ec2-52-65-239-39.ap-southeast-2.compute.amazonaws.com
Open in
urlscan Pro
52.65.239.39
Malicious Activity!
Public Scan
Submission: On August 04 via automatic, source phishtank
Summary
This is the only time ec2-52-65-239-39.ap-southeast-2.compute.amazonaws.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Netflix (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 8 | 52.65.239.39 52.65.239.39 | 16509 (AMAZON-02) (AMAZON-02) | |
4 | 2a00:86c0:209... 2a00:86c0:2091::1 | 40027 (NETFLIX-ASN) (NETFLIX-ASN) | |
7 | 2a00:86c0:209... 2a00:86c0:2090::1 | 40027 (NETFLIX-ASN) (NETFLIX-ASN) | |
1 3 | 91.235.133.103 91.235.133.103 | 30286 (THM) (THM) | |
20 | 4 |
ASN16509 (AMAZON-02, US)
PTR: ec2-52-65-239-39.ap-southeast-2.compute.amazonaws.com
ec2-52-65-239-39.ap-southeast-2.compute.amazonaws.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
nflxext.com
codex.nflxext.com assets.nflxext.com |
696 KB |
8 |
amazonaws.com
1 redirects
ec2-52-65-239-39.ap-southeast-2.compute.amazonaws.com |
60 KB |
3 |
netflix.com
1 redirects
secured.netflix.com |
1 KB |
20 | 3 |
Domain | Requested by | |
---|---|---|
8 | ec2-52-65-239-39.ap-southeast-2.compute.amazonaws.com |
1 redirects
ec2-52-65-239-39.ap-southeast-2.compute.amazonaws.com
codex.nflxext.com |
7 | assets.nflxext.com |
ec2-52-65-239-39.ap-southeast-2.compute.amazonaws.com
|
4 | codex.nflxext.com |
ec2-52-65-239-39.ap-southeast-2.compute.amazonaws.com
|
3 | secured.netflix.com |
1 redirects
ec2-52-65-239-39.ap-southeast-2.compute.amazonaws.com
|
20 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
help.netflix.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.1.nflxso.net DigiCert SHA2 Secure Server CA |
2020-07-24 - 2020-08-26 |
a month | crt.sh |
secured.netflix.com DigiCert SHA2 Secure Server CA |
2020-01-27 - 2021-01-27 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
http://ec2-52-65-239-39.ap-southeast-2.compute.amazonaws.com/9f1ae8fdd0adf18/
Frame ID: 69A16082FD49C1B422A26FD863BD30D7
Requests: 20 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://ec2-52-65-239-39.ap-southeast-2.compute.amazonaws.com/9f1ae8fdd0adf18
HTTP 301
http://ec2-52-65-239-39.ap-southeast-2.compute.amazonaws.com/9f1ae8fdd0adf18/ Page URL
Detected technologies
Windows Server (Operating Systems) ExpandDetected patterns
- headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i
IIS (Web Servers) Expand
Detected patterns
- headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i
Page Statistics
6 Outgoing links
These are links going to different origins than the main page.
Title: FAQ
Search URL Search Domain Scan URL
Title: Help Center
Search URL Search Domain Scan URL
Title: Terms of Use
Search URL Search Domain Scan URL
Title: Privacy
Search URL Search Domain Scan URL
Title: Cookie Preferences
Search URL Search Domain Scan URL
Title: Corporate Information
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://ec2-52-65-239-39.ap-southeast-2.compute.amazonaws.com/9f1ae8fdd0adf18
HTTP 301
http://ec2-52-65-239-39.ap-southeast-2.compute.amazonaws.com/9f1ae8fdd0adf18/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 9- https://secured.netflix.com/fp/clear.png?org_id=lg9m47ph&session_id=81baa1e0-a1f6-4c56-9d29-6a190901dda1&m=2 HTTP 302
- https://secured.netflix.com/fp/clear.png?org_id=lg9m47ph&session_id=81baa1e0-a1f6-4c56-9d29-6a190901dda1&k=1
20 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
ec2-52-65-239-39.ap-southeast-2.compute.amazonaws.com/9f1ae8fdd0adf18/ Redirect Chain
|
356 KB 53 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
none
codex.nflxext.com/%5E3.0.0/truthBundle/webui/0.0.1-shakti-js-ve0d6d2cb/js/js/bootstrap.js,common%7Cbootstrap.js/2/4K034j494l4z05454t4J070o004L4o4v4m4F4b4u4x4d4c0a024H13/bck/true/ |
9 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
none
codex.nflxext.com/%5E3.0.0/truthBundle/webui/0.0.1-shakti-js-ve0d6d2cb/js/js/signup%7Csimplicity%7CsimpleSignupClient.js/2/4K034j494l4z05454t4J070o004L4o4v4m4F4b4u4x4d4c0a024H13/l/true/ |
2 MB 466 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
WebsiteDetect
ec2-52-65-239-39.ap-southeast-2.compute.amazonaws.com/personalization/cl2/freeform/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
none
codex.nflxext.com/%5E3.0.0/truthBundle/webui/0.0.1-shakti-css-ve0d6d2cb/css/css/less%7Ccore%7Cerror-page.less/1/vFxM3w8EJL/none/true/ |
11 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
none
codex.nflxext.com/%5E3.0.0/truthBundle/webui/0.0.1-shakti-css-ve0d6d2cb/css/css/less%7Cpages%7Csignup%7Csimplicity%7Csimplicity.less/1/vFxM3w8EJL/none/true/ |
207 KB 36 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
visa-v2.svg
assets.nflxext.com/ffe/siteui/acquisition/payment/svg/ |
1 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mastercard-v2.svg
assets.nflxext.com/ffe/siteui/acquisition/payment/svg/ |
3 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
amex-v2.svg
assets.nflxext.com/ffe/siteui/acquisition/payment/svg/ |
3 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon_discover.png
assets.nflxext.com/ffe/siteui/acquisition/payment/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
clear.png
secured.netflix.com/fp/ Redirect Chain
|
81 B 474 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
WebsiteDetect
ec2-52-65-239-39.ap-southeast-2.compute.amazonaws.com/personalization/cl2/freeform/ |
1 KB 1 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
NetflixSans_W_Rg.woff2
assets.nflxext.com/ffe/siteui/fonts/netflix-sans/v3/ |
52 KB 52 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
clear.png
secured.netflix.com/fp/ |
81 B 474 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
NetflixSans_W_Md.woff2
assets.nflxext.com/ffe/siteui/fonts/netflix-sans/v3/ |
53 KB 53 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
nf-icon-v1-93.woff
assets.nflxext.com/ffe/siteui/fonts/ |
72 KB 72 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
log
ec2-52-65-239-39.ap-southeast-2.compute.amazonaws.com/personalization/ |
1 KB 1 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
cl2
ec2-52-65-239-39.ap-southeast-2.compute.amazonaws.com/personalization/ |
1 KB 1 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
cl2
ec2-52-65-239-39.ap-southeast-2.compute.amazonaws.com/personalization/ |
1 KB 1 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
cl2
ec2-52-65-239-39.ap-southeast-2.compute.amazonaws.com/personalization/ |
1 KB 1 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Netflix (Online)8 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| netflix object| Codex object| C object| global object| process object| util function| jQuery object| jQuery1111056535046036677431 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.ec2-52-65-239-39.ap-southeast-2.compute.amazonaws.com/ | Name: cL Value: 1596558600817%7C159655860046882121%7C159655860058517288%7C%7C4%7C4KKSXXGSLBE63GB6DRPOGFT4SA |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
assets.nflxext.com
codex.nflxext.com
ec2-52-65-239-39.ap-southeast-2.compute.amazonaws.com
secured.netflix.com
2a00:86c0:2090::1
2a00:86c0:2091::1
52.65.239.39
91.235.133.103
5069c31661d5f292883bf46fcf480947d2ed3aac5a777afadc3833c5e9861f24
573b74c3ba28c5ad535fb8a365253670fae4e585930bee4e996b031a013da533
61c3738272cf954cc5afab921385ac1d43fb1cfef827be5a457d1405d37c84d8
7601455c0af7c3e0d8e64a288249c254b8fc1b257350613a6cdd1e1aaca9a3e4
896f4bfd636c4428757955d428c40c5a5d2a181a3232404704fe539c3b079f23
95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d
9a4620a32974adc5764f26a8070cd432aa32ba8be3167320fd32bcd9cdcaed08
9ac2bd03fcde501b3f30f47ab1fae62161f87808ea6411f38e8feaa4bbddc42e
b9549ed9f720d016addcc927627163f3e197f00abc8032d4ee571c4a9909409c
c0bceb927c506dce9f6e6f5f570e641ad580b9554be06f61508a4aee32380167
c5b725b9ce26dc374999c18d62d2ab0ee2dd4336d49c87b7f03fd7ceccc30f68
d0369ae39c0d3ecfe1fabcfa797f05750d296a3c53bbc50fac25314a0cefa8ce
dc1d54dab6ec8c00f70137927504e4f222c8395f10760b6beecfcfa94e08249f