urlscan.io logo urlscan.io
SecurityTrails logo

orerwinsaddso.tk Open in urlscan Pro
2606:4700:3035::ac43:88d5  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://orerwinsaddso.tk/NlZ5eEFTTjQ=/index.php
Submission Tags: @jcybersec_
Submission: On July 20 via api from GB
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 17 HTTP transactions. The main IP is 2606:4700:3035::ac43:88d5, located in United States and belongs to CLOUDFLARENET, US. The main domain is orerwinsaddso.tk.
This is the only time orerwinsaddso.tk was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

IP Address AS Autonomous System
11 2606:4700:303... 13335 (CLOUDFLAR...)
2 2a00:86c0:209... 40027 (NETFLIX-ASN)
3 3 2a03:2880:f01... 32934 (FACEBOOK)
3 2a03:2880:f11... 32934 (FACEBOOK)
1 2a01:578:3::3... 16509 (AMAZON-02)
17 4
11    2606:4700:3035::ac43:88d5 (United States)

ASN13335 (CLOUDFLARENET, US)
orerwinsaddso.tk
2    2a00:86c0:2090::1 (United Kingdom)

ASN40027 (NETFLIX-ASN, US)
assets.nflxext.com
3    2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)
staticxx.facebook.com
3    2a03:2880:f11c:8183:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)
www.facebook.com
1    2a01:578:3::34d6:91e9 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
www.netflix.com
Domain Requested by
11 orerwinsaddso.tk orerwinsaddso.tk
3 www.facebook.com orerwinsaddso.tk
3 staticxx.facebook.com 3 redirects
2 assets.nflxext.com orerwinsaddso.tk
1 www.netflix.com orerwinsaddso.tk
17 5

This site contains links to these domains. Also see Links.

Domain
www.netflix.com
help.netflix.com
Subject Issuer Validity Valid
*.1.nflxso.net
DigiCert SHA2 Secure Server CA		 2020-07-17 -
2020-08-18		 a month crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2020-05-14 -
2020-08-05		 3 months crt.sh
www.netflix.com
DigiCert SHA2 Secure Server CA		 2020-01-13 -
2022-01-13		 2 years crt.sh

This page contains 5 frames:

Primary Page: http://orerwinsaddso.tk/NlZ5eEFTTjQ=/index.php
Frame ID: 37A9EF67AEFC6F7BE5E011E8ED7368E6
Requests: 13 HTTP requests in this frame

Frame: http://orerwinsaddso.tk/NlZ5eEFTTjQ=/Netflix_files/xaOI6zd9HW9.html
Frame ID: 0ED83CAC0CE10C2D35E971F190A8E01F
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/connect/xd_arbiter/r/xaOI6zd9HW9.js?version=42
Frame ID: 34C6011EA783DE560813B161C1A1B9DB
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/connect/xd_arbiter/r/xaOI6zd9HW9.js?version=42
Frame ID: BEA836934509203120383B359BBF739D
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/connect/ping?client_id=163114453728333&domain=orerwinsaddso.tk&origin=1&redirect_uri=http%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter%2Fr%2FxaOI6zd9HW9.js%3Fversion%3D42%23cb%3Df3baf0f81b78dc%26domain%3Dorerwinsaddso.tk%26origin%3Dhttp%253A%252F%252Forerwinsaddso.tk%252Ff16ef36d9aab7a8%26relation%3Dparent&response_type=token%2Csigned_request%2Ccode&sdk=joey&version=v2.9
Frame ID: F7342923C0B686AD581BBE7B98B722CC
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i
Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i

Page Statistics

17
Requests

35 %
HTTPS

100 %
IPv6

4
Domains

5
Subdomains

4
IPs

3
Countries

521 kB
Transfer

1434 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 11
  • http://staticxx.facebook.com/connect/xd_arbiter/r/xaOI6zd9HW9.js?version=42 HTTP 302
  • https://staticxx.facebook.com/connect/xd_arbiter/r/xaOI6zd9HW9.js?version=42 HTTP 302
  • https://www.facebook.com/connect/xd_arbiter/r/xaOI6zd9HW9.js?version=42
Request Chain 12
  • https://staticxx.facebook.com/connect/xd_arbiter/r/xaOI6zd9HW9.js?version=42 HTTP 302
  • https://www.facebook.com/connect/xd_arbiter/r/xaOI6zd9HW9.js?version=42

17 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Cookie set index.php
orerwinsaddso.tk/NlZ5eEFTTjQ=/ 		240 KB
67 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://orerwinsaddso.tk/NlZ5eEFTTjQ=/index.php
Protocol
HTTP/1.1
Server
2606:4700:3035::ac43:88d5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
029bd18cc547f1e733302ff47b60b38c0c6d461c883c5fef546b3596602dfdef

Request headers

Host
orerwinsaddso.tk
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 20 Jul 2020 02:22:53 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Set-Cookie
__cfduid=d2b1cfdebed8313330e370a030aa27f1a1595211772; expires=Wed, 19-Aug-20 02:22:52 GMT; path=/; domain=.orerwinsaddso.tk; HttpOnly; SameSite=Lax
Vary
Accept-Encoding
CF-Cache-Status
DYNAMIC
cf-request-id
040ba109da0000c2f928a6c200000001
Server
cloudflare
CF-RAY
5b5937895c47c2f9-FRA
Content-Encoding
gzip
none.js
orerwinsaddso.tk/NlZ5eEFTTjQ=/Netflix_files/ 		24 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://orerwinsaddso.tk/NlZ5eEFTTjQ=/Netflix_files/none.js
Requested by
Host: orerwinsaddso.tk
URL: http://orerwinsaddso.tk/NlZ5eEFTTjQ=/index.php
Protocol
HTTP/1.1
Server
2606:4700:3035::ac43:88d5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
36d6338e657cdef8022ef6782c4a709216a661166abaf141cd55e9286d774fda

Request headers

Referer
http://orerwinsaddso.tk/NlZ5eEFTTjQ=/index.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 20 Jul 2020 02:22:53 GMT
Content-Encoding
gzip
CF-Cache-Status
HIT
Last-Modified
Sat, 18 Jul 2020 21:44:19 GMT
Server
cloudflare
Age
2999
ETag
W/"5f136d33-6127"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=14400
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
5b59378f7ffc1f45-FRA
cf-request-id
040ba10da700001f45bca38200000001
none_002.js
orerwinsaddso.tk/NlZ5eEFTTjQ=/Netflix_files/ 		655 KB
191 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://orerwinsaddso.tk/NlZ5eEFTTjQ=/Netflix_files/none_002.js
Requested by
Host: orerwinsaddso.tk
URL: http://orerwinsaddso.tk/NlZ5eEFTTjQ=/index.php
Protocol
HTTP/1.1
Server
2606:4700:3035::ac43:88d5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
abfe0e1b195380596a8d28abb2d472cc1cc670ac7f8a9582ca45bf3fb1b0950f

Request headers

Referer
http://orerwinsaddso.tk/NlZ5eEFTTjQ=/index.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 20 Jul 2020 02:22:53 GMT
Content-Encoding
gzip
CF-Cache-Status
HIT
Last-Modified
Sat, 18 Jul 2020 21:44:19 GMT
Server
cloudflare
Age
2999
ETag
W/"5f136d33-a3a3b"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=14400
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
5b59378f7833645b-FRA
cf-request-id
040ba10da70000645bd7b50200000001
WebsiteDetect.asc
orerwinsaddso.tk/NlZ5eEFTTjQ=/Netflix_files/ 		0
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://orerwinsaddso.tk/NlZ5eEFTTjQ=/Netflix_files/WebsiteDetect.asc
Requested by
Host: orerwinsaddso.tk
URL: http://orerwinsaddso.tk/NlZ5eEFTTjQ=/index.php
Protocol
HTTP/1.1
Server
2606:4700:3035::ac43:88d5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
http://orerwinsaddso.tk/NlZ5eEFTTjQ=/index.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 20 Jul 2020 02:22:53 GMT
Content-Encoding
gzip
CF-Cache-Status
DYNAMIC
Server
cloudflare
Transfer-Encoding
chunked
Content-Type
text/html; charset=iso-8859-1
Connection
keep-alive
CF-RAY
5b59378f7a5e05bf-FRA
cf-request-id
040ba10da6000005bff69f5200000001
sdk.js
orerwinsaddso.tk/NlZ5eEFTTjQ=/Netflix_files/ 		213 KB
64 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://orerwinsaddso.tk/NlZ5eEFTTjQ=/Netflix_files/sdk.js
Requested by
Host: orerwinsaddso.tk
URL: http://orerwinsaddso.tk/NlZ5eEFTTjQ=/index.php
Protocol
HTTP/1.1
Server
2606:4700:3035::ac43:88d5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d69b388d3d3c136484970f6ee5e1ebb2dfe51fbd4af2ea731d8de40cfce3816e

Request headers

Referer
http://orerwinsaddso.tk/NlZ5eEFTTjQ=/index.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 20 Jul 2020 02:22:53 GMT
Content-Encoding
gzip
CF-Cache-Status
HIT
Last-Modified
Sat, 18 Jul 2020 21:44:19 GMT
Server
cloudflare
Age
2999
ETag
W/"5f136d33-35525"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=14400
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
5b59378f78a6dfbb-FRA
cf-request-id
040ba10da70000dfbbce3d1200000001
none.css
orerwinsaddso.tk/NlZ5eEFTTjQ=/Netflix_files/ 		101 KB
17 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://orerwinsaddso.tk/NlZ5eEFTTjQ=/Netflix_files/none.css
Requested by
Host: orerwinsaddso.tk
URL: http://orerwinsaddso.tk/NlZ5eEFTTjQ=/index.php
Protocol
HTTP/1.1
Server
2606:4700:3035::ac43:88d5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
601553a598f6c89f43b5f373d84fdf182db3af0acd6df215f9e4f62ee6c4dcb6

Request headers

Referer
http://orerwinsaddso.tk/NlZ5eEFTTjQ=/index.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 20 Jul 2020 02:22:53 GMT
Content-Encoding
gzip
CF-Cache-Status
HIT
Last-Modified
Sat, 18 Jul 2020 21:44:19 GMT
Server
cloudflare
Age
2999
ETag
W/"5f136d33-19503"
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=14400
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
5b59378f78ed97d2-FRA
cf-request-id
040ba10da6000097d2bb0eb200000001
FB-f-Logo__blue_57.png
orerwinsaddso.tk/NlZ5eEFTTjQ=/Netflix_files/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://orerwinsaddso.tk/NlZ5eEFTTjQ=/Netflix_files/FB-f-Logo__blue_57.png
Requested by
Host: orerwinsaddso.tk
URL: http://orerwinsaddso.tk/NlZ5eEFTTjQ=/index.php
Protocol
HTTP/1.1
Server
2606:4700:3035::ac43:88d5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece

Request headers

Referer
http://orerwinsaddso.tk/NlZ5eEFTTjQ=/index.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 20 Jul 2020 02:22:53 GMT
CF-Cache-Status
HIT
Last-Modified
Sat, 18 Jul 2020 21:44:19 GMT
Server
cloudflare
Age
2998
ETag
"5f136d33-5af"
Vary
Accept-Encoding
Content-Type
image/png
Cache-Control
max-age=14400
Connection
keep-alive
Accept-Ranges
bytes
CF-RAY
5b59378fc84f645b-FRA
Content-Length
1455
cf-request-id
040ba10dd90000645bd7b51200000001
WebsiteDetect
orerwinsaddso.tk/ichnaea/cl2/freeform/ 		278 B
557 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://orerwinsaddso.tk/ichnaea/cl2/freeform/WebsiteDetect?source=wwwhead&fetchType=js&modalView=login
Requested by
Host: orerwinsaddso.tk
URL: http://orerwinsaddso.tk/NlZ5eEFTTjQ=/index.php
Protocol
HTTP/1.1
Server
2606:4700:3035::ac43:88d5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4e2d1ba25924a7ebec30793e710592b8e8e65af0c1dd78245ac5ab2685c5f2e4

Request headers

Referer
http://orerwinsaddso.tk/NlZ5eEFTTjQ=/index.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 20 Jul 2020 02:22:54 GMT
Content-Encoding
gzip
CF-Cache-Status
DYNAMIC
Server
cloudflare
Transfer-Encoding
chunked
Content-Type
text/html; charset=iso-8859-1
Connection
keep-alive
CF-RAY
5b593792c82205bf-FRA
cf-request-id
040ba10fc1000005bff6a09200000001
WebsiteScreen
orerwinsaddso.tk/ichnaea/cl2/freeform/ 		278 B
557 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://orerwinsaddso.tk/ichnaea/cl2/freeform/WebsiteScreen?source=wwwhead&fetchType=js&winw=1600&winh=1200&screenw=1600&screenh=1200&ratio=1
Requested by
Host: orerwinsaddso.tk
URL: http://orerwinsaddso.tk/NlZ5eEFTTjQ=/index.php
Protocol
HTTP/1.1
Server
2606:4700:3035::ac43:88d5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4e2d1ba25924a7ebec30793e710592b8e8e65af0c1dd78245ac5ab2685c5f2e4

Request headers

Referer
http://orerwinsaddso.tk/NlZ5eEFTTjQ=/index.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 20 Jul 2020 02:22:54 GMT
Content-Encoding
gzip
CF-Cache-Status
DYNAMIC
Server
cloudflare
Transfer-Encoding
chunked
Content-Type
text/html; charset=iso-8859-1
Connection
keep-alive
CF-RAY
5b593792cfa2c2f9-FRA
cf-request-id
040ba10fc10000c2f928a92200000001
login-the-crown_2-1500x1000.jpg
assets.nflxext.com/ffe/siteui/acquisition/login/ 		84 KB
85 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.nflxext.com/ffe/siteui/acquisition/login/login-the-crown_2-1500x1000.jpg
Requested by
Host: orerwinsaddso.tk
URL: http://orerwinsaddso.tk/NlZ5eEFTTjQ=/index.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a00:86c0:2090::1 , United Kingdom, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software
nginx /
Resource Hash
baafd74a4cb4dc594b614eeb45c7267bb1af729d9271752460348ece16532d04

Request headers

Referer
http://orerwinsaddso.tk/NlZ5eEFTTjQ=/Netflix_files/none.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 20 Jul 2020 02:22:53 GMT
Last-Modified
Mon, 24 Oct 2016 20:49:51 GMT
Server
nginx
Content-MD5
5GY/BZWwL7HDlH/B8V64Eg==
Content-Type
image/jpeg
Cache-Control
public, max-age=13100
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
86226
Expires
Mon, 29 Jun 2020 16:22:10 GMT
nf-icon-v1-93.woff
assets.nflxext.com/ffe/siteui/fonts/ 		72 KB
72 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://assets.nflxext.com/ffe/siteui/fonts/nf-icon-v1-93.woff
Requested by
Host: orerwinsaddso.tk
URL: http://orerwinsaddso.tk/NlZ5eEFTTjQ=/index.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a00:86c0:2090::1 , United Kingdom, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software
nginx /
Resource Hash
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
http://orerwinsaddso.tk/NlZ5eEFTTjQ=/Netflix_files/none.css
Origin
http://orerwinsaddso.tk

Response headers

Date
Mon, 20 Jul 2020 02:22:53 GMT
Content-Encoding
gzip
Last-Modified
Mon, 29 Jan 2018 01:50:51 GMT
Server
nginx
Content-MD5
fPYVbMSBJEtaJUNi17c/AA==
Content-Type
text/plain
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=7260
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
73566
Expires
Fri, 15 May 2020 03:30:20 GMT
xaOI6zd9HW9.html
orerwinsaddso.tk/NlZ5eEFTTjQ=/Netflix_files/ Frame 0ED8 		42 KB
14 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://orerwinsaddso.tk/NlZ5eEFTTjQ=/Netflix_files/xaOI6zd9HW9.html
Requested by
Host: orerwinsaddso.tk
URL: http://orerwinsaddso.tk/NlZ5eEFTTjQ=/index.php
Protocol
HTTP/1.1
Server
2606:4700:3035::ac43:88d5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d9013ca6d10e27a1c53881852fd9bc126a0f92eb0392f7138acae4bf8947e2f3

Request headers

Host
orerwinsaddso.tk
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer
http://orerwinsaddso.tk/NlZ5eEFTTjQ=/index.php
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Cookie
__cfduid=d2b1cfdebed8313330e370a030aa27f1a1595211772; cL=1595211773959%7C159521177383571924%7C159521177388282527%7C%7C4%7CUNPYKR5TOVFFFKE6OU2YTRLYFY
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
http://orerwinsaddso.tk/NlZ5eEFTTjQ=/index.php

Response headers

Date
Mon, 20 Jul 2020 02:22:54 GMT
Content-Type
text/html
Transfer-Encoding
chunked
Connection
keep-alive
Last-Modified
Sat, 18 Jul 2020 21:44:19 GMT
Vary
Accept-Encoding
CF-Cache-Status
DYNAMIC
cf-request-id
040ba1105c0000645bd7b55200000001
Server
cloudflare
CF-RAY
5b593793c91c645b-FRA
Content-Encoding
gzip
xaOI6zd9HW9.js
www.facebook.com/connect/xd_arbiter/r/ Frame 34C6
Redirect Chain
  • http://staticxx.facebook.com/connect/xd_arbiter/r/xaOI6zd9HW9.js?version=42
  • https://staticxx.facebook.com/connect/xd_arbiter/r/xaOI6zd9HW9.js?version=42
  • https://www.facebook.com/connect/xd_arbiter/r/xaOI6zd9HW9.js?version=42
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/connect/xd_arbiter/r/xaOI6zd9HW9.js?version=42
Requested by
Host: orerwinsaddso.tk
URL: http://orerwinsaddso.tk/NlZ5eEFTTjQ=/Netflix_files/sdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

:method
GET
:authority
www.facebook.com
:scheme
https
:path
/connect/xd_arbiter/r/xaOI6zd9HW9.js?version=42
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
http://orerwinsaddso.tk/NlZ5eEFTTjQ=/index.php
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
about:blank

Response headers

status
404
cache-control
private, no-cache, no-store, must-revalidate
expires
Sat, 01 Jan 2000 00:00:00 GMT
pragma
no-cache
strict-transport-security
max-age=15552000; preload
x-content-type-options
nosniff
content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
x-xss-protection
0
x-frame-options
DENY
content-type
text/html; charset="utf-8"
x-fb-debug
0zi0uWWIEIlTcYJ4WD0K/NVLxKRV9GuUUZced1bCyl//0dRbxfxewjSpJQURFOmQzzvRYfQ9+qfoMdKPDXx+wQ==
content-length
72
date
Mon, 20 Jul 2020 02:22:54 GMT
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600

Redirect headers

status
302
location
https://www.facebook.com/connect/xd_arbiter/r/xaOI6zd9HW9.js?version=42
strict-transport-security
max-age=15552000; preload
content-type
text/html; charset="utf-8"
x-fb-debug
clk8wljdQvNvG+me/H5ys1V8CGHn8DT8brUd1xS+rmvYoOMvjnv4P+vB3J4u/AhEc3CKPIM26fR3ki2Ss7+grw==
content-length
0
x-fb-trip-id
664085054
date
Mon, 20 Jul 2020 02:22:54 GMT
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
xaOI6zd9HW9.js
www.facebook.com/connect/xd_arbiter/r/ Frame BEA8
Redirect Chain
  • https://staticxx.facebook.com/connect/xd_arbiter/r/xaOI6zd9HW9.js?version=42
  • https://www.facebook.com/connect/xd_arbiter/r/xaOI6zd9HW9.js?version=42
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/connect/xd_arbiter/r/xaOI6zd9HW9.js?version=42
Requested by
Host: orerwinsaddso.tk
URL: http://orerwinsaddso.tk/NlZ5eEFTTjQ=/Netflix_files/sdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

:method
GET
:authority
www.facebook.com
:scheme
https
:path
/connect/xd_arbiter/r/xaOI6zd9HW9.js?version=42
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
http://orerwinsaddso.tk/NlZ5eEFTTjQ=/index.php
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
about:blank

Response headers

status
404
cache-control
private, no-cache, no-store, must-revalidate
expires
Sat, 01 Jan 2000 00:00:00 GMT
pragma
no-cache
strict-transport-security
max-age=15552000; preload
x-content-type-options
nosniff
content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
x-xss-protection
0
x-frame-options
DENY
content-type
text/html; charset="utf-8"
x-fb-debug
Nf21xtDdejeqQKikrbm9OTUH++qulnbCQTI+LZprEzAvl6HhijdbZfC5tK0X2nL6S/t+j6cFEK/artkH4mtwlw==
content-length
72
date
Mon, 20 Jul 2020 02:22:54 GMT
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600

Redirect headers

status
302
location
https://www.facebook.com/connect/xd_arbiter/r/xaOI6zd9HW9.js?version=42
strict-transport-security
max-age=15552000; preload
content-type
text/html; charset="utf-8"
x-fb-debug
NZQgU0+wCIiXMnir/OiK8rz8NlT0opodFttwVCMafVQiuq1INu9sUCQFz7c0V4pSQxBOn7Lj+KyeyoE/kuxJpA==
content-length
0
x-fb-trip-id
664085054
date
Mon, 20 Jul 2020 02:22:54 GMT
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
ping
www.facebook.com/connect/ Frame F734 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/connect/ping?client_id=163114453728333&domain=orerwinsaddso.tk&origin=1&redirect_uri=http%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter%2Fr%2FxaOI6zd9HW9.js%3Fversion%3D42%23cb%3Df3baf0f81b78dc%26domain%3Dorerwinsaddso.tk%26origin%3Dhttp%253A%252F%252Forerwinsaddso.tk%252Ff16ef36d9aab7a8%26relation%3Dparent&response_type=token%2Csigned_request%2Ccode&sdk=joey&version=v2.9
Requested by
Host: orerwinsaddso.tk
URL: http://orerwinsaddso.tk/NlZ5eEFTTjQ=/Netflix_files/sdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
www.facebook.com
:scheme
https
:path
/connect/ping?client_id=163114453728333&domain=orerwinsaddso.tk&origin=1&redirect_uri=http%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter%2Fr%2FxaOI6zd9HW9.js%3Fversion%3D42%23cb%3Df3baf0f81b78dc%26domain%3Dorerwinsaddso.tk%26origin%3Dhttp%253A%252F%252Forerwinsaddso.tk%252Ff16ef36d9aab7a8%26relation%3Dparent&response_type=token%2Csigned_request%2Ccode&sdk=joey&version=v2.9
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
http://orerwinsaddso.tk/NlZ5eEFTTjQ=/index.php
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
http://orerwinsaddso.tk/NlZ5eEFTTjQ=/index.php

Response headers

status
200
cache-control
private, no-cache, no-store, must-revalidate
pragma
no-cache
strict-transport-security
max-age=15552000; preload
content-encoding
br
content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
expires
Sat, 01 Jan 2000 00:00:00 GMT
content-type
text/html; charset="utf-8"
x-fb-debug
3GmOsLs/+nORDWzPlAfzWpi45enNdxG1C8zyXJiSF0OkG4gte9g8U7NWmnEtrDysbnsGa4anDumEtpHdWxxoHQ==
date
Mon, 20 Jul 2020 02:22:54 GMT
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
log
orerwinsaddso.tk/ichnaea/ 		278 B
557 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://orerwinsaddso.tk/ichnaea/log
Requested by
Host: orerwinsaddso.tk
URL: http://orerwinsaddso.tk/NlZ5eEFTTjQ=/Netflix_files/none_002.js
Protocol
HTTP/1.1
Server
2606:4700:3035::ac43:88d5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4e2d1ba25924a7ebec30793e710592b8e8e65af0c1dd78245ac5ab2685c5f2e4

Request headers

Accept
*/*
Referer
http://orerwinsaddso.tk/NlZ5eEFTTjQ=/index.php
X-Netflix.ichnaea.request.type
UiRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
X-Requested-With
XMLHttpRequest
Content-Type
application/json

Response headers

Date
Mon, 20 Jul 2020 02:22:54 GMT
Content-Encoding
gzip
CF-Cache-Status
DYNAMIC
Server
cloudflare
Transfer-Encoding
chunked
Content-Type
text/html; charset=iso-8859-1
Connection
keep-alive
CF-RAY
5b593793ffafdfbb-FRA
cf-request-id
040ba1107c0000dfbbce3ed200000001
cl2
www.netflix.com/ichnaea/ 		0
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.netflix.com/ichnaea/cl2
Requested by
Host: orerwinsaddso.tk
URL: http://orerwinsaddso.tk/NlZ5eEFTTjQ=/Netflix_files/none_002.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a01:578:3::34d6:91e9 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
clingest-secure i-01de9ebae6d000513 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
http://orerwinsaddso.tk/NlZ5eEFTTjQ=/index.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
application/json

Response headers

Date
Mon, 20 Jul 2020 02:22:58 GMT
Via
1.1 i-0f63ac119696e7e43 (eu-west-1)
X-Content-Type-Options
nosniff
X-Netflix_proxy_execution-time
18
Connection
keep-alive
Content-Length
0
X-XSS-Protection
1; mode=block
Pragma
no-cache
Allow
GET, POST, OPTIONS
Server
clingest-secure i-01de9ebae6d000513
X-Frame-Options
DENY
X-Netflix_nfstatus
1_1
Strict-Transport-Security
max-age=31536000
Access-Control-Allow-Methods
GET, POST, OPTIONS
X-Originating-URL
https://www.netflix.com/ichnaea/cl2
Access-Control-Allow-Origin
http://orerwinsaddso.tk
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
X-Ichnaea
~0=true~RL=0
Access-Control-Allow-Headers
Accept,Authorization,Content-Type,Cookie,debugRequest,X-Netflix.application.name,X-Netflix.application.version,X-Netflix.certification.version,X-Netflix.Client.Request.Name,X-Netflix.device.type,X-Netflix.esn,X-Netflix.ichnaea.request.type,X-Netflix.oauth.consumer.key,X-Netflix.oauth.token,X-Netflix.request.uuid,X-Netflix.user.id
Expires
0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| FB object| netflix object| Codex object| C object| global object| process object| __core-js_shared__ object| util function| jQuery object| jQuery1111041044149754047554 function| fbAsyncInit

2 Cookies

Domain/Path Name / Value
.orerwinsaddso.tk/ Name: cL
Value: 1595211773959%7C159521177383571924%7C159521177388282527%7C%7C4%7CUNPYKR5TOVFFFKE6OU2YTRLYFY
.orerwinsaddso.tk/ Name: __cfduid
Value: d2b1cfdebed8313330e370a030aa27f1a1595211772