f9w1lned0ruqblxi6jahwotak.filesusr.com Open in urlscan Pro
34.102.176.152 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://f9w1lned0ruqblxi6jahwotak.filesusr.com/html/c69417_3a78d13182fce9818213d74210e7f8fe.html?*d2hhdhnzyxaxmcpodhrwczovl2rhcmsubmv0zmxpec5pb...
Submission: On February 27 via automatic, source openphish (February 27th 2021, 1:16:22 pm UTC)

Summary HTTP 9 Redirects Links 8 Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 9 HTTP transactions. The main IP is 34.102.176.152, located in Kansas City, United States and belongs to GOOGLE, US. The main domain is f9w1lned0ruqblxi6jahwotak.filesusr.com.

This is the only time f9w1lned0ruqblxi6jahwotak.filesusr.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

	IP Address	AS Autonomous System
2	34.102.176.152 34.102.176.152	15169 (GOOGLE) (GOOGLE)
4	2a00:86c0:209... 2a00:86c0:2090::1	40027 (NETFLIX-ASN) (NETFLIX-ASN)
3	2a00:86c0:209... 2a00:86c0:2091::1	40027 (NETFLIX-ASN) (NETFLIX-ASN)
9	3

2 34.102.176.152 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 152.176.102.34.bc.googleusercontent.com

f9w1lned0ruqblxi6jahwotak.filesusr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:86c0:2090::1 (United States)

ASN40027 (NETFLIX-ASN, US)

codex.nflxext.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:86c0:2091::1 (United States)

ASN40027 (NETFLIX-ASN, US)

assets.nflxext.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	nflxext.com codex.nflxext.com assets.nflxext.com	692 KB
2	filesusr.com f9w1lned0ruqblxi6jahwotak.filesusr.com	179 KB
9	2

	Domain	Requested by
4	codex.nflxext.com	f9w1lned0ruqblxi6jahwotak.filesusr.com
3	assets.nflxext.com	f9w1lned0ruqblxi6jahwotak.filesusr.com codex.nflxext.com
2	f9w1lned0ruqblxi6jahwotak.filesusr.com	f9w1lned0ruqblxi6jahwotak.filesusr.com
9	3

This site contains links to these domains. Also see Links.

Domain
policies.google.com
help.netflix.com

Subject Issuer	Validity	Valid
*.1.nflxso.net DigiCert SHA2 Secure Server CA	`2021-01-31` - `2021-03-06`	a month	crt.sh

This page contains 1 frames:

Primary Page: http://f9w1lned0ruqblxi6jahwotak.filesusr.com/html/c69417_3a78d13182fce9818213d74210e7f8fe.html?*d2hhdhnzyxaxmcpodhrwczovl2rhcmsubmv0zmxpec5pbyphbnnhz18ymtazqghvdg1hawwuy29tkmvzkmpvc2vhc3jvzhjpz3vlemvaz21hawwuy29t
Frame ID: 4E0F0A12B4DED50451545787C4AA27E8
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Lua (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

OpenResty (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

Google Cloud (CDN) Expand

Overall confidence: 100%
Detected patterns

headers via /^1\.1 google$/i

Page Statistics

9
Requests

78 %
HTTPS

67 %
IPv6

2
Domains

3
Subdomains

3
IPs

1
Countries

870 kB
Transfer

1572 kB
Size

0
Cookies

8 Outgoing links

These are links going to different origins than the main page.

URL: https://policies.google.com/privacy
Title: Política de privacidad

Search URL Search Domain Scan URL

URL: https://policies.google.com/terms
Title: Condiciones del servicio

Search URL Search Domain Scan URL

URL: https://help.netflix.com/support/412
Title: Preguntas frecuentes

Search URL Search Domain Scan URL

URL: https://help.netflix.com/
Title: Centro de ayuda

Search URL Search Domain Scan URL

URL: https://help.netflix.com/legal/termsofuse
Title: Términos de uso

Search URL Search Domain Scan URL

URL: https://help.netflix.com/legal/privacy
Title: Privacidad

Search URL Search Domain Scan URL

URL: https://help.netflix.com/legal/privacy#cookies
Title: Preferencias de cookies

Search URL Search Domain Scan URL

URL: https://help.netflix.com/es/node/2101
Title: Información corporativa

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request c69417_3a78d13182fce9818213d74210e7f8fe.html Show response
f9w1lned0ruqblxi6jahwotak.filesusr.com/html/ 178 KB
179 KB 25ms
9ms Document
text/html 34.102.176.152
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: http://f9w1lned0ruqblxi6jahwotak.filesusr.com/html/c69417_3a78d13182fce9818213d74210e7f8fe.html?*d2hhdhnzyxaxmcpodhrwczovl2rhcmsubmv0zmxpec5pbyphbnnhz18ymtazqghvdg1hawwuy29tkmvzkmpvc2vhc3jvzhjpz3vlemvaz21hawwuy29t
Protocol: HTTP/1.1
Server: 34.102.176.152 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 152.176.102.34.bc.googleusercontent.com
Software: openresty/1.17.8.2 /
Resource Hash: 922cc27512380fc5b4dbb9554c94d664e8e7149234f9fc5c83ad81dbaf08f347

Request headers

Host: f9w1lned0ruqblxi6jahwotak.filesusr.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Server: openresty/1.17.8.2
Date: Fri, 26 Feb 2021 23:05:10 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 182002
X-GUploader-UploadID: ABg5-UyJilzUakQj5petW6oTkTYKw0rC3thwHRDdpW42VEwa5qHN0Vx5gtfvUKCZvZcxyN6jCDxC7XEH4I5FsG4cGmBWVmaaew
Expires: Sat, 27 Feb 2021 00:04:12 GMT
Last-Modified: Wed, 16 Sep 2020 21:30:05 GMT
ETag: "3a78d13182fce9818213d74210e7f8fe"
x-goog-generation: 1600291805812156
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 182002
x-goog-hash: crc32c=0rwpzA== md5=OnjRMYL86YGCE9dCEOf4/g==
x-goog-storage-class: STANDARD
Accept-Ranges: bytes
Age: 51052
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Seen-By: gcp.us-central-1.media-router-779d4599d7-v9lbg
Via: 1.1 google
Cache-Control: public, max-age=15552000, immutable

GET
H/1.1 200
OK none Show response
codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-js-vff980d5b/js/js/bootstrap.js,common%7Cbootstrap.js/2/4N034k4a4m06464u4M080o004O4p4J4w4n4I4c4v4y0a024K/bck/true/ 9 KB
4 KB 26ms
6ms Script
application/javascript 2a00:86c0:2090::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-js-vff980d5b/js/js/bootstrap.js,common%7Cbootstrap.js/2/4N034k4a4m06464u4M080o004O4p4J4w4n4I4c4v4y0a024K/bck/true/none

Requested by

Host: f9w1lned0ruqblxi6jahwotak.filesusr.com
URL: http://f9w1lned0ruqblxi6jahwotak.filesusr.com/html/c69417_3a78d13182fce9818213d74210e7f8fe.html?*d2hhdhnzyxaxmcpodhrwczovl2rhcmsubmv0zmxpec5pbyphbnnhz18ymtazqghvdg1hawwuy29tkmvzkmpvc2vhc3jvzhjpz3vlemvaz21hawwuy29t

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2a00:86c0:2090::1 , United States, ASN40027 (NETFLIX-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

2d82fa536e110d6e93bf9d5f017291cdf89ac0f005ed366c40e037c9143fa7d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://f9w1lned0ruqblxi6jahwotak.filesusr.com/html/c69417_3a78d13182fce9818213d74210e7f8fe.html?*d2hhdhnzyxaxmcpodhrwczovl2rhcmsubmv0zmxpec5pbyphbnnhz18ymtazqghvdg1hawwuy29tkmvzkmpvc2vhc3jvzhjpz3vlemvaz21hawwuy29t
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 27 Feb 2021 13:16:02 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx
Content-Type: application/javascript; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=16070400
req_id: c9ce966a-5da6-459c-a7b9-d72315532bc2
Connection: keep-alive
Timing-Allow-Origin: https://www.netflix.com
Content-Length: 3600
Expires: Wed, 01 Sep 2021 12:42:17 GMT

GET
H/1.1 200
OK none Show response
codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-js-vff980d5b/js/js/components%7Clogin%7CloginControllerClient.js/2/4N034k4a4m06464u4M080o004O4p4J4w4n4I4c4v4y0a024K/l/true/ 841 KB
258 KB 26ms
6ms Script
application/javascript 2a00:86c0:2090::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-js-vff980d5b/js/js/components%7Clogin%7CloginControllerClient.js/2/4N034k4a4m06464u4M080o004O4p4J4w4n4I4c4v4y0a024K/l/true/none

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2a00:86c0:2090::1 , United States, ASN40027 (NETFLIX-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

8a99f9e6636b529addd0c288b20751340988174fc6912026b9ba1120533bf276

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://f9w1lned0ruqblxi6jahwotak.filesusr.com/html/c69417_3a78d13182fce9818213d74210e7f8fe.html?*d2hhdhnzyxaxmcpodhrwczovl2rhcmsubmv0zmxpec5pbyphbnnhz18ymtazqghvdg1hawwuy29tkmvzkmpvc2vhc3jvzhjpz3vlemvaz21hawwuy29t
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 27 Feb 2021 13:16:02 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx
Content-Type: application/javascript; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=16070400
req_id: 3e8dbca4-9774-4b17-bef9-f6197773068c
Connection: keep-alive
Timing-Allow-Origin: https://www.netflix.com
Content-Length: 263884
Expires: Tue, 31 Aug 2021 18:55:21 GMT

GET
H/1.1 403
Forbidden WebsiteDetect
f9w1lned0ruqblxi6jahwotak.filesusr.com/personalization/cl2/freeform/ 0
0 447ms
442ms Stylesheet
text/plain 34.102.176.152
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: http://f9w1lned0ruqblxi6jahwotak.filesusr.com/personalization/cl2/freeform/WebsiteDetect?source=wwwhead&fetchType=css&modalView=login
Requested by: Host: f9w1lned0ruqblxi6jahwotak.filesusr.com
URL: http://f9w1lned0ruqblxi6jahwotak.filesusr.com/html/c69417_3a78d13182fce9818213d74210e7f8fe.html?*d2hhdhnzyxaxmcpodhrwczovl2rhcmsubmv0zmxpec5pbyphbnnhz18ymtazqghvdg1hawwuy29tkmvzkmpvc2vhc3jvzhjpz3vlemvaz21hawwuy29t
Protocol: HTTP/1.1
Server: 34.102.176.152 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 152.176.102.34.bc.googleusercontent.com
Software: openresty/1.17.8.2 /
Resource Hash

Request headers

Referer: http://f9w1lned0ruqblxi6jahwotak.filesusr.com/html/c69417_3a78d13182fce9818213d74210e7f8fe.html?*d2hhdhnzyxaxmcpodhrwczovl2rhcmsubmv0zmxpec5pbyphbnnhz18ymtazqghvdg1hawwuy29tkmvzkmpvc2vhc3jvzhjpz3vlemvaz21hawwuy29t
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 27 Feb 2021 13:16:02 GMT
Via: 1.1 google
Server: openresty/1.17.8.2
Content-Type: text/plain
Access-Control-Allow-Origin: *
Cache-Control: no-cache, private, must-revalidate, proxy-revalidate, no-store
Timing-Allow-Origin: *
Content-Length: 9
X-Seen-By: gcp.us-central-1.media-router-779d4599d7-qg5b9

GET
H/1.1 200
OK none
codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-css-vff980d5b/css/css/less%7Ccore%7Cerror-page.less/1/vFxM3Kw8EJL/none/true/ 11 KB
3 KB 24ms
6ms Stylesheet
text/css 2a00:86c0:2090::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-css-vff980d5b/css/css/less%7Ccore%7Cerror-page.less/1/vFxM3Kw8EJL/none/true/none

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2a00:86c0:2090::1 , United States, ASN40027 (NETFLIX-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

d9bac1aefff045998fd064ed279defcd96c37a53ee0ee3816d1ebab19c1ff739

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://f9w1lned0ruqblxi6jahwotak.filesusr.com/html/c69417_3a78d13182fce9818213d74210e7f8fe.html?*d2hhdhnzyxaxmcpodhrwczovl2rhcmsubmv0zmxpec5pbyphbnnhz18ymtazqghvdg1hawwuy29tkmvzkmpvc2vhc3jvzhjpz3vlemvaz21hawwuy29t
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 27 Feb 2021 13:16:02 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx
Content-Type: text/css; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=16070400
req_id: 86f36d5d-419b-44d4-b6fa-1fc4eb14e156
Connection: keep-alive
Timing-Allow-Origin: https://www.netflix.com
Content-Length: 2592
Expires: Tue, 31 Aug 2021 23:10:22 GMT

GET
H/1.1 200
OK none
codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-css-vff980d5b/css/css/less%7Clogin%7CloginBase.less,less%7Cpages%7Clogin%7CLogin.less/1/vFxM3Kw8EJL/none/true/ 128 KB
21 KB 457ms
438ms Stylesheet
text/css 2a00:86c0:2090::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-css-vff980d5b/css/css/less%7Clogin%7CloginBase.less,less%7Cpages%7Clogin%7CLogin.less/1/vFxM3Kw8EJL/none/true/none

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2a00:86c0:2090::1 , United States, ASN40027 (NETFLIX-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

5031cf92b3fbacf08a1a32ac5261f809097b64f04fb4c96c2b263b794e926a83

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://f9w1lned0ruqblxi6jahwotak.filesusr.com/html/c69417_3a78d13182fce9818213d74210e7f8fe.html?*d2hhdhnzyxaxmcpodhrwczovl2rhcmsubmv0zmxpec5pbyphbnnhz18ymtazqghvdg1hawwuy29tkmvzkmpvc2vhc3jvzhjpz3vlemvaz21hawwuy29t
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 27 Feb 2021 13:16:02 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx
Transfer-Encoding: chunked
Content-Type: text/css; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=16070400
req_id: 89cb9585-52eb-407c-a77a-9930ebebf378
Connection: keep-alive
Timing-Allow-Origin: https://www.netflix.com
Expires: Wed, 01 Sep 2021 13:16:02 GMT

GET
H/1.1 200
OK MX-es-20200914-popsignuptwoweeks-perspective_alpha_website_large.jpg
assets.nflxext.com/ffe/siteui/vlv3/70731dc8-8977-4ed7-9a0a-421f510aea00/eee627d4-cdcf-419f-a823-ce5864140508/ 331 KB
332 KB 164ms
119ms Image
image/jpeg 2a00:86c0:2091::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.nflxext.com/ffe/siteui/vlv3/70731dc8-8977-4ed7-9a0a-421f510aea00/eee627d4-cdcf-419f-a823-ce5864140508/MX-es-20200914-popsignuptwoweeks-perspective_alpha_website_large.jpg
Requested by: Host: f9w1lned0ruqblxi6jahwotak.filesusr.com
URL: http://f9w1lned0ruqblxi6jahwotak.filesusr.com/html/c69417_3a78d13182fce9818213d74210e7f8fe.html?*d2hhdhnzyxaxmcpodhrwczovl2rhcmsubmv0zmxpec5pbyphbnnhz18ymtazqghvdg1hawwuy29tkmvzkmpvc2vhc3jvzhjpz3vlemvaz21hawwuy29t
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:86c0:2091::1 , United States, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: fbf130ed2e64bf025c167c69e9978010e7100fe23b502e264a5f062010d57be3

Request headers

Referer: http://f9w1lned0ruqblxi6jahwotak.filesusr.com/html/c69417_3a78d13182fce9818213d74210e7f8fe.html?*d2hhdhnzyxaxmcpodhrwczovl2rhcmsubmv0zmxpec5pbyphbnnhz18ymtazqghvdg1hawwuy29tkmvzkmpvc2vhc3jvzhjpz3vlemvaz21hawwuy29t
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 27 Feb 2021 13:16:03 GMT
Last-Modified: Wed, 16 Sep 2020 18:35:58 GMT
Server: nginx
Content-MD5: vJCq8p0mCJ53kbeP/7ZjiA==
Content-Type: image/jpeg
Cache-Control: public, max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 339349
Expires: Sat, 06 Mar 2021 13:16:03 GMT

GET
H/1.1 200
OK FB-f-Logo__blue_57.png
assets.nflxext.com/ffe/siteui/login/images/ 1 KB
2 KB 21ms
8ms Image
image/png 2a00:86c0:2091::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.nflxext.com/ffe/siteui/login/images/FB-f-Logo__blue_57.png
Requested by: Host: f9w1lned0ruqblxi6jahwotak.filesusr.com
URL: http://f9w1lned0ruqblxi6jahwotak.filesusr.com/html/c69417_3a78d13182fce9818213d74210e7f8fe.html?*d2hhdhnzyxaxmcpodhrwczovl2rhcmsubmv0zmxpec5pbyphbnnhz18ymtazqghvdg1hawwuy29tkmvzkmpvc2vhc3jvzhjpz3vlemvaz21hawwuy29t
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:86c0:2091::1 , United States, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece

Request headers

Referer: http://f9w1lned0ruqblxi6jahwotak.filesusr.com/html/c69417_3a78d13182fce9818213d74210e7f8fe.html?*d2hhdhnzyxaxmcpodhrwczovl2rhcmsubmv0zmxpec5pbyphbnnhz18ymtazqghvdg1hawwuy29tkmvzkmpvc2vhc3jvzhjpz3vlemvaz21hawwuy29t
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 27 Feb 2021 13:16:03 GMT
Last-Modified: Thu, 30 Jun 2016 17:48:49 GMT
Server: nginx
Content-MD5: ozykfvEQtuPsUIa4d2QH0w==
Content-Type: image/png
Cache-Control: public, max-age=9485
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1455
Expires: Thu, 03 Sep 2020 00:46:18 GMT

GET
H/1.1 200
OK nf-icon-v1-93.woff
assets.nflxext.com/ffe/siteui/fonts/ 72 KB
72 KB 21ms
6ms Font
application/octet-stream 2a00:86c0:2091::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.nflxext.com/ffe/siteui/fonts/nf-icon-v1-93.woff
Requested by: Host: codex.nflxext.com
URL: https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-css-vff980d5b/css/css/less%7Clogin%7CloginBase.less,less%7Cpages%7Clogin%7CLogin.less/1/vFxM3Kw8EJL/none/true/none
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:86c0:2091::1 , United States, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d

Request headers

Origin: http://f9w1lned0ruqblxi6jahwotak.filesusr.com
Referer: https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-css-vff980d5b/css/css/less%7Clogin%7CloginBase.less,less%7Cpages%7Clogin%7CLogin.less/1/vFxM3Kw8EJL/none/true/none
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 27 Feb 2021 13:16:03 GMT
Content-Encoding: gzip
Last-Modified: Mon, 29 Jan 2018 01:50:51 GMT
Server: nginx
Content-MD5: fPYVbMSBJEtaJUNi17c/AA==
Content-Type: text/plain
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=11022
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 73566
Expires: Sun, 06 Sep 2020 03:01:35 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

19 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.nflxext.com
codex.nflxext.com
f9w1lned0ruqblxi6jahwotak.filesusr.com
2a00:86c0:2090::1
2a00:86c0:2091::1
34.102.176.152
2d82fa536e110d6e93bf9d5f017291cdf89ac0f005ed366c40e037c9143fa7d6
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece
5031cf92b3fbacf08a1a32ac5261f809097b64f04fb4c96c2b263b794e926a83
8a99f9e6636b529addd0c288b20751340988174fc6912026b9ba1120533bf276
922cc27512380fc5b4dbb9554c94d664e8e7149234f9fc5c83ad81dbaf08f347
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d
d9bac1aefff045998fd064ed279defcd96c37a53ee0ee3816d1ebab19c1ff739
fbf130ed2e64bf025c167c69e9978010e7100fe23b502e264a5f062010d57be3

f9w1lned0ruqblxi6jahwotak.filesusr.com Open in urlscan Pro 34.102.176.152 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

9 Requests

78 %HTTPS

67 %IPv6

2 Domains

3 Subdomains

3 IPs

1 Countries

870 kBTransfer

1572 kBSize

0 Cookies

8 Outgoing links

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

19 JavaScript Global Variables

0 Cookies

Indicators

f9w1lned0ruqblxi6jahwotak.filesusr.com Open in urlscan Pro
34.102.176.152 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

78 %
HTTPS

67 %
IPv6

2
Domains

3
Subdomains

3
IPs

1
Countries

870 kB
Transfer

1572 kB
Size

0
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!