ecertificatewala.com Open in urlscan Pro
50.63.14.127 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://ecertificatewala.com/.well-known/NL
Effective URL:
https://ecertificatewala.com/.well-known/NL/d63514f3bdf813d002e74f7090215522/
Submission: On March 22 via api (March 22nd 2020, 12:30:51 pm UTC) from BE

Summary HTTP 10 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 10 HTTP transactions. The main IP is 50.63.14.127, located in Scottsdale, United States and belongs to AS-26496-GO-DADDY-COM-LLC, US. The main domain is ecertificatewala.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on February 28th 2020. Valid for: 3 months.

This is the only time ecertificatewala.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

	IP Address	AS Autonomous System
3 8	50.63.14.127 50.63.14.127	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC)
3	2a00:86c0:209... 2a00:86c0:2090::1	40027 (NETFLIX-ASN) (NETFLIX-ASN)
2	2a00:86c0:209... 2a00:86c0:2091::1	40027 (NETFLIX-ASN) (NETFLIX-ASN)
10	3

8 50.63.14.127 (Scottsdale, United States) 3 redirects

ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: ip-50-63-14-127.ip.secureserver.net

ecertificatewala.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:86c0:2090::1 (United Kingdom)

ASN40027 (NETFLIX-ASN, US)

codex.nflxext.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:86c0:2091::1 (United Kingdom)

ASN40027 (NETFLIX-ASN, US)

assets.nflxext.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	ecertificatewala.com 3 redirects ecertificatewala.com	327 KB
5	nflxext.com codex.nflxext.com assets.nflxext.com	647 KB
10	2

	Domain	Requested by
8	ecertificatewala.com	3 redirects ecertificatewala.com codex.nflxext.com
3	codex.nflxext.com	ecertificatewala.com
2	assets.nflxext.com	ecertificatewala.com
10	3

This site contains links to these domains. Also see Links.

Domain
help..com

Subject Issuer	Validity	Valid
ecertificatewala.com cPanel, Inc. Certification Authority	`2020-02-28` - `2020-05-28`	3 months	crt.sh
*.1.nflxso.net DigiCert SHA2 Secure Server CA	`2020-03-07` - `2020-04-07`	a month	crt.sh

This page contains 1 frames:

Primary Page: https://ecertificatewala.com/.well-known/NL/d63514f3bdf813d002e74f7090215522/
Frame ID: 8684C3865B474B4F44C56513E07F9407
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://ecertificatewala.com/.well-known/NL HTTP 301
https://ecertificatewala.com/.well-known/NL/ HTTP 302
https://ecertificatewala.com/.well-known/NL/d63514f3bdf813d002e74f7090215522 HTTP 301
https://ecertificatewala.com/.well-known/NL/d63514f3bdf813d002e74f7090215522/ Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

React (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<[^>]+data-react/i

Page Statistics

10
Requests

100 %
HTTPS

67 %
IPv6

2
Domains

3
Subdomains

3
IPs

2
Countries

973 kB
Transfer

1537 kB
Size

1
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://help..com/legal/termsofuse
Title: Gebruiksvoorwaarden

Search URL Search Domain Scan URL

URL: https://help..com/legal/privacy
Title: Privacyverklaring

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://ecertificatewala.com/.well-known/NL HTTP 301
https://ecertificatewala.com/.well-known/NL/ HTTP 302
https://ecertificatewala.com/.well-known/NL/d63514f3bdf813d002e74f7090215522 HTTP 301
https://ecertificatewala.com/.well-known/NL/d63514f3bdf813d002e74f7090215522/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
ecertificatewala.com/.well-known/NL/d63514f3bdf813d002e74f7090215522/
Redirect Chain

https://ecertificatewala.com/.well-known/NL
https://ecertificatewala.com/.well-known/NL/
https://ecertificatewala.com/.well-known/NL/d63514f3bdf813d002e74f7090215522
https://ecertificatewala.com/.well-known/NL/d63514f3bdf813d002e74f7090215522/

323 KB
324 KB

441ms
440ms

Document
text/html

50.63.14.127
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: https://ecertificatewala.com/.well-known/NL/d63514f3bdf813d002e74f7090215522/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 50.63.14.127 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: ip-50-63-14-127.ip.secureserver.net
Software: Apache /
Resource Hash: 513a48740ec32bd338b529617421735e4538223d82dbb5a33c24c0ad3271291e

Request headers

Host: ecertificatewala.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document

Response headers

Date: Sun, 22 Mar 2020 12:30:34 GMT
Server: Apache
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

Redirect headers

Date: Sun, 22 Mar 2020 12:30:34 GMT
Server: Apache
Location: https://ecertificatewala.com/.well-known/NL/d63514f3bdf813d002e74f7090215522/
Content-Length: 285
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK none Show response
codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-shakti-js-mk-vd3ac2e8a/js/js/bootstrap.js,common%7Cbootstrap.js/2/4Z034u4t4e4w084h4a4A4Y060u004_4z4C4x0f4Q4O4M4i4B4r4E024U/bck/true/ 9 KB
4 KB 43ms
8ms Script
application/javascript 2a00:86c0:2090::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-shakti-js-mk-vd3ac2e8a/js/js/bootstrap.js,common%7Cbootstrap.js/2/4Z034u4t4e4w084h4a4A4Y060u004_4z4C4x0f4Q4O4M4i4B4r4E024U/bck/true/none

Requested by

Host: ecertificatewala.com
URL: https://ecertificatewala.com/.well-known/NL/d63514f3bdf813d002e74f7090215522/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a00:86c0:2090::1 , United Kingdom, ASN40027 (NETFLIX-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

015a58aba75e0e8eed3a5ae186a423fec5f0b7b735666049f83d8febb46b06b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://ecertificatewala.com/.well-known/NL/d63514f3bdf813d002e74f7090215522/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Sun, 22 Mar 2020 12:30:34 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx
Content-Type: application/javascript; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=16070400
req_id: 9c42b2cb-874e-4ff4-b030-7d00dc62830d
Connection: keep-alive
Timing-Allow-Origin: https://www.netflix.com
Content-Length: 3480
Expires: Wed, 23 Sep 2020 20:53:01 GMT

GET
H/1.1 200
OK none Show response
codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-shakti-js-mk-vd3ac2e8a/js/js/components%7Clogin%7CloginControllerClient.js/2/4Z034u4t4e4w084h4a4A4Y060u004_4z4C4x0f4Q4O4M4i4B4r4E024U/l/true/ 666 KB
209 KB 50ms
10ms Script
application/javascript 2a00:86c0:2090::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-shakti-js-mk-vd3ac2e8a/js/js/components%7Clogin%7CloginControllerClient.js/2/4Z034u4t4e4w084h4a4A4Y060u004_4z4C4x0f4Q4O4M4i4B4r4E024U/l/true/none

Requested by

Host: ecertificatewala.com
URL: https://ecertificatewala.com/.well-known/NL/d63514f3bdf813d002e74f7090215522/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a00:86c0:2090::1 , United Kingdom, ASN40027 (NETFLIX-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

b2482301af1ac6d03a5f2eb91520f1e472302130011bcde9d78c5c829cce2e47

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://ecertificatewala.com/.well-known/NL/d63514f3bdf813d002e74f7090215522/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Sun, 22 Mar 2020 12:30:34 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx
Content-Type: application/javascript; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=16070400
req_id: d2987101-21d5-4578-b918-50ac79d33bd0
Connection: keep-alive
Timing-Allow-Origin: https://www.netflix.com
Content-Length: 213199
Expires: Thu, 24 Sep 2020 06:42:25 GMT

GET
H/1.1 500
Internal Server Error WebsiteDetect
ecertificatewala.com/personalization/cl2/freeform/ 0
0 162ms
160ms Stylesheet
text/html 50.63.14.127
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: https://ecertificatewala.com/personalization/cl2/freeform/WebsiteDetect?source=wwwhead&fetchType=css&modalView=login
Requested by: Host: ecertificatewala.com
URL: https://ecertificatewala.com/.well-known/NL/d63514f3bdf813d002e74f7090215522/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 50.63.14.127 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: ip-50-63-14-127.ip.secureserver.net
Software: Apache /
Resource Hash

Request headers

Referer: https://ecertificatewala.com/.well-known/NL/d63514f3bdf813d002e74f7090215522/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

Date: Sun, 22 Mar 2020 12:30:34 GMT
Server: Apache
Connection: close
Content-Length: 674
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK none
codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-shakti-css-vd3ac2e8a/css/css/less%7Clogin%7CloginBase.less,less%7Cpages%7Clogin%7CLogin.less/1/AI4rD9CNTKEHSPW/none/true/ 124 KB
21 KB 38ms
6ms Stylesheet
text/css 2a00:86c0:2090::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-shakti-css-vd3ac2e8a/css/css/less%7Clogin%7CloginBase.less,less%7Cpages%7Clogin%7CLogin.less/1/AI4rD9CNTKEHSPW/none/true/none

Requested by

Host: ecertificatewala.com
URL: https://ecertificatewala.com/.well-known/NL/d63514f3bdf813d002e74f7090215522/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a00:86c0:2090::1 , United Kingdom, ASN40027 (NETFLIX-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

154e9866c94f43a17d75aed32adc27020f95f614232f8b3cfedd7fc4bf2a48d3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://ecertificatewala.com/.well-known/NL/d63514f3bdf813d002e74f7090215522/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

Date: Sun, 22 Mar 2020 12:30:34 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx
Content-Type: text/css; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=16070400
req_id: 7331d216-dd98-45bb-b447-d48a29e70b31
Connection: keep-alive
Timing-Allow-Origin: https://www.netflix.com
Content-Length: 20835
Expires: Thu, 24 Sep 2020 07:22:12 GMT

GET
H/1.1 200
OK ES-es-20190311-popsignuptwoweeks-perspective_alpha_website_large.jpg
assets.nflxext.com/ffe/siteui/vlv3/8428eba7-ed9f-44a5-b263-496900005b56/3ecbf985-674a-4c66-a88c-07a6c34a5362/ 341 KB
341 KB 145ms
124ms Image
image/jpeg 2a00:86c0:2091::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.nflxext.com/ffe/siteui/vlv3/8428eba7-ed9f-44a5-b263-496900005b56/3ecbf985-674a-4c66-a88c-07a6c34a5362/ES-es-20190311-popsignuptwoweeks-perspective_alpha_website_large.jpg
Requested by: Host: ecertificatewala.com
URL: https://ecertificatewala.com/.well-known/NL/d63514f3bdf813d002e74f7090215522/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a00:86c0:2091::1 , United Kingdom, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 8d842cf193c0b64aa139855e78fa16a4900c6df4491f015d6b2d7798f061ec48

Request headers

Referer: https://ecertificatewala.com/.well-known/NL/d63514f3bdf813d002e74f7090215522/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Sun, 22 Mar 2020 12:30:34 GMT
Last-Modified: Wed, 13 Mar 2019 13:39:46 GMT
Server: nginx
Content-MD5: s2ynmclL/8FCrzyRSd+5KA==
Content-Type: image/jpeg
Cache-Control: public, max-age=2100566
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 349058
Expires: Wed, 15 Apr 2020 20:00:00 GMT

GET
H/1.1 500
Internal Server Error WebsiteDetect Show response
ecertificatewala.com/personalization/cl2/freeform/ 674 B
850 B 472ms
158ms XHR
text/html 50.63.14.127
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: https://ecertificatewala.com/personalization/cl2/freeform/WebsiteDetect?source=wwwhead&fetchType=js&modalView=login
Requested by: Host: ecertificatewala.com
URL: https://ecertificatewala.com/.well-known/NL/d63514f3bdf813d002e74f7090215522/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 50.63.14.127 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: ip-50-63-14-127.ip.secureserver.net
Software: Apache /
Resource Hash: ccd46009c8dd1767b90d22595a23b2130cf131ee62cca9a652b15b3398f5bcae

Request headers

Referer: https://ecertificatewala.com/.well-known/NL/d63514f3bdf813d002e74f7090215522/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

Date: Sun, 22 Mar 2020 12:30:35 GMT
Server: Apache
Connection: close
Content-Length: 674
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 500
Internal Server Error WebsiteScreen Show response
ecertificatewala.com/personalization/cl2/freeform/ 674 B
850 B 473ms
158ms XHR
text/html 50.63.14.127
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: https://ecertificatewala.com/personalization/cl2/freeform/WebsiteScreen?source=wwwhead&fetchType=js&winw=1600&winh=1200&screenw=1600&screenh=1200&ratio=1
Requested by: Host: ecertificatewala.com
URL: https://ecertificatewala.com/.well-known/NL/d63514f3bdf813d002e74f7090215522/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 50.63.14.127 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: ip-50-63-14-127.ip.secureserver.net
Software: Apache /
Resource Hash: ccd46009c8dd1767b90d22595a23b2130cf131ee62cca9a652b15b3398f5bcae

Request headers

Referer: https://ecertificatewala.com/.well-known/NL/d63514f3bdf813d002e74f7090215522/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

Date: Sun, 22 Mar 2020 12:30:35 GMT
Server: Apache
Connection: close
Content-Length: 674
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK nf-icon-v1-93.woff
assets.nflxext.com/ffe/siteui/fonts/ 72 KB
72 KB 43ms
13ms Font
font/woff 2a00:86c0:2091::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.nflxext.com/ffe/siteui/fonts/nf-icon-v1-93.woff
Requested by: Host: ecertificatewala.com
URL: https://ecertificatewala.com/.well-known/NL/d63514f3bdf813d002e74f7090215522/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a00:86c0:2091::1 , United Kingdom, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d

Request headers

Referer: https://codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-shakti-css-vd3ac2e8a/css/css/less%7Clogin%7CloginBase.less,less%7Cpages%7Clogin%7CLogin.less/1/AI4rD9CNTKEHSPW/none/true/none
Origin: https://ecertificatewala.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sun, 22 Mar 2020 12:30:35 GMT
Last-Modified: Mon, 29 Jan 2018 01:50:51 GMT
Server: nginx
Content-MD5: fPYVbMSBJEtaJUNi17c/AA==
Content-Type: font/woff
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=6621670
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 73572
Expires: Wed, 15 Apr 2020 20:00:00 GMT

POST
H/1.1 500
Internal Server Error log Show response
ecertificatewala.com/personalization/ 674 B
850 B 159ms
159ms XHR
text/html 50.63.14.127
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: https://ecertificatewala.com/personalization/log
Requested by: Host: codex.nflxext.com
URL: https://codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-shakti-js-mk-vd3ac2e8a/js/js/components%7Clogin%7CloginControllerClient.js/2/4Z034u4t4e4w084h4a4A4Y060u004_4z4C4x0f4Q4O4M4i4B4r4E024U/l/true/none
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 50.63.14.127 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: ip-50-63-14-127.ip.secureserver.net
Software: Apache /
Resource Hash: ccd46009c8dd1767b90d22595a23b2130cf131ee62cca9a652b15b3398f5bcae

Request headers

Origin: https://ecertificatewala.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/json
Accept: */*
Referer: https://ecertificatewala.com/.well-known/NL/d63514f3bdf813d002e74f7090215522/
Sec-Fetch-Dest: empty
X-Requested-With: XMLHttpRequest
X-Netflix.ichnaea.request.type: UiRequest

Response headers

Date: Sun, 22 Mar 2020 12:30:35 GMT
Server: Apache
Connection: close
Content-Length: 674
Content-Type: text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.ecertificatewala.com/	1969-12-31 23:59:59	Name: cL Value: 1584880235710%7C158488023553690057%7C158488023545047546%7C%7C4%7Cundefined

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.nflxext.com
codex.nflxext.com
ecertificatewala.com
2a00:86c0:2090::1
2a00:86c0:2091::1
50.63.14.127
015a58aba75e0e8eed3a5ae186a423fec5f0b7b735666049f83d8febb46b06b1
154e9866c94f43a17d75aed32adc27020f95f614232f8b3cfedd7fc4bf2a48d3
513a48740ec32bd338b529617421735e4538223d82dbb5a33c24c0ad3271291e
8d842cf193c0b64aa139855e78fa16a4900c6df4491f015d6b2d7798f061ec48
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d
b2482301af1ac6d03a5f2eb91520f1e472302130011bcde9d78c5c829cce2e47
ccd46009c8dd1767b90d22595a23b2130cf131ee62cca9a652b15b3398f5bcae

ecertificatewala.com Open in urlscan Pro 50.63.14.127 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

10 Requests

100 %HTTPS

67 %IPv6

2 Domains

3 Subdomains

3 IPs

2 Countries

973 kBTransfer

1537 kBSize

1 Cookies

2 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

10 JavaScript Global Variables

1 Cookies

Indicators

ecertificatewala.com Open in urlscan Pro
50.63.14.127 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

67 %
IPv6

2
Domains

3
Subdomains

3
IPs

2
Countries

973 kB
Transfer

1537 kB
Size

1
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!