urlscan.io logo urlscan.io
SecurityTrails logo

netflixedicaolimitada.alla-z.com Open in urlscan Pro
50.116.87.218  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://netflixedicaolimitada.alla-z.com/
Submission Tags: @phishunt_io
Submission: On May 21 via api from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 3 countries across 6 domains to perform 10 HTTP transactions. The main IP is 50.116.87.218, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is netflixedicaolimitada.alla-z.com.
TLS certificate: Issued by R3 on May 21st 2021. Valid for: 3 months.
This is the only time netflixedicaolimitada.alla-z.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

IP Address AS Autonomous System
2 50.116.87.218 46606 (UNIFIEDLA...)
3 2a00:86c0:209... 40027 (NETFLIX-ASN)
1 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
2 2600:1f14:62a... 16509 (AMAZON-02)
1 54.195.251.142 16509 (AMAZON-02)
1 104.111.248.191 16625 (AKAMAI-AS)
10 6
2    50.116.87.218 (United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 50-116-87-218.unifiedlayer.com
netflixedicaolimitada.alla-z.com
3    2a00:86c0:2091::1 (United States)

ASN40027 (NETFLIX-ASN, US)
codex.nflxext.com
assets.nflxext.com
1    2a02:26f0:6c00:286::33c4 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
adtech.nflximg.net
2    2600:1f14:62a:de81:b848:82ee:2416:447e (Boardman, United States)

ASN16509 (AMAZON-02, US)
www.netflix.com
1    54.195.251.142 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-195-251-142.eu-west-1.compute.amazonaws.com
s.thebrighttag.com
1    104.111.248.191 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-248-191.deploy.static.akamaitechnologies.com
s.btstatic.com
Domain Requested by
2 www.netflix.com adtech.nflximg.net
2 assets.nflxext.com codex.nflxext.com
2 netflixedicaolimitada.alla-z.com netflixedicaolimitada.alla-z.com
1 s.btstatic.com s.thebrighttag.com
1 s.thebrighttag.com adtech.nflximg.net
1 adtech.nflximg.net netflixedicaolimitada.alla-z.com
1 codex.nflxext.com netflixedicaolimitada.alla-z.com
10 7

This site contains links to these domains. Also see Links.

Domain
www.netflix.com
help.netflix.com
Subject Issuer Validity Valid
netflixedicaolimitada.alla-z.com
R3		 2021-05-21 -
2021-08-19		 3 months crt.sh
*.1.nflxso.net
DigiCert SHA2 Secure Server CA		 2021-05-11 -
2021-06-10		 a month crt.sh
assets.nflxext.com
DigiCert SHA2 Secure Server CA		 2020-02-19 -
2022-02-19		 2 years crt.sh
www.netflix.com
DigiCert SHA2 Secure Server CA		 2020-01-13 -
2022-01-13		 2 years crt.sh
*.signal.co
Entrust Certification Authority - L1K		 2021-01-26 -
2022-02-25		 a year crt.sh
s.btstatic.com
DigiCert SHA2 Secure Server CA		 2020-02-10 -
2022-02-17		 2 years crt.sh

This page contains 3 frames:

Primary Page: https://netflixedicaolimitada.alla-z.com/
Frame ID: 448DDFFD86DD78D160B549A20D395BD1
Requests: 5 HTTP requests in this frame

Frame: https://adtech.nflximg.net/adtech_iframe_target_03.html?data=%7B%22membership_status%22%3A%22NON_REGISTERED_MEMBER%22%2C%22country%22%3A%22BR%22%2C%22nli%22%3A%229038c8a6-bfea-4abd-9c52-8711d331a07f%22%2C%22fbaId%22%3A%224c43bdd6-826f-466c-8547-423c90bcd11b%22%2C%22is_member%22%3A%22anonymous%22%2C%22wasFormerMember%22%3Afalse%2C%22referrer%22%3A%22planSelectionContext%22%7D
Frame ID: 48007DE6CCDD9BF65DEA13E5E7CA76F9
Requests: 2 HTTP requests in this frame

Frame: https://s.thebrighttag.com/tag?site=voKfK9l&mode=iframe&membership_status=NON_REGISTERED_MEMBER&country=BR&nli=9038c8a6-bfea-4abd-9c52-8711d331a07f&fbaId=4c43bdd6-826f-466c-8547-423c90bcd11b&is_member=anonymous&wasFormerMember=false&referrer=netflix.com%2Fbt%2FplanSelectionContext
Frame ID: 0833B0743C9392F7B68088AA35B8A2E9
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Overall confidence: 100%
Detected patterns
  • html /<[^>]+data-react/i

Page Statistics

10
Requests

100 %
HTTPS

50 %
IPv6

6
Domains

7
Subdomains

6
IPs

3
Countries

128 kB
Transfer

283 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
netflixedicaolimitada.alla-z.com/ 		45 KB
19 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://netflixedicaolimitada.alla-z.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
50.116.87.218 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
50-116-87-218.unifiedlayer.com
Software
Apache /
Resource Hash
64c883ab5d5bc6178c9f166e7b8f4adadbc089698f9aad80079d33a63a57521e

Request headers

:method
GET
:authority
netflixedicaolimitada.alla-z.com
:scheme
https
:path
/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 21 May 2021 14:36:41 GMT
server
Apache
last-modified
Fri, 25 Jan 2019 15:09:36 GMT
accept-ranges
none
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
WebsiteDetect
netflixedicaolimitada.alla-z.com/ichnaea/cl2/freeform/ 		0
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://netflixedicaolimitada.alla-z.com/ichnaea/cl2/freeform/WebsiteDetect?source=wwwhead&fetchType=css&modalView=signupSimplicity-planSelectionWithContext
Requested by
Host: netflixedicaolimitada.alla-z.com
URL: https://netflixedicaolimitada.alla-z.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
50.116.87.218 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
50-116-87-218.unifiedlayer.com
Software
Apache /
Resource Hash

Request headers

:path
/ichnaea/cl2/freeform/WebsiteDetect?source=wwwhead&fetchType=css&modalView=signupSimplicity-planSelectionWithContext
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
netflixedicaolimitada.alla-z.com
referer
https://netflixedicaolimitada.alla-z.com/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://netflixedicaolimitada.alla-z.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 21 May 2021 14:36:41 GMT
content-encoding
gzip
last-modified
Fri, 10 Jul 2020 17:59:55 GMT
server
Apache
vary
Accept-Encoding
content-type
text/html
accept-ranges
bytes
content-length
836
none
codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-shakti-css-c5f5180e/css/css/pages%7Csignup%7Csimplicity%7Csimplicity.less/2/0H0Z0i0f0-0P0N110_0O0X/none/true/ 		128 KB
22 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-shakti-css-c5f5180e/css/css/pages%7Csignup%7Csimplicity%7Csimplicity.less/2/0H0Z0i0f0-0P0N110_0O0X/none/true/none
Requested by
Host: netflixedicaolimitada.alla-z.com
URL: https://netflixedicaolimitada.alla-z.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a00:86c0:2091::1 , United States, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software
nginx /
Resource Hash
13e62f891940f940d0a9da9f175136a9db9e2fbd2e8444792d1fdf3d71126220
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://netflixedicaolimitada.alla-z.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 21 May 2021 14:36:41 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Server
nginx
Transfer-Encoding
chunked
Content-Type
text/css; charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=16070400
req_id
a2ee9a3a-1999-4d68-8434-ce275c00ea1c
Connection
keep-alive
Timing-Allow-Origin
https://www.netflix.com
Expires
Tue, 23 Nov 2021 14:36:41 GMT
adtech_iframe_target_03.html
adtech.nflximg.net/ Frame 4800 		4 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://adtech.nflximg.net/adtech_iframe_target_03.html?data=%7B%22membership_status%22%3A%22NON_REGISTERED_MEMBER%22%2C%22country%22%3A%22BR%22%2C%22nli%22%3A%229038c8a6-bfea-4abd-9c52-8711d331a07f%22%2C%22fbaId%22%3A%224c43bdd6-826f-466c-8547-423c90bcd11b%22%2C%22is_member%22%3A%22anonymous%22%2C%22wasFormerMember%22%3Afalse%2C%22referrer%22%3A%22planSelectionContext%22%7D
Requested by
Host: netflixedicaolimitada.alla-z.com
URL: https://netflixedicaolimitada.alla-z.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:286::33c4 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
86d5daa181723d4ad30bce3d50305b19a4c271e4b8c2a878e9809d160d48b310

Request headers

Host
adtech.nflximg.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://netflixedicaolimitada.alla-z.com/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://netflixedicaolimitada.alla-z.com/

Response headers

Accept-Ranges
bytes
Content-Type
text/html
ETag
"15ea117e697201fb35e5598e829da564:1473219202"
Last-Modified
Wed, 07 Sep 2016 03:33:19 GMT
Server
AkamaiNetStorage
Vary
Accept-Encoding
Content-Encoding
gzip
Date
Fri, 21 May 2021 14:36:41 GMT
Content-Length
1403
Connection
keep-alive
Checkmark.png
assets.nflxext.com/ffe/siteui/acquisition/simplicity/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.nflxext.com/ffe/siteui/acquisition/simplicity/Checkmark.png
Requested by
Host: codex.nflxext.com
URL: https://codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-shakti-css-c5f5180e/css/css/pages%7Csignup%7Csimplicity%7Csimplicity.less/2/0H0Z0i0f0-0P0N110_0O0X/none/true/none
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a00:86c0:2091::1 , United States, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software
nginx /
Resource Hash
421fda28f37b12f33bd0d268a14a0acc0b996b69497896fe66f4f4681bdf0c9c

Request headers

Referer
https://codex.nflxext.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 21 May 2021 14:36:41 GMT
Last-Modified
Fri, 26 Feb 2016 23:48:46 GMT
Server
nginx
Content-MD5
2tlyh/5kP9TN++aHFQ/YiA==
Content-Type
image/png
Cache-Control
max-age=604801
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
3249
Expires
Mon, 24 Aug 2020 21:44:44 GMT
nf-icon-v1-88.woff
assets.nflxext.com/ffe/siteui/fonts/ 		69 KB
69 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://assets.nflxext.com/ffe/siteui/fonts/nf-icon-v1-88.woff
Requested by
Host: codex.nflxext.com
URL: https://codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-shakti-css-c5f5180e/css/css/pages%7Csignup%7Csimplicity%7Csimplicity.less/2/0H0Z0i0f0-0P0N110_0O0X/none/true/none
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a00:86c0:2091::1 , United States, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software
nginx /
Resource Hash
ba892f7903e737d06c952be4ed3266746ed5e1090377fbc5d2ac975626c4533a

Request headers

Origin
https://netflixedicaolimitada.alla-z.com
Referer
https://codex.nflxext.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 21 May 2021 14:36:41 GMT
Last-Modified
Fri, 27 Jan 2017 22:53:52 GMT
Server
nginx
Content-MD5
ezBCotj2o1GiKPEVK1YDAg==
Content-Type
font/woff
Access-Control-Allow-Origin
*
Cache-Control
max-age=604801
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
70204
Expires
Fri, 14 May 2021 23:27:51 GMT
log
www.netflix.com/ichnaea/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://www.netflix.com/ichnaea/log
Protocol
H2
Server
2600:1f14:62a:de81:b848:82ee:2416:447e Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
clingest-secure i-083426d5c5704f80c /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block; report=https://www.netflix.com/ichnaea/log/freeform/xssreport

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
content-type,x-netflix.ichnaea.request.type
Origin
https://adtech.nflximg.net
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

access-control-allow-origin
https://adtech.nflximg.net
access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Content-Type,Cookie,debugRequest,X-Netflix.application.name,X-Netflix.application.version,X-Netflix.certification.version,X-Netflix.Client.Request.Name,X-Netflix.device.type,X-Netflix.esn,X-Netflix.ichnaea.request.type,X-Netflix.oauth.consumer.key,X-Netflix.oauth.token,X-Netflix.request.uuid,X-Netflix.user.id
access-control-allow-methods
GET, POST, OPTIONS
allow
GET, POST, OPTIONS
vary
Origin Access-Control-Request-Method Access-Control-Request-Headers
date
Fri, 21 May 2021 14:36:41 GMT
via
1.1 i-0586eb2373c3f0425 (us-east-1), 2 i-0a62a3c02c542aea1 (us-west-2)
server
clingest-secure i-083426d5c5704f80c
x-xss-protection
1; mode=block; report=https://www.netflix.com/ichnaea/log/freeform/xssreport
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
x-originating-url
https://www.netflix.com/ichnaea/log
x-netflix_nfstatus
1_1
content-length
0
x-netflix_proxy_execution-time
232
log
www.netflix.com/ichnaea/ Frame 4800 		0
976 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.netflix.com/ichnaea/log
Requested by
Host: adtech.nflximg.net
URL: https://adtech.nflximg.net/adtech_iframe_target_03.html?data=%7B%22membership_status%22%3A%22NON_REGISTERED_MEMBER%22%2C%22country%22%3A%22BR%22%2C%22nli%22%3A%229038c8a6-bfea-4abd-9c52-8711d331a07f%22%2C%22fbaId%22%3A%224c43bdd6-826f-466c-8547-423c90bcd11b%22%2C%22is_member%22%3A%22anonymous%22%2C%22wasFormerMember%22%3Afalse%2C%22referrer%22%3A%22planSelectionContext%22%7D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1f14:62a:de81:b848:82ee:2416:447e Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
clingest-secure i-027f1fed72876db44 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

X-Netflix.ichnaea.request.type
IchnaeaRequest
Referer
https://adtech.nflximg.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/json

Response headers

date
Fri, 21 May 2021 14:36:42 GMT
via
1.1 i-02b9b1c9b1ea4e4a0 (us-east-1), 2 i-06253b3eb6490c03b (us-west-2)
x-content-type-options
nosniff
x-netflix_proxy_execution-time
89
content-length
0
x-xss-protection
1; mode=block
pragma
no-cache
allow
GET, POST, OPTIONS
server
clingest-secure i-027f1fed72876db44
x-frame-options
DENY
x-netflix_nfstatus
1_1
strict-transport-security
max-age=31536000
access-control-allow-methods
GET, POST, OPTIONS
x-originating-url
https://www.netflix.com/ichnaea/log
access-control-allow-origin
https://adtech.nflximg.net
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
x-ichnaea
~0=true~RL=0
access-control-allow-headers
Accept,Authorization,Content-Type,Cookie,debugRequest,X-Netflix.application.name,X-Netflix.application.version,X-Netflix.certification.version,X-Netflix.Client.Request.Name,X-Netflix.device.type,X-Netflix.esn,X-Netflix.ichnaea.request.type,X-Netflix.oauth.consumer.key,X-Netflix.oauth.token,X-Netflix.request.uuid,X-Netflix.user.id
expires
0
tag
s.thebrighttag.com/ Frame 0833 		203 B
559 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.thebrighttag.com/tag?site=voKfK9l&mode=iframe&membership_status=NON_REGISTERED_MEMBER&country=BR&nli=9038c8a6-bfea-4abd-9c52-8711d331a07f&fbaId=4c43bdd6-826f-466c-8547-423c90bcd11b&is_member=anonymous&wasFormerMember=false&referrer=netflix.com%2Fbt%2FplanSelectionContext
Requested by
Host: adtech.nflximg.net
URL: https://adtech.nflximg.net/adtech_iframe_target_03.html?data=%7B%22membership_status%22%3A%22NON_REGISTERED_MEMBER%22%2C%22country%22%3A%22BR%22%2C%22nli%22%3A%229038c8a6-bfea-4abd-9c52-8711d331a07f%22%2C%22fbaId%22%3A%224c43bdd6-826f-466c-8547-423c90bcd11b%22%2C%22is_member%22%3A%22anonymous%22%2C%22wasFormerMember%22%3Afalse%2C%22referrer%22%3A%22planSelectionContext%22%7D
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
54.195.251.142 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-195-251-142.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
9acc4d33994ee010a6b6a0f1467c30596934705750f0158a7bcf3907cea2eb2d

Request headers

Host
s.thebrighttag.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://adtech.nflximg.net/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://adtech.nflximg.net/

Response headers

Server
nginx
Date
Fri, 21 May 2021 14:36:41 GMT
Content-Type
text/html
Content-Length
176
Connection
keep-alive
ETag
ff569c8eabc22f2081b5544699be5c24
Pragma
no-cache
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control
private, must-revalidate
X-BT-RequestId
f57b9650-ba41-11eb-b7fe-0000ac150901
content-encoding
gzip
P3P
CP=NOI DSP COR NID
tag.js
s.btstatic.com/ Frame 0833 		34 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.btstatic.com/tag.js
Requested by
Host: s.thebrighttag.com
URL: https://s.thebrighttag.com/tag?site=voKfK9l&mode=iframe&membership_status=NON_REGISTERED_MEMBER&country=BR&nli=9038c8a6-bfea-4abd-9c52-8711d331a07f&fbaId=4c43bdd6-826f-466c-8547-423c90bcd11b&is_member=anonymous&wasFormerMember=false&referrer=netflix.com%2Fbt%2FplanSelectionContext
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.111.248.191 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-248-191.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
5c2b76989e49a2bd8c651a35634fd43081b13bde1a6385fb8e36dccc1d0d42d8

Request headers

Referer
https://s.thebrighttag.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id
M1.rBdFPkYUZAqbwA8PPsZwez29wDB5e
Content-Encoding
gzip
Last-Modified
Wed, 31 Mar 2021 18:58:47 GMT
Server
nginx
ETag
"00faca760dbffa8181ab5101a52189e7"
Vary
Accept-Encoding
P3P
CP=NOI DSP COR NID
Cache-Control
max-age=14400
Date
Fri, 21 May 2021 14:36:41 GMT
Connection
keep-alive
Content-Type
application/javascript; charset=utf-8
Content-Length
12525

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated

0 Cookies