.net DigiCert Secure Site ECC CA-1	`2024-03-19` - `2024-04-19`	a month	crt.sh

This page contains 1 frames:

Primary Page: https://netflixgpt-a308e.firebaseapp.com/
Frame ID: C3C881C856EC2F2A9CE2CDB3B27349C7
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

React App

Detected technologies

Contentful (CMS) Expand

Overall confidence: 100%
Detected patterns

<[^>]+(?:https?:)?//(?:assets|downloads|images|videos)\.(?:ct?fassets\.net|contentful\.com)

Page Statistics

6
Requests

100 %
HTTPS

75 %
IPv6

3
Domains

3
Subdomains

4
IPs

1
Countries

187 kB
Transfer

328 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
netflixgpt-a308e.firebaseapp.com/ 644 B
616 B 120ms
25ms Document
text/html 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://netflixgpt-a308e.firebaseapp.com/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

/

Resource Hash

87efa7ef590e4729efb404e0a5f2c6c942b6045aff1004542a6f1fd993448158

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: de-DE,de;q=0.9
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
cache-control: max-age=3600
content-encoding: br
content-length: 248
content-type: text/html; charset=utf-8
date: Sat, 06 Apr 2024 13:00:24 GMT
etag: "feb67340ecbb2ff77b266b4f0678488720a2eefa4cf4933f081923c0ebe4b0e9-br"
last-modified: Mon, 01 Apr 2024 18:13:05 GMT
strict-transport-security: max-age=31556926; includeSubDomains; preload
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
x-cache-hits: 1
x-served-by: cache-fra-eddf8230049-FRA
x-timer: S1712408424.286291,VS0,VE1

GET
H2 200 main.11c9a824.js Show response
netflixgpt-a308e.firebaseapp.com/static/js/ 193 KB
55 KB 25ms
23ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://netflixgpt-a308e.firebaseapp.com/static/js/main.11c9a824.js

Requested by

Host: netflixgpt-a308e.firebaseapp.com
URL: https://netflixgpt-a308e.firebaseapp.com/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

/

Resource Hash

5e4df559edd2bd89a3b973a6f8112a00ae1eec7a6e7fe2be3f20550043e3d0b2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://netflixgpt-a308e.firebaseapp.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-served-by: cache-fra-eddf8230049-FRA
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Sat, 06 Apr 2024 13:00:24 GMT
last-modified: Mon, 01 Apr 2024 18:13:05 GMT
x-timer: S1712408424.323826,VS0,VE2
etag: "befb87f130308f2b1ff6418cf710c0356f5d1fcfc34990c364093833c4c2d4c4-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 56123
x-cache-hits: 1

GET
H2 200 main.399e8e4a.css
netflixgpt-a308e.firebaseapp.com/static/css/ 6 KB
2 KB 23ms
22ms Stylesheet
text/css 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://netflixgpt-a308e.firebaseapp.com/static/css/main.399e8e4a.css

Requested by

Host: netflixgpt-a308e.firebaseapp.com
URL: https://netflixgpt-a308e.firebaseapp.com/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

/

Resource Hash

bb020e30f4bbd993ff1fa16c18b6caf16e9424471b241cf92b0eccc0f33fea38

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://netflixgpt-a308e.firebaseapp.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-served-by: cache-fra-eddf8230049-FRA
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Sat, 06 Apr 2024 13:00:24 GMT
last-modified: Mon, 01 Apr 2024 18:13:05 GMT
x-timer: S1712408424.323841,VS0,VE2
etag: "5787edbd4d35a4cdfc2311fa9a8d051c7c0e13749d225522a4b01ab08c4df150-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/css; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 1598
x-cache-hits: 1

GET
H2 200 BrandAssets_Logos_01-Wordmark.jpg
images.ctfassets.net/y2ske730sjqp/1aONibCke6niZhgPxuiilC/2c401b05a07288746ddf3bd3943fbc76/ 19 KB
19 KB 151ms
34ms Image
image/jpeg 2600:9000:20a0:2800:12:94b3:c380:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.ctfassets.net/y2ske730sjqp/1aONibCke6niZhgPxuiilC/2c401b05a07288746ddf3bd3943fbc76/BrandAssets_Logos_01-Wordmark.jpg?w=940
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20a0:2800:12:94b3:c380:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Contentful Images API /
Resource Hash: d366d894df1b9d423ce76096999af947a7fc1a7bc3b357fcf1b70a994e481681

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://netflixgpt-a308e.firebaseapp.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 06 Apr 2024 07:32:02 GMT
via: 1.1 2e727a8c78efdc43baa0571190ea0f4a.cloudfront.net (CloudFront)
last-modified: Fri, 01 Mar 2024 13:47:17 GMT
server: Contentful Images API
x-amz-cf-pop: AMS58-P2
age: 19702
etag: "818c41acd81442d98e99dc5badc12d76"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-length: 19315
x-amz-cf-id: 02dJ_E3sOBlg6u4Qf6BXgibcggD7IqzYpf8bbGP_0A9XicBXQuGyIg==

GET
H/1.1 200
OK PK-en-20240326-popsignuptwoweeks-perspective_alpha_website_small.jpg
assets.nflxext.com/ffe/siteui/vlv3/7ca5b7c7-20aa-42a8-a278-f801b0d65fa1/3d7bd3dc-e3bf-4093-915d-2299d53943d6/ 106 KB
107 KB 145ms
53ms Image
image/jpeg 2a00:86c0:2091::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.nflxext.com/ffe/siteui/vlv3/7ca5b7c7-20aa-42a8-a278-f801b0d65fa1/3d7bd3dc-e3bf-4093-915d-2299d53943d6/PK-en-20240326-popsignuptwoweeks-perspective_alpha_website_small.jpg
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:86c0:2091::1 , United States, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: bdaab7548ce5143f33e938c1f5e3dcdd0915f0213fd4ff732609ac3016201bff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://netflixgpt-a308e.firebaseapp.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Sat, 06 Apr 2024 13:00:24 GMT
Last-Modified: Thu, 28 Mar 2024 19:29:05 GMT
Server: nginx
Content-MD5: uCSzc8lf+N9SC5w2WqBMIA==
Content-Type: image/jpeg
Cache-Control: max-age=604801
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 109044
Expires: Sat, 13 Apr 2024 13:00:25 GMT

GET
H3 200 favicon.ico
netflixgpt-a308e.firebaseapp.com/ 4 KB
4 KB 22ms
22ms Other
image/x-icon 199.36.158.100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://netflixgpt-a308e.firebaseapp.com/favicon.ico

Protocol

H3

Security

QUIC, , AES_256_GCM

Server

199.36.158.100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

/

Resource Hash

3d10f7da6c603178340081668c4ac5b3ae9743ca9a262ab0fcd312fbb9f48bdd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://netflixgpt-a308e.firebaseapp.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-served-by: cache-fra-eddf8230058-FRA
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
date: Sat, 06 Apr 2024 13:00:24 GMT
last-modified: Mon, 01 Apr 2024 18:13:05 GMT
x-timer: S1712408424.414482,VS0,VE1
etag: "eae62e993eb980ec8a25058c39d5a51feab118bd2100c4deebb2a9c158ec11f9"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: image/x-icon
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 3460
x-cache-hits: 0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| webpackChunknetflix_gpt string| __reactRouterVersion

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.nflxext.com
images.ctfassets.net
netflixgpt-a308e.firebaseapp.com
199.36.158.100
2600:9000:20a0:2800:12:94b3:c380:93a1
2620:0:890::100
2a00:86c0:2091::1
3d10f7da6c603178340081668c4ac5b3ae9743ca9a262ab0fcd312fbb9f48bdd
5e4df559edd2bd89a3b973a6f8112a00ae1eec7a6e7fe2be3f20550043e3d0b2
87efa7ef590e4729efb404e0a5f2c6c942b6045aff1004542a6f1fd993448158
bb020e30f4bbd993ff1fa16c18b6caf16e9424471b241cf92b0eccc0f33fea38
bdaab7548ce5143f33e938c1f5e3dcdd0915f0213fd4ff732609ac3016201bff
d366d894df1b9d423ce76096999af947a7fc1a7bc3b357fcf1b70a994e481681

netflixgpt-a308e.firebaseapp.com Open in urlscan Pro 2620:0:890::100 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

6 Requests

100 %HTTPS

75 %IPv6

3 Domains

3 Subdomains

4 IPs

1 Countries

187 kBTransfer

328 kBSize

0 Cookies

0 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

netflixgpt-a308e.firebaseapp.com Open in urlscan Pro
2620:0:890::100 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

75 %
IPv6

3
Domains

3
Subdomains

4
IPs

1
Countries

187 kB
Transfer

328 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!