help.netflix.info-ro.com
Open in
urlscan Pro
162.241.60.198
Malicious Activity!
Public Scan
Submission Tags: @jcybersec_
Submission: On May 28 via api from GB
Summary
This is the only time help.netflix.info-ro.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Netflix (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
6 | 162.241.60.198 162.241.60.198 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
2 | 2a00:86c0:209... 2a00:86c0:2090::1 | 40027 (NETFLIX-ASN) (NETFLIX-ASN) | |
8 | 2 |
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 162-241-60-198.unifiedlayer.com
help.netflix.info-ro.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
info-ro.com
help.netflix.info-ro.com |
34 KB |
2 |
nflxext.com
assets.nflxext.com |
380 KB |
8 | 2 |
Domain | Requested by | |
---|---|---|
6 | help.netflix.info-ro.com |
help.netflix.info-ro.com
|
2 | assets.nflxext.com |
help.netflix.info-ro.com
|
8 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.1.nflxso.net DigiCert SHA2 Secure Server CA |
2020-05-13 - 2020-06-15 |
a month | crt.sh |
This page contains 1 frames:
Primary Page:
http://help.netflix.info-ro.com/locale=ro-RO/editcredit/0c7119e3a6a2209da6a5b90e5b5b75bd/signin.php?country=SE-Sweden&lang=en
Frame ID: E7CC6BAD1BE260F07D83DDA002CA8B55
Requests: 8 HTTP requests in this frame
Screenshot
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- url /\.php(?:$|\?)/i
Apache (Web Servers) Expand
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
React (JavaScript Frameworks) Expand
Detected patterns
- html /<[^>]+data-react/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
8 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
signin.php
help.netflix.info-ro.com/locale=ro-RO/editcredit/0c7119e3a6a2209da6a5b90e5b5b75bd/ |
8 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
codex.login.css
help.netflix.info-ro.com/locale=ro-RO/editcredit/0c7119e3a6a2209da6a5b90e5b5b75bd/Netflix_files/ |
149 KB 29 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
signin.css
help.netflix.info-ro.com/locale=ro-RO/editcredit/0c7119e3a6a2209da6a5b90e5b5b75bd/Netflix_files/ |
2 KB 787 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.min.js.t%C3%A9l%C3%A9chargement
help.netflix.info-ro.com/locale=ro-RO/editcredit/0c7119e3a6a2209da6a5b90e5b5b75bd/Netflix_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
FB-f-Logo__blue_57.png
help.netflix.info-ro.com/locale=ro-RO/editcredit/0c7119e3a6a2209da6a5b90e5b5b75bd/Netflix_files/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
DZ-en-20180813-popsignuptwoweeks-perspective_alpha_website_large.jpg
assets.nflxext.com/ffe/siteui/vlv3/bd27b60f-02db-41da-8f5c-1558b01b44d0/17a20159-6c8b-4e60-be30-becbc0268684/ |
324 KB 324 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
nf-icon-v1-93.woff
help.netflix.info-ro.com/locale=ro-RO/editcredit/0c7119e3a6a2209da6a5b90e5b5b75bd/Netflix_files/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
nf-icon-v1-93.ttf
assets.nflxext.com/ffe/siteui/fonts/ |
92 KB 56 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Netflix (Online)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
assets.nflxext.com
help.netflix.info-ro.com
162.241.60.198
2a00:86c0:2090::1
3b9e059dcdf8b8fde48315fa28254bb2d6ceaeaebc0643721194baddccc0b4da
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece
4ae58d47961137684b3aab1178b303d1afc30501da65087122dc59dd6d00ad44
b276f78e16684b9a430b082d9d0d018316c523590015631fb5ad15aa705a0f03
df9a8b117a4fd266818dee3d12d7080ebdc7d1e1802445d3584d2c7d78bd9725
fe8402a9358de9060c332a9eeb46a29add067639751ca10a62e06eeed66a900f