f9w1lned0ruqblxi6jahwotak.filesusr.com Open in urlscan Pro
34.102.176.152 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://f9w1lned0ruqblxi6jahwotak.filesusr.com/html/c69417_3a78d13182fce9818213d74210e7f8fe.html?*d2hhdhnzyxaxmcpodhrwczovl2rhcmsubmv0zmxpec5pb...
Submission: On August 17 via automatic, source phishtank (August 17th 2021, 7:03:20 pm UTC)

Summary HTTP 9 Redirects Links 8 Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 9 HTTP transactions. The main IP is 34.102.176.152, located in Kansas City, United States and belongs to GOOGLE, US. The main domain is f9w1lned0ruqblxi6jahwotak.filesusr.com.

This is the only time f9w1lned0ruqblxi6jahwotak.filesusr.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

	IP Address	AS Autonomous System
2	34.102.176.152 34.102.176.152	15169 (GOOGLE) (GOOGLE)
4	2a00:86c0:209... 2a00:86c0:2091::1	40027 (NETFLIX-ASN) (NETFLIX-ASN)
3	2a00:86c0:209... 2a00:86c0:2090::1	40027 (NETFLIX-ASN) (NETFLIX-ASN)
9	3

2 34.102.176.152 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 152.176.102.34.bc.googleusercontent.com

f9w1lned0ruqblxi6jahwotak.filesusr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:86c0:2091::1 (United States)

ASN40027 (NETFLIX-ASN, US)

codex.nflxext.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:86c0:2090::1 (United States)

ASN40027 (NETFLIX-ASN, US)

assets.nflxext.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	nflxext.com codex.nflxext.com assets.nflxext.com	692 KB
2	filesusr.com f9w1lned0ruqblxi6jahwotak.filesusr.com	179 KB
9	2

	Domain	Requested by
4	codex.nflxext.com	f9w1lned0ruqblxi6jahwotak.filesusr.com
3	assets.nflxext.com	f9w1lned0ruqblxi6jahwotak.filesusr.com codex.nflxext.com
2	f9w1lned0ruqblxi6jahwotak.filesusr.com	f9w1lned0ruqblxi6jahwotak.filesusr.com
9	3

This site contains links to these domains. Also see Links.

Domain
policies.google.com
help.netflix.com

Subject Issuer	Validity	Valid
*.1.nflxso.net DigiCert TLS RSA SHA256 2020 CA1	`2021-08-11` - `2021-09-12`	a month	crt.sh

This page contains 1 frames:

Primary Page: http://f9w1lned0ruqblxi6jahwotak.filesusr.com/html/c69417_3a78d13182fce9818213d74210e7f8fe.html?*d2hhdhnzyxaxmcpodhrwczovl2rhcmsubmv0zmxpec5pbyphbnnhz18ymtazqghvdg1hawwuy29tkmvzkmpvc2vhc3jvzhjpz3vlemvaz21hawwuy29t
Frame ID: D3285D554EECC5FFA33FAD757083A331
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Lua (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

OpenResty (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

Google Cloud (CDN) Expand

Overall confidence: 100%
Detected patterns

headers via /^1\.1 google$/i

Page Statistics

9
Requests

78 %
HTTPS

67 %
IPv6

2
Domains

3
Subdomains

3
IPs

1
Countries

870 kB
Transfer

1572 kB
Size

0
Cookies

8 Outgoing links

These are links going to different origins than the main page.

URL: https://policies.google.com/privacy
Title: Política de privacidad

Search URL Search Domain Scan URL

URL: https://policies.google.com/terms
Title: Condiciones del servicio

Search URL Search Domain Scan URL

URL: https://help.netflix.com/support/412
Title: Preguntas frecuentes

Search URL Search Domain Scan URL

URL: https://help.netflix.com/
Title: Centro de ayuda

Search URL Search Domain Scan URL

URL: https://help.netflix.com/legal/termsofuse
Title: Términos de uso

Search URL Search Domain Scan URL

URL: https://help.netflix.com/legal/privacy
Title: Privacidad

Search URL Search Domain Scan URL

URL: https://help.netflix.com/legal/privacy#cookies
Title: Preferencias de cookies

Search URL Search Domain Scan URL

URL: https://help.netflix.com/es/node/2101
Title: Información corporativa

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request c69417_3a78d13182fce9818213d74210e7f8fe.html Show response
f9w1lned0ruqblxi6jahwotak.filesusr.com/html/ 178 KB
179 KB 72ms
31ms Document
text/html 34.102.176.152
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: http://f9w1lned0ruqblxi6jahwotak.filesusr.com/html/c69417_3a78d13182fce9818213d74210e7f8fe.html?*d2hhdhnzyxaxmcpodhrwczovl2rhcmsubmv0zmxpec5pbyphbnnhz18ymtazqghvdg1hawwuy29tkmvzkmpvc2vhc3jvzhjpz3vlemvaz21hawwuy29t
Protocol: HTTP/1.1
Server: 34.102.176.152 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 152.176.102.34.bc.googleusercontent.com
Software: openresty/1.17.8.2 /
Resource Hash: 922cc27512380fc5b4dbb9554c94d664e8e7149234f9fc5c83ad81dbaf08f347

Request headers

Host: f9w1lned0ruqblxi6jahwotak.filesusr.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Server: openresty/1.17.8.2
Date: Tue, 20 Jul 2021 22:11:58 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 182002
X-GUploader-UploadID: ADPycduwCXPFdIOzEscNwsaRxXLc6riOOIEygSCZtN1w-NZ6emZi08DVqm8Nm1FDl2mrLa1rJ6awBwFHKlhR4Z_zNOx4qqvggw
Expires: Tue, 20 Jul 2021 23:11:58 GMT
Last-Modified: Wed, 16 Sep 2020 21:30:05 GMT
ETag: "3a78d13182fce9818213d74210e7f8fe"
x-goog-generation: 1600291805812156
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 182002
x-goog-hash: crc32c=0rwpzA== md5=OnjRMYL86YGCE9dCEOf4/g==
x-goog-storage-class: STANDARD
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Seen-By: gcp.us-central-1.media-router-6f96f966d6-qh2cj
Via: 1.1 google
Cache-Control: public, max-age=15552000, immutable
Age: 2407860

GET
H/1.1 200
OK none Show response
codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-js-vff980d5b/js/js/bootstrap.js,common%7Cbootstrap.js/2/4N034k4a4m06464u4M080o004O4p4J4w4n4I4c4v4y0a024K/bck/true/ 9 KB
4 KB 126ms
105ms Script
application/javascript 2a00:86c0:2091::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-js-vff980d5b/js/js/bootstrap.js,common%7Cbootstrap.js/2/4N034k4a4m06464u4M080o004O4p4J4w4n4I4c4v4y0a024K/bck/true/none

Requested by

Host: f9w1lned0ruqblxi6jahwotak.filesusr.com
URL: http://f9w1lned0ruqblxi6jahwotak.filesusr.com/html/c69417_3a78d13182fce9818213d74210e7f8fe.html?*d2hhdhnzyxaxmcpodhrwczovl2rhcmsubmv0zmxpec5pbyphbnnhz18ymtazqghvdg1hawwuy29tkmvzkmpvc2vhc3jvzhjpz3vlemvaz21hawwuy29t

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2a00:86c0:2091::1 , United States, ASN40027 (NETFLIX-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

2d82fa536e110d6e93bf9d5f017291cdf89ac0f005ed366c40e037c9143fa7d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://f9w1lned0ruqblxi6jahwotak.filesusr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 19:02:58 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx
Content-Type: application/javascript; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=16070400
req_id: 9045ff6b-97ff-470c-8e28-366942af11b9
Connection: keep-alive
Timing-Allow-Origin: https://www.netflix.com
Content-Length: 3629
Expires: Sat, 19 Feb 2022 19:02:58 GMT

GET
H/1.1 200
OK none Show response
codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-js-vff980d5b/js/js/components%7Clogin%7CloginControllerClient.js/2/4N034k4a4m06464u4M080o004O4p4J4w4n4I4c4v4y0a024K/l/true/ 841 KB
258 KB 170ms
149ms Script
application/javascript 2a00:86c0:2091::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-js-vff980d5b/js/js/components%7Clogin%7CloginControllerClient.js/2/4N034k4a4m06464u4M080o004O4p4J4w4n4I4c4v4y0a024K/l/true/none

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2a00:86c0:2091::1 , United States, ASN40027 (NETFLIX-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

8a99f9e6636b529addd0c288b20751340988174fc6912026b9ba1120533bf276

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://f9w1lned0ruqblxi6jahwotak.filesusr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 19:02:58 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx
Transfer-Encoding: chunked
Content-Type: application/javascript; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=16070400
req_id: ce9ba401-e419-46a4-a5fb-4a995d94e687
Connection: keep-alive
Timing-Allow-Origin: https://www.netflix.com
Expires: Sat, 19 Feb 2022 19:02:58 GMT

GET
H/1.1 403
Forbidden WebsiteDetect
f9w1lned0ruqblxi6jahwotak.filesusr.com/personalization/cl2/freeform/ 0
0 293ms
266ms Stylesheet
text/plain 34.102.176.152
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: http://f9w1lned0ruqblxi6jahwotak.filesusr.com/personalization/cl2/freeform/WebsiteDetect?source=wwwhead&fetchType=css&modalView=login
Requested by: Host: f9w1lned0ruqblxi6jahwotak.filesusr.com
URL: http://f9w1lned0ruqblxi6jahwotak.filesusr.com/html/c69417_3a78d13182fce9818213d74210e7f8fe.html?*d2hhdhnzyxaxmcpodhrwczovl2rhcmsubmv0zmxpec5pbyphbnnhz18ymtazqghvdg1hawwuy29tkmvzkmpvc2vhc3jvzhjpz3vlemvaz21hawwuy29t
Protocol: HTTP/1.1
Server: 34.102.176.152 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 152.176.102.34.bc.googleusercontent.com
Software: openresty/1.17.8.2 /
Resource Hash

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: f9w1lned0ruqblxi6jahwotak.filesusr.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://f9w1lned0ruqblxi6jahwotak.filesusr.com/html/c69417_3a78d13182fce9818213d74210e7f8fe.html?*d2hhdhnzyxaxmcpodhrwczovl2rhcmsubmv0zmxpec5pbyphbnnhz18ymtazqghvdg1hawwuy29tkmvzkmpvc2vhc3jvzhjpz3vlemvaz21hawwuy29t
Connection: keep-alive
Cache-Control: no-cache
Referer: http://f9w1lned0ruqblxi6jahwotak.filesusr.com/html/c69417_3a78d13182fce9818213d74210e7f8fe.html?*d2hhdhnzyxaxmcpodhrwczovl2rhcmsubmv0zmxpec5pbyphbnnhz18ymtazqghvdg1hawwuy29tkmvzkmpvc2vhc3jvzhjpz3vlemvaz21hawwuy29t
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 19:02:58 GMT
Via: 1.1 google
Server: openresty/1.17.8.2
Content-Type: text/plain
Access-Control-Allow-Origin: *
Cache-Control: no-cache, private, must-revalidate, proxy-revalidate, no-store
Timing-Allow-Origin: *
Content-Length: 9
X-Seen-By: gcp.us-central-1.media-router-6f96f966d6-d64m2

GET
H/1.1 200
OK none
codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-css-vff980d5b/css/css/less%7Ccore%7Cerror-page.less/1/vFxM3Kw8EJL/none/true/ 11 KB
3 KB 126ms
106ms Stylesheet
text/css 2a00:86c0:2091::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-css-vff980d5b/css/css/less%7Ccore%7Cerror-page.less/1/vFxM3Kw8EJL/none/true/none

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2a00:86c0:2091::1 , United States, ASN40027 (NETFLIX-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

d9bac1aefff045998fd064ed279defcd96c37a53ee0ee3816d1ebab19c1ff739

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://f9w1lned0ruqblxi6jahwotak.filesusr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 19:02:58 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx
Content-Type: text/css; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=16070400
req_id: 3f632710-0da9-4524-b4c8-3ca9765e491a
Connection: keep-alive
Timing-Allow-Origin: https://www.netflix.com
Content-Length: 2595
Expires: Sat, 19 Feb 2022 19:02:58 GMT

GET
H/1.1 200
OK none
codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-css-vff980d5b/css/css/less%7Clogin%7CloginBase.less,less%7Cpages%7Clogin%7CLogin.less/1/vFxM3Kw8EJL/none/true/ 128 KB
21 KB 126ms
106ms Stylesheet
text/css 2a00:86c0:2091::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-css-vff980d5b/css/css/less%7Clogin%7CloginBase.less,less%7Cpages%7Clogin%7CLogin.less/1/vFxM3Kw8EJL/none/true/none

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2a00:86c0:2091::1 , United States, ASN40027 (NETFLIX-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

5031cf92b3fbacf08a1a32ac5261f809097b64f04fb4c96c2b263b794e926a83

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://f9w1lned0ruqblxi6jahwotak.filesusr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 19:02:58 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx
Transfer-Encoding: chunked
Content-Type: text/css; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=16070400
req_id: 69b6a0c7-7f19-47c2-bc3e-6a530bfede22
Connection: keep-alive
Timing-Allow-Origin: https://www.netflix.com
Expires: Sat, 19 Feb 2022 19:02:58 GMT

GET
H/1.1 200
OK MX-es-20200914-popsignuptwoweeks-perspective_alpha_website_large.jpg
assets.nflxext.com/ffe/siteui/vlv3/70731dc8-8977-4ed7-9a0a-421f510aea00/eee627d4-cdcf-419f-a823-ce5864140508/ 331 KB
332 KB 997ms
254ms Image
image/jpeg 2a00:86c0:2090::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.nflxext.com/ffe/siteui/vlv3/70731dc8-8977-4ed7-9a0a-421f510aea00/eee627d4-cdcf-419f-a823-ce5864140508/MX-es-20200914-popsignuptwoweeks-perspective_alpha_website_large.jpg
Requested by: Host: f9w1lned0ruqblxi6jahwotak.filesusr.com
URL: http://f9w1lned0ruqblxi6jahwotak.filesusr.com/html/c69417_3a78d13182fce9818213d74210e7f8fe.html?*d2hhdhnzyxaxmcpodhrwczovl2rhcmsubmv0zmxpec5pbyphbnnhz18ymtazqghvdg1hawwuy29tkmvzkmpvc2vhc3jvzhjpz3vlemvaz21hawwuy29t
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:86c0:2090::1 , United States, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: fbf130ed2e64bf025c167c69e9978010e7100fe23b502e264a5f062010d57be3

Request headers

Referer: http://f9w1lned0ruqblxi6jahwotak.filesusr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 19:02:59 GMT
Last-Modified: Wed, 16 Sep 2020 18:35:58 GMT
Server: nginx
Content-MD5: vJCq8p0mCJ53kbeP/7ZjiA==
Content-Type: image/jpeg
Cache-Control: max-age=604801
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 339349
Expires: Tue, 24 Aug 2021 19:02:59 GMT

GET
H/1.1 200
OK FB-f-Logo__blue_57.png
assets.nflxext.com/ffe/siteui/login/images/ 1 KB
2 KB 710ms
27ms Image
image/png 2a00:86c0:2090::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.nflxext.com/ffe/siteui/login/images/FB-f-Logo__blue_57.png
Requested by: Host: f9w1lned0ruqblxi6jahwotak.filesusr.com
URL: http://f9w1lned0ruqblxi6jahwotak.filesusr.com/html/c69417_3a78d13182fce9818213d74210e7f8fe.html?*d2hhdhnzyxaxmcpodhrwczovl2rhcmsubmv0zmxpec5pbyphbnnhz18ymtazqghvdg1hawwuy29tkmvzkmpvc2vhc3jvzhjpz3vlemvaz21hawwuy29t
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:86c0:2090::1 , United States, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece

Request headers

Referer: http://f9w1lned0ruqblxi6jahwotak.filesusr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 19:02:59 GMT
Last-Modified: Thu, 30 Jun 2016 17:48:49 GMT
Server: nginx
Content-MD5: ozykfvEQtuPsUIa4d2QH0w==
Content-Type: image/png
Cache-Control: max-age=604801
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1455
Expires: Mon, 19 Apr 2021 01:19:24 GMT

GET
H/1.1 200
OK nf-icon-v1-93.woff
assets.nflxext.com/ffe/siteui/fonts/ 72 KB
72 KB 715ms
36ms Font
font/woff 2a00:86c0:2090::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.nflxext.com/ffe/siteui/fonts/nf-icon-v1-93.woff
Requested by: Host: codex.nflxext.com
URL: https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-css-vff980d5b/css/css/less%7Clogin%7CloginBase.less,less%7Cpages%7Clogin%7CLogin.less/1/vFxM3Kw8EJL/none/true/none
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:86c0:2090::1 , United States, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d

Request headers

Origin: http://f9w1lned0ruqblxi6jahwotak.filesusr.com
Referer: https://codex.nflxext.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 19:02:59 GMT
Last-Modified: Mon, 29 Jan 2018 01:50:51 GMT
Server: nginx
Content-MD5: fPYVbMSBJEtaJUNi17c/AA==
Content-Type: font/woff
Access-Control-Allow-Origin: *
Cache-Control: max-age=604801
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 73572
Expires: Sat, 08 May 2021 16:30:28 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

21 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.nflxext.com
codex.nflxext.com
f9w1lned0ruqblxi6jahwotak.filesusr.com
2a00:86c0:2090::1
2a00:86c0:2091::1
34.102.176.152
2d82fa536e110d6e93bf9d5f017291cdf89ac0f005ed366c40e037c9143fa7d6
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece
5031cf92b3fbacf08a1a32ac5261f809097b64f04fb4c96c2b263b794e926a83
8a99f9e6636b529addd0c288b20751340988174fc6912026b9ba1120533bf276
922cc27512380fc5b4dbb9554c94d664e8e7149234f9fc5c83ad81dbaf08f347
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d
d9bac1aefff045998fd064ed279defcd96c37a53ee0ee3816d1ebab19c1ff739
fbf130ed2e64bf025c167c69e9978010e7100fe23b502e264a5f062010d57be3

f9w1lned0ruqblxi6jahwotak.filesusr.com Open in urlscan Pro 34.102.176.152 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

9 Requests

78 %HTTPS

67 %IPv6

2 Domains

3 Subdomains

3 IPs

1 Countries

870 kBTransfer

1572 kBSize

0 Cookies

8 Outgoing links

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

21 JavaScript Global Variables

0 Cookies

Indicators

f9w1lned0ruqblxi6jahwotak.filesusr.com Open in urlscan Pro
34.102.176.152 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

78 %
HTTPS

67 %
IPv6

2
Domains

3
Subdomains

3
IPs

1
Countries

870 kB
Transfer

1572 kB
Size

0
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!