52.194.0.194
Open in
urlscan Pro
52.194.0.194
Malicious Activity!
Public Scan
Effective URL: http://52.194.0.194/wp-content/themes/twentyfifteen/genericons/mynetflex-ukpin0s/zuu6FY0iSQQod4A/
Submission: On May 15 via manual from US
Summary
This is the only time 52.194.0.194 was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Netflix (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 94.100.11.35 94.100.11.35 | 47570 (V2O-SIA-AS) (V2O-SIA-AS) | |
1 5 | 52.194.0.194 52.194.0.194 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
5 | 2 |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-194-0-194.ap-northeast-1.compute.amazonaws.com
52.194.0.194 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
1 |
ppd.lv
www.ppd.lv |
589 B |
5 | 1 |
Domain | Requested by | |
---|---|---|
1 | www.ppd.lv | |
5 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid |
---|
This page contains 1 frames:
Primary Page:
http://52.194.0.194/wp-content/themes/twentyfifteen/genericons/mynetflex-ukpin0s/zuu6FY0iSQQod4A/
Frame ID: DB5883A59189B3179A6D3FA8988CFD64
Requests: 5 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- http://www.ppd.lv//gallery/original/55ca6fdc89c3b.html Page URL
- http://52.194.0.194/wp-content/themes/twentyfifteen/genericons//mynetflex-ukpin0s/ Page URL
-
http://52.194.0.194/wp-content/themes/twentyfifteen/genericons//mynetflex-ukpin0s/zuu6FY0iSQQod4A
HTTP 301
http://52.194.0.194/wp-content/themes/twentyfifteen/genericons/mynetflex-ukpin0s/zuu6FY0iSQQod4A/ Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://www.ppd.lv//gallery/original/55ca6fdc89c3b.html Page URL
- http://52.194.0.194/wp-content/themes/twentyfifteen/genericons//mynetflex-ukpin0s/ Page URL
-
http://52.194.0.194/wp-content/themes/twentyfifteen/genericons//mynetflex-ukpin0s/zuu6FY0iSQQod4A
HTTP 301
http://52.194.0.194/wp-content/themes/twentyfifteen/genericons/mynetflex-ukpin0s/zuu6FY0iSQQod4A/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
5 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
55ca6fdc89c3b.html
www.ppd.lv//gallery/original/ |
334 B 589 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
52.194.0.194/wp-content/themes/twentyfifteen/genericons//mynetflex-ukpin0s/ |
62 B 254 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
52.194.0.194/wp-content/themes/twentyfifteen/genericons/mynetflex-ukpin0s/zuu6FY0iSQQod4A/ Redirect Chain
|
1 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bro.jpg
52.194.0.194/wp-content/themes/twentyfifteen/genericons/mynetflex-ukpin0s/zuu6FY0iSQQod4A/img/ |
5 KB 6 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
brain1.jpg
52.194.0.194/wp-content/themes/twentyfifteen/genericons/mynetflex-ukpin0s/zuu6FY0iSQQod4A/img/ |
217 KB 217 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Netflix (Online)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
www.ppd.lv
52.194.0.194
94.100.11.35
0094a3de822abf00627c6bf12283900cc6de816a1884ef56115f08b579c79ca6
5911c07c8f37009c26697403b7e3b62132deffbf5845ea479595f076ecc0dc84
d0a2a96a065b229b8ce387df24855897bb99436dc4221aa073fd2f4e1c30f74b
ec6273ce42d66a82688ed495be3f2c1224a4c9d079c690d21f89bc24d35fe4f2